| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Viren, Trojaner, Malware auf meinem PC. AntiVir findet, löscht und findet wieder.Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
08.07.2010, 00:57
| #1 |
| |  Viren, Trojaner, Malware auf meinem PC. AntiVir findet, löscht und findet wieder. Ich hoffe, ich folge den Regeln des Boards. Zu gerne würde ich eure Hilfe in Anspruch nehmen. Seit ein paar Tagen mehren sich die Probleme mit bösartiger Software, doch ich weiß nicht recht, wie ich sie lösen kann. Zunächst einmal die Beschreibung des Vorgefallenen: Ich habe in meiner Dummheit zwei Dateien heruntergeladen, die offenbar nicht ganz sauber waren. Anschließend begann nämlich erst, was ich jetzt berichten kann. Es öffneten sich wahllos und ohne Aufforderung Fenster des Internet Explorer und präsentierten Werbeseiten. Alle paar Minuten eine Neue. AntiVir fand Viren, Malware und Trojaner, die sich löschen ließen, in unregelmäßigen Abständen aber immer wieder gefunden wurden. Ein kompletter Scan durch AntiVir hat das Problem vorübergehend gelöst. Spätestens nach dem Neustart ging aber alles wieder von vorne los, nur die Werbeseiten öffneten sich nicht mehr. Ein Scan durch AntiVir löst meine Probleme offensichtlich nicht, weil die schon zuvor gefundenen Problem-Programme immer wieder aufs Neue zu entstehen scheinen. Da ist irgendwo ein Nest.  Im Detail: Fehlermeldung nach dem Starten des Laptops: „RunDLL Fehler beim Laden von C:\Users\Lars\AppData\Local\Temp\sshnas21.dll Das angegebene Modul wurde nicht gefunden.“ Antivir findet (unter anderem): „Erkennungsmuster des Wurmes WORM/Iksmas.hsz“ in „C:\Users\****\AppData\Local\Temp\970.exe“ „Erkennungsmuster des (gefährlichen) Backdoorprogrammes BDS/Bredolab.fkl“ in „C:\Users\****\AppData\Local\Temp\6901158.exe“ „Das Trojanische Pferd TR/Agent.HF.30 in „C:\Users\****\AppData\Local\Temp\733.exe“ Die zwei zuletzt genannten außerdem nochmal in „C:\Users\****\AppData\Local\Microsoft\Windows\ […]“ Die empfohlene Vorangehensweise: 1. Abgesehen von der ungenutzten Datei-Endung, die nicht zu löschen ist, weil AntiVir installiert ist, konnte CCleaner alle Fehler beheben. 2. Malwarebytes Anti-Malware gesteht „Bestimmte Objekte konnten nicht entfernt werden.“ Log-Datei: Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Datenbank Version: 4290 Windows 6.0.6002 Service Pack 2 Internet Explorer 7.0.6002.18005 08.07.2010 01:17:08 mbam-log-2010-07-08 (01-17-08).txt Art des Suchlaufs: Quick-Scan Durchsuchte Objekte: 136201 Laufzeit: 5 Minute(n), 30 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 3 Infizierte Registrierungswerte: 1 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 3 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: HKEY_CURRENT_USER\SOFTWARE\UBC5AB1IDP (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\EWABQAF7KL (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell (Malware.Trace) -> Quarantined and deleted successfully. Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: C:\Users\****\csrss.exe (Trojan.Agent) -> Delete on reboot. C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Windows\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job (Trojan.Downloader) -> Quarantined and deleted successfully. 3. RSIT notiert folgendes, wenn ich es durch mein System jage: (1) log.txt[I] RSIT Logfile: Code:
ATTFilter Logfile of random's system information tool 1.07 (written by random/random) Run by **** at 2010-07-08 01:27:23 Microsoft® Windows Vista™ Home Premium Service Pack 2 System drive C: has 51 GB (52%) free of 98 GB Total RAM: 3066 MB (64% free) Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 01:27:43, on 08.07.2010 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v7.00 (7.00.6002.18005) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe D:\Programme\Avira\AntiVir Desktop\avgnt.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe D:\Programme\iTunes\iTunesHelper.exe C:\Program Files\Citrix\ICA Client\concentr.exe C:\Program Files\Windows Sidebar\sidebar.exe D:\Programme\DAEMON Tools Lite\DTLite.exe C:\Program Files\Citrix\ICA Client\wfcrun32.exe C:\Windows\system32\SearchFilterHost.exe C:\Users\Lars\Desktop\RSIT.exe C:\Program Files\trend micro\Lars.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe O4 - HKLM\..\Run: [avgnt] "D:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Programme\Adobe\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "D:\Programme\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "D:\Programme\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [ConnectionCenter] "C:\Program Files\Citrix\ICA Client\concentr.exe" /startup O4 - HKLM\..\Run: [ Malwarebytes Anti-Malware (reboot)] "D:\Programme\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\Programme\DAEMON Tools Lite\DTLite.exe" -autorun O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-21-6710304-3433624121-992636011-1001\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'postgres') O4 - Global Startup: VPN Client.lnk = ? O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Cool Hand Poker - {00000000-0000-0000-0000-000000000000} - C:\MicroGaming\Poker\coolhandMPP\MPPoker.exe (HKCU) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O18 - Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll O18 - Filter hijack: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - D:\Programme\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - D:\Programme\Avira\AntiVir Desktop\avguard.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe O23 - Service: Dienst "Bonjour" (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\Windows\system32\brsvc01a.exe O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe O23 - Service: Dragon Age: Origins - Inhaltsupdater (DAUpdaterSvc) - BioWare - D:\Programme\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe O23 - Service: PostgreSQL Server 8.4 (postgresql-8.4) - PostgreSQL Global Development Group - C:/Program Files/PostgreSQL/8.4/bin/pg_ctl.exe O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe -- End of file - 7515 bytes ======Scheduled tasks folder====== C:\Windows\tasks\User_Feed_Synchronization-{A39CB0E9-224B-49F3-A4EA-4874F36B50CC}.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}] Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-05-27 41760] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-21 1008184] "RtHDVCpl"=C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [2009-07-20 7625248] "avgnt"=D:\Programme\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153] "BrMfcWnd"=C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [2007-02-15 622592] "ControlCenter3"=C:\Program Files\Brother\ControlCenter3\brctrcen.exe [2006-07-19 65536] "GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072] "Adobe Reader Speed Launcher"=D:\Programme\Adobe\Reader\Reader_sl.exe [2010-06-20 35760] "Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832] "NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2009-07-02 13789728] "SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040] "QuickTime Task"=D:\Programme\QuickTime\QTTask.exe [2010-03-17 421888] "iTunesHelper"=D:\Programme\iTunes\iTunesHelper.exe [2010-04-28 142120] "ConnectionCenter"=C:\Program Files\Citrix\ICA Client\concentr.exe [2010-03-11 300400] " Malwarebytes Anti-Malware (reboot)"=D:\Programme\Malwarebytes' Anti-Malware\mbam.exe [2010-04-29 1090952] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-04-11 1233920] "DAEMON Tools Lite"=D:\Programme\DAEMON Tools Lite\DTLite.exe [2009-10-30 369200] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup VPN Client.lnk - C:\Windows\Installer\{08B785C1-3893-4154-B53B-F5D341D0AAAA}\Icon3E5562ED7.ico [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "EnableUIADesktopToggle"=0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "BindDirectlyToPropertySetStorage"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7e0724bc-1290-11df-89f6-806e6f6e6963}] shell\AutoRun\command - E:\monsetup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8da2a376-17b7-11df-86a6-001f160b6d58}] shell\AutoRun\command - G:\SETUP.EXE shell\configure\command - G:\SETUP.EXE shell\install\command - G:\SETUP.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ac37f57d-51ec-11df-856d-001f160b6d58}] shell\AutoRun\command - H:\PRVA\\\\\\\\\\STRANA.exe shell\explore\command - H:\PRVA\\\\\\\\\\\\STRANA.exe shell\open\command - H:\PRVA\\\\\\\\\\\\STRANA.exe ======List of files/folders created in the last 1 months====== 2010-07-08 01:27:23 ----D---- C:\rsit 2010-07-08 01:27:23 ----D---- C:\Program Files\trend micro 2010-07-08 00:55:45 ----D---- C:\Users\****\AppData\Roaming\Malwarebytes 2010-07-08 00:55:36 ----D---- C:\ProgramData\Malwarebytes 2010-06-22 22:35:19 ----D---- C:\Windows\system32\WindowsPowerShell 2010-06-22 22:32:49 ----A---- C:\Windows\system32\winrsmgr.dll 2010-06-22 22:32:29 ----A---- C:\Windows\system32\wsmprovhost.exe 2010-06-22 22:32:29 ----A---- C:\Windows\system32\winrshost.exe 2010-06-22 22:32:29 ----A---- C:\Windows\system32\winrs.exe 2010-06-22 22:32:25 ----A---- C:\Windows\system32\wsmplpxy.dll 2010-06-22 22:32:25 ----A---- C:\Windows\system32\winrssrv.dll 2010-06-22 22:32:22 ----A---- C:\Windows\system32\wevtfwd.dll 2010-06-22 22:32:22 ----A---- C:\Windows\system32\wecutil.exe 2010-06-22 22:32:22 ----A---- C:\Windows\system32\wecapi.dll 2010-06-22 22:32:21 ----A---- C:\Windows\system32\WsmRes.dll 2010-06-22 22:32:21 ----A---- C:\Windows\system32\wecsvc.dll 2010-06-22 22:32:21 ----A---- C:\Windows\system32\pwrshplugin.dll 2010-06-22 22:32:12 ----A---- C:\Windows\system32\winrm.vbs 2010-06-22 22:32:10 ----A---- C:\Windows\system32\WsmWmiPl.dll 2010-06-22 22:32:10 ----A---- C:\Windows\system32\WsmAuto.dll 2010-06-22 22:32:10 ----A---- C:\Windows\system32\WSManMigrationPlugin.dll 2010-06-22 22:32:10 ----A---- C:\Windows\system32\WSManHTTPConfig.exe 2010-06-22 22:32:10 ----A---- C:\Windows\system32\winrscmd.dll 2010-06-22 22:32:09 ----A---- C:\Windows\system32\WsmSvc.dll 2010-06-22 22:22:43 ----A---- C:\Windows\system32\PresentationHostProxy.dll 2010-06-22 22:22:43 ----A---- C:\Windows\system32\PresentationHost.exe 2010-06-22 22:22:43 ----A---- C:\Windows\system32\netfxperf.dll 2010-06-22 22:22:43 ----A---- C:\Windows\system32\mscoree.dll 2010-06-22 22:22:43 ----A---- C:\Windows\system32\dfshim.dll 2010-06-22 22:22:14 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll 2010-06-22 22:22:14 ----A---- C:\Windows\system32\Apphlpdm.dll 2010-06-17 03:18:43 ----D---- C:\Users\Lars\AppData\Roaming\dvdcss 2010-06-15 23:50:05 ----A---- C:\Windows\system32\javaws.exe 2010-06-15 23:50:05 ----A---- C:\Windows\system32\javaw.exe 2010-06-15 23:50:05 ----A---- C:\Windows\system32\java.exe 2010-06-15 23:50:05 ----A---- C:\Windows\system32\deployJava1.dll 2010-06-10 18:46:19 ----D---- C:\Windows\Minidump 2010-06-09 21:47:17 ----A---- C:\Windows\system32\mshtml.dll 2010-06-09 21:47:16 ----A---- C:\Windows\system32\wininet.dll 2010-06-09 21:47:16 ----A---- C:\Windows\system32\urlmon.dll 2010-06-09 21:47:15 ----A---- C:\Windows\system32\mshtmled.dll 2010-06-09 21:47:15 ----A---- C:\Windows\system32\ieui.dll 2010-06-09 21:47:15 ----A---- C:\Windows\system32\iepeers.dll 2010-06-09 21:47:15 ----A---- C:\Windows\system32\ieframe.dll 2010-06-09 21:47:15 ----A---- C:\Windows\system32\ieencode.dll 2010-06-09 21:47:14 ----A---- C:\Windows\system32\ieapfltr.dll 2010-06-09 21:46:27 ----A---- C:\Windows\system32\asycfilt.dll 2010-06-09 21:46:25 ----A---- C:\Windows\system32\atmlib.dll 2010-06-09 21:46:25 ----A---- C:\Windows\system32\atmfd.dll ======List of files/folders modified in the last 1 months====== 2010-07-08 01:27:30 ----D---- C:\Windows\Temp 2010-07-08 01:27:23 ----RD---- C:\Program Files 2010-07-08 01:20:52 ----D---- C:\Windows 2010-07-08 01:20:44 ----D---- C:\Windows\system32\drivers 2010-07-08 01:20:44 ----D---- C:\Windows\Registration 2010-07-08 01:17:08 ----D---- C:\Windows\Tasks 2010-07-08 00:55:36 ----HD---- C:\ProgramData 2010-07-08 00:48:20 ----D---- C:\Windows\Debug 2010-07-08 00:34:27 ----D---- C:\Users\****\AppData\Roaming\Skype 2010-07-08 00:33:54 ----D---- C:\Users\****\AppData\Roaming\skypePM 2010-07-06 21:12:03 ----D---- C:\Windows\system32\Tasks 2010-07-06 13:47:21 ----SHD---- C:\System Volume Information 2010-07-05 16:45:54 ----D---- C:\Windows\Prefetch 2010-07-03 14:55:22 ----D---- C:\Windows\system32\catroot2 2010-07-03 11:47:53 ----D---- C:\Windows\System32 2010-07-03 11:47:53 ----D---- C:\Windows\inf 2010-07-03 11:47:53 ----A---- C:\Windows\system32\PerfStringBackup.INI 2010-07-03 00:37:45 ----SHD---- C:\Windows\Installer 2010-06-29 13:08:29 ----D---- C:\Windows\system32\catroot 2010-06-27 03:37:56 ----D---- C:\Users\****\AppData\Roaming\vlc 2010-06-22 23:30:09 ----D---- C:\Windows\rescache 2010-06-22 23:15:08 ----D---- C:\Windows\Microsoft.NET 2010-06-22 23:15:03 ----RSD---- C:\Windows\assembly 2010-06-22 22:53:36 ----D---- C:\Windows\AppPatch 2010-06-22 22:36:49 ----D---- C:\Windows\winsxs 2010-06-22 22:35:23 ----D---- C:\Windows\system32\de-DE 2010-06-22 22:35:23 ----D---- C:\Windows\PolicyDefinitions 2010-06-22 22:31:32 ----D---- C:\Windows\ehome 2010-06-22 22:24:15 ----D---- C:\Windows\system32\en-US 2010-06-22 22:24:11 ----D---- C:\Program Files\Microsoft.NET 2010-06-22 13:57:03 ----D---- C:\Windows\system32\LogFiles 2010-06-16 22:42:52 ----SD---- C:\Users\****\AppData\Roaming\Microsoft 2010-06-15 23:49:59 ----D---- C:\Program Files\Java 2010-06-15 00:05:18 ----D---- C:\Users\****\AppData\Roaming\Microgaming 2010-06-13 12:50:03 ----D---- C:\Windows\system32\WDI 2010-06-10 18:46:39 ----D---- C:\Users\****\AppData\Roaming\Apple Computer 2010-06-10 15:00:31 ----HD---- C:\Program Files\InstallShield Installation Information 2010-06-09 21:55:22 ----D---- C:\Program Files\Windows Mail 2010-06-09 21:48:28 ----D---- C:\Windows\system32\wbem ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 avgio;avgio; \??\D:\Programme\Avira\AntiVir Desktop\avgio.sys [2009-02-13 11608] R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2009-03-30 96104] R1 ctxusbm;Citrix USB Monitor Driver; C:\Windows\system32\DRIVERS\ctxusbm.sys [2009-10-05 65584] R1 ssmdrv;ssmdrv; C:\Windows\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520] R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2009-11-25 56816] R2 CVPNDRVA;Cisco Systems Inc. IPSec Driver; \??\C:\Windows\system32\Drivers\CVPNDRVA.sys [2009-08-23 308859] R3 CmBatt;Treiber für Microsoft-ACPI-Kontrollmethodenkompatible Batterie; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-21 14208] R3 DNE;Deterministic Network Enhancer Miniport; C:\Windows\system32\DRIVERS\dne2000.sys [2008-11-16 131984] R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600] R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2009-07-20 2664032] R3 NETw5v32;Intel(R) Wireless WiFi Link Adaptertreiber für Windows Vista 32-Bit; C:\Windows\system32\DRIVERS\NETw5v32.sys [2008-04-28 3658752] R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda32v.sys [2009-06-26 66080] R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2009-07-01 9786752] R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2010-03-04 261152] R3 StillCam;Treiber für serielle Digitalkamera; C:\Windows\system32\DRIVERS\serscan.sys [2008-01-21 9216] R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2008-01-21 11264] R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328] R3 XUIF;X10 USB Wireless Transceiver; C:\Windows\System32\Drivers\x10ufx2.sys [2006-11-30 27416] S3 arbmbuhd;arbmbuhd; C:\Windows\system32\drivers\arbmbuhd.sys [] S3 CVirtA;Cisco Systems VPN Adapter; C:\Windows\system32\DRIVERS\CVirtA.sys [2007-01-18 5275] S3 drmkaud;Microsoft Kernel-DRM-Audioentschlüsselung; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632] S3 HdAudAddService;Microsoft 1.1 UAA-Funktionstreiber für High Definition Audio-Dienst; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520] S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192] S3 MSPCLOCK;Microsoft Proxy für Streaming Clock; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888] S3 MSPQM;Microsoft Proxy für Streaming Quality Manager; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504] S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016] S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656] S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 AntiVirSchedulerService;Avira AntiVir Planer; D:\Programme\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289] R2 AntiVirService;Avira AntiVir Guard; D:\Programme\Avira\AntiVir Desktop\avguard.exe [2009-07-21 185089] R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [2010-04-16 144672] R2 Bonjour Service;Dienst "Bonjour"; C:\Program Files\Bonjour\mDNSResponder.exe [2010-04-08 345376] R2 Brother XP spl Service;BrSplService; C:\Windows\system32\brsvc01a.exe [2002-04-12 57344] R2 CVPND;Cisco Systems, Inc. VPN Service; C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe [2009-08-23 1528624] R2 EvtEng;Intel® PROSet/Wireless Event Log; C:\Program Files\Intel\WiFi\bin\EvtEng.exe [2008-04-30 815104] R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2009-07-02 211488] R2 postgresql-8.4;PostgreSQL Server 8.4; C:/Program Files/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N postgresql-8.4 -D C:/Program Files/PostgreSQL/8.4/data -w [] R2 RegSrvc;Intel® PROSet/Wireless Registry Service; C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe [2008-04-30 466944] R3 iPod Service;iPod-Dienst; C:\Program Files\iPod\bin\iPodService.exe [2010-04-28 545576] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] S3 DAUpdaterSvc;Dragon Age: Origins - Inhaltsupdater; D:\Programme\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe [2009-07-26 25832] S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2010-04-21 654848] S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-21 21504] S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888] S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712] S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184] S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2010-04-16 332720] S3 WPFFontCache_v0400;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100; C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504] -----------------EOF----------------- (2) info.txt [I]info.txtRSIT Logfile: Code:
ATTFilter logfile of random's system information tool 1.06 2010-07-08 01:27:44
======Uninstall list======
-->D:\Programme\DivX\DivXConverterUninstall.exe /CONVERTER
-->MsiExec /X{1C4551A6-4743-4093-91E4-1477CD655043}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0015-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0016-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0018-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0019-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001A-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001B-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {A0516415-ED61-419A-981D-93596DA74165}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0410-0000-0000000FF1CE} /uninstall {322296D4-1EAE-4030-9FBC-D2787EB25FA2}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-0044-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-006E-0407-0000-0000000FF1CE} /uninstall {26454C26-D259-4543-AA60-3189E09C5F76}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-00A1-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B}
2007 Microsoft Office Suite Service Pack 2 (SP2)-->msiexec /package {90120000-00BA-0407-0000-0000000FF1CE} /uninstall {9BD40163-B95D-4B07-8991-0AB775B6D88B}
Adobe Anchor Service CS3-->MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95}
Adobe Asset Services CS3-->MsiExec.exe /I{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}
Adobe Bridge CS3-->MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394}
Adobe Bridge Start Meeting-->MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23}
Adobe Camera Raw 4.0-->MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}
Adobe CMaps-->MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}
Adobe Color - Photoshop Specific-->MsiExec.exe /I{A2D81E70-2A98-4A08-A628-94388B063C5E}
Adobe Color Common Settings-->MsiExec.exe /I{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}
Adobe Color EU Recommended Settings-->MsiExec.exe /I{73B5D990-04EA-4751-B10F-5534770B91F2}
Adobe Color JA Extra Settings-->MsiExec.exe /I{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}
Adobe Color NA Extra Settings-->MsiExec.exe /I{FF29A7E2-FF40-4D07-B7E4-2093DE59E10A}
Adobe Default Language CS3-->MsiExec.exe /I{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}
Adobe Device Central CS3-->MsiExec.exe /I{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}
Adobe ExtendScript Toolkit 2-->MsiExec.exe /I{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}
Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\FlashUtil10h_Plugin.exe -maintain plugin
Adobe Fonts All-->MsiExec.exe /I{6ABE0BEE-D572-4FE8-B434-9E72A289431B}
Adobe Help Viewer CS3-->MsiExec.exe /I{04AF207D-9A77-465A-8B76-991F6AB66245}
Adobe Linguistics CS3-->MsiExec.exe /I{54793AA1-5001-42F4-ABB6-C364617C6078}
Adobe PDF Library Files-->MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}
Adobe Photoshop CS3-->C:\Program Files\Common Files\Adobe\Installers\5f143314a5d434c8511097393d17397\Setup.exe
Adobe Photoshop CS3-->MsiExec.exe /I{29F05234-DCBB-4FE0-88DC-5160C9250312}
Adobe Reader 9.3.3 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A93000000001}
Adobe Setup-->MsiExec.exe /I{F01F79AD-1F47-4685-AE4E-CCFA4EA9FF7C}
Adobe Stock Photos CS3-->MsiExec.exe /I{29E5EA97-5F74-4A57-B8B2-D4F169117183}
Adobe Type Support-->MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}
Adobe Update Manager CS3-->MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8}
Adobe Version Cue CS3 Client-->MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5}
Adobe WinSoft Linguistics Plugin-->MsiExec.exe /I{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}
Adobe XMP Panels CS3-->MsiExec.exe /I{802771A9-A856-4A41-ACF7-1450E523C923}
Apple Application Support-->MsiExec.exe /I{553255F3-78FD-40F1-A6F8-6882140265FE}
Apple Mobile Device Support-->MsiExec.exe /I{9DE1BE03-AFE2-4CDB-BFEB-D06D736CD01A}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Avira AntiVir Personal - Free Antivirus-->D:\Programme\Avira\AntiVir Desktop\setup.exe /REMOVE
Azurewave Wireless LAN-->C:\Program Files\InstallShield Installation Information\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}\setup.exe -runfromtemp -l0x0009 -removeonly
Bonjour-->MsiExec.exe /X{8A253629-0511-4854-8B4E-46E57E66005C}
Brother MFL-Pro Suite-->"C:\Program Files\InstallShield Installation Information\{BB9AC6BF-71B6-42A4-9689-C17D9F44E79A}\Setup.exe" -runfromtemp -l0x0007 Brunin03.dll -removeonly
CCleaner-->"D:\Programme\CCleaner\uninst.exe"
Cisco Systems VPN Client 5.0.06.0110-->MsiExec.exe /X{08B785C1-3893-4154-B53B-F5D341D0AAAA}
Citrix Online Plug-in - Web-->C:\ProgramData\Citrix\Citrix Online Plug-in - Web\TrolleyExpress.exe /uninstall /cleanup
Citrix Online Plug-in (DV)-->MsiExec.exe /I{8144262B-25B4-44F6-8204-FCC8EF50179F}
Citrix Online Plug-in (HDX)-->MsiExec.exe /I{EA74A293-3FAC-4D1B-AE3A-3BD47FADDC20}
Citrix Online Plug-in (USB)-->MsiExec.exe /I{6F8EAC65-314D-4D86-9557-BC9312AACCB0}
Citrix Online Plug-in (Web)-->MsiExec.exe /I{023D64D7-E7B4-47C7-BE6E-B7C2E8960D08}
Cool Hand Poker-->C:\MicroGaming\Poker\coolhandMPP\install.exe -uninstall
Counter-Strike: Source-->"D:\Programme\Steam\steam.exe" steam://uninstall/240
Counter-Strike-->"D:\Programme\Steam\steam.exe" steam://uninstall/10
DivX Codec-->D:\Programme\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter-->D:\Programme\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->D:\Programme\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Plus DirectShow Filters-->D:\Programme\DivX\DivXDSFiltersUninstall.exe /DSFILTERS
DivX Plus Web Player-->D:\Programme\DivX\DivXWebPlayerUninstall.exe /PLUGIN
DivX-Setup-->C:\ProgramData\DivX\Setup\DivXSetup.exe /uninstall /bundleGroupId divx.com
Dragon Age: Origins-->C:\Program Files\Common Files\BioWare\Uninstall Dragon Age.exe
GoeMobile - Cisco VPN Client 5.0.06.0110-->C:\Program Files\Cisco Systems\VPN Client\goemobile\Goemobile_uninst.exe
Holdem Manager-->"D:\Programme\Holdem Manager\UninstallHoldemManager.exe"
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Intel PROSet Wireless-->Intel PROSet Wireless
iTunes-->MsiExec.exe /I{5ECB3A3C-980B-4D12-9724-25DCB07A1F47}
Java(TM) 6 Update 20-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216016FF}
K-Lite Mega Codec Pack 5.8.3-->"D:\Programme\K-Lite Codec Pack\unins000.exe"
Malwarebytes' Anti-Malware-->"D:\Programme\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - deu\setup.exe
Microsoft .NET Framework 3.5 Language Pack SP1 - deu-->MsiExec.exe /I{052FDD78-A6EA-3187-8386-C82F4CA3A929}
Microsoft .NET Framework 3.5 SP1-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft .NET Framework 4 Client Profile DEU Language Pack-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\ClientLP\Setup.exe /repair /x86 /lcid 1031 /parameterfolder ClientLP
Microsoft .NET Framework 4 Client Profile DEU Language Pack-->MsiExec.exe /X{F750C986-5310-3A5A-95F8-4EC71C8AC01C}
Microsoft .NET Framework 4 Client Profile-->C:\Windows\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\Setup.exe /repair /x86 /parameterfolder Client
Microsoft .NET Framework 4 Client Profile-->MsiExec.exe /X{3C3901C5-3455-3E0A-A214-0B093A5070A6}
Microsoft Office Access MUI (German) 2007-->MsiExec.exe /X{90120000-0015-0407-0000-0000000FF1CE}
Microsoft Office Enterprise 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL
Microsoft Office Enterprise 2007-->MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (German) 2007-->MsiExec.exe /X{90120000-0016-0407-0000-0000000FF1CE}
Microsoft Office Groove MUI (German) 2007-->MsiExec.exe /X{90120000-00BA-0407-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (German) 2007-->MsiExec.exe /X{90120000-0044-0407-0000-0000000FF1CE}
Microsoft Office OneNote MUI (German) 2007-->MsiExec.exe /X{90120000-00A1-0407-0000-0000000FF1CE}
Microsoft Office Outlook MUI (German) 2007-->MsiExec.exe /X{90120000-001A-0407-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (German) 2007-->MsiExec.exe /X{90120000-0018-0407-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Italian) 2007-->MsiExec.exe /X{90120000-001F-0410-0000-0000000FF1CE}
Microsoft Office Proofing (German) 2007-->MsiExec.exe /X{90120000-002C-0407-0000-0000000FF1CE}
Microsoft Office Publisher MUI (German) 2007-->MsiExec.exe /X{90120000-0019-0407-0000-0000000FF1CE}
Microsoft Office Shared MUI (German) 2007-->MsiExec.exe /X{90120000-006E-0407-0000-0000000FF1CE}
Microsoft Office Word MUI (German) 2007-->MsiExec.exe /X{90120000-001B-0407-0000-0000000FF1CE}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Mozilla Firefox (3.6)-->D:\Programme\Mozilla\uninstall\helper.exe
No23 Recorder-->MsiExec.exe /X{22B0E143-2B0B-435B-9F56-136A3D16065F}
NVIDIA Drivers-->C:\Windows\system32\nvuninst.exe UninstallGUI
NVIDIA PhysX-->MsiExec.exe /X{1C4551A6-4743-4093-91E4-1477CD655043}
OpenAL-->"C:\Program Files\OpenAL\oalinst.exe" /U
OpenOffice.org 3.0-->MsiExec.exe /I{04B45310-A5FE-4425-BFCA-1A6D8920DE74}
PDF Settings-->MsiExec.exe /I{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}
PokerStars-->"D:\Eigene Dateien\Poker\Alles\PokerstarsNew\PokerStarsUninstall.exe" /u:PokerStars
PokerStrategy.com Equilator-->"C:\Program Files\InstallShield Installation Information\{045A9539-37B6-464D-94F9-E4ADFA856903}\setup.exe" -runfromtemp -l0x0409 -removeonly
PokerStrategy.com Equilator-->MsiExec.exe /I{045A9539-37B6-464D-94F9-E4ADFA856903}
PostgreSQL 8.4-->C:\Program Files\PostgreSQL\8.4\uninstall-postgresql.exe
QuickTime-->MsiExec.exe /I{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}
Realtek 8169 8168 8101E 8102E Ethernet Driver-->C:\Program Files\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\setup.exe -runfromtemp -l0x0007 -removeonly
Realtek High Definition Audio Driver-->C:\Program Files\Realtek\Audio\HDA\RtlUpd.exe -r -m -nrg2709
Skype Toolbars-->MsiExec.exe /I{981029E0-7FC9-4CF3-AB39-6F133621921A}
Skype™ 4.1-->MsiExec.exe /X{D103C4BA-F905-437A-8049-DB24763BBE36}
Steam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
VC80CRTRedist - 8.0.50727.4053-->MsiExec.exe /I{5EE7D259-D137-4438-9A5F-42F432EC0421}
VLC media player 1.0.5-->D:\Program Files\VideoLAN\VLC\uninstall.exe
Windows Driver Package - Intel (NETw5v32) net (04/27/2008 12.0.0.73)-->C:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\dpinst32.exe /u C:\Windows\system32\DRVSTORE\netw5v32_CA3CC4AC2C4CECBEA38C31B2AD0494382FBDC4B1\netw5v32.inf
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
WinRAR-->D:\Programme\WinRar\uninstall.exe
======Security center information======
AS: Windows Defender
======System event log======
Computer Name: ****-PC
Event Code: 4383
Message: Windows-Wartung hat das Update 979306-1166_neutral_PACKAGE aus Paket KB979306 (Update) in den Status Installiert(Installed) gesetzt.
Record Number: 32500
Source Name: Microsoft-Windows-Servicing
Time Written: 20100301083910.000000-000
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM
Computer Name: ****-PC
Event Code: 4383
Message: Windows-Wartung hat das Update 979306-1165_neutral_PACKAGE aus Paket KB979306 (Update) in den Status Installiert(Installed) gesetzt.
Record Number: 32499
Source Name: Microsoft-Windows-Servicing
Time Written: 20100301083910.000000-000
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM
Computer Name: ****-PC
Event Code: 4383
Message: Windows-Wartung hat das Update 979306-1164_neutral_PACKAGE aus Paket KB979306 (Update) in den Status Installiert(Installed) gesetzt.
Record Number: 32498
Source Name: Microsoft-Windows-Servicing
Time Written: 20100301083910.000000-000
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM
Computer Name: ****-PC
Event Code: 4383
Message: Windows-Wartung hat das Update 979306-1163_neutral_PACKAGE aus Paket KB979306 (Update) in den Status Installiert(Installed) gesetzt.
Record Number: 32497
Source Name: Microsoft-Windows-Servicing
Time Written: 20100301083910.000000-000
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM
Computer Name: ****-PC
Event Code: 4383
Message: Windows-Wartung hat das Update 979306-1162_neutral_PACKAGE aus Paket KB979306 (Update) in den Status Installiert(Installed) gesetzt.
Record Number: 32496
Source Name: Microsoft-Windows-Servicing
Time Written: 20100301083910.000000-000
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM
=====Application event log=====
Computer Name: 26L2233B1-13
Event Code: 5615
Message: Der Windows-Verwaltungsinstrumentationsdienst wurde erfolgreich gestartet.
Record Number: 5
Source Name: Microsoft-Windows-WMI
Time Written: 20100205195759.000000-000
Event Type: Informationen
User:
Computer Name: WIN-S1SM9G5BLPK
Event Code: 4625
Message: Das EventSystem-Subsystem unterdrückt duplizierte Ereignisprotokolleinträge für eine Dauer von 86400 Sekunden. Dieses Zeitlimit kann durch den REG_DWORD-Wert SuppressDuplicateDuration unter folgendem Registrierungsschlüssel gesteuert werden: HKLM\Software\Microsoft\EventSystem\EventLog.
Record Number: 4
Source Name: Microsoft-Windows-EventSystem
Time Written: 20100205195756.000000-000
Event Type: Informationen
User:
Computer Name: WIN-S1SM9G5BLPK
Event Code: 900
Message: Der Softwarelizenzierungsdienst wird gestartet.
Record Number: 3
Source Name: Microsoft-Windows-Security-Licensing-SLC
Time Written: 20100205195756.000000-000
Event Type: Informationen
User:
Computer Name: WIN-S1SM9G5BLPK
Event Code: 1531
Message: Der Benutzerprofildienst wurde erfolgreich gestartet.
Record Number: 2
Source Name: Microsoft-Windows-User Profiles Service
Time Written: 20100205195755.000000-000
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM
Computer Name: 26L2233B1-13
Event Code: 2
Message: Der Zertifikatdiensteclient wurde angehalten.
Record Number: 1
Source Name: Microsoft-Windows-CertificateServicesClient
Time Written: 20080121025830.046400-000
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM
=====Security event log=====
Computer Name: 26L2233B1-13
Event Code: 4648
Message: Anmeldeversuch mit expliziten Anmeldeinformationen.
Antragsteller:
Sicherheits-ID: S-1-5-18
Kontoname: 26L2233B1-13$
Kontodomäne: WORKGROUP
Anmelde-ID: 0x3e7
Anmelde-GUID: {00000000-0000-0000-0000-000000000000}
Konto, dessen Anmeldeinformationen verwendet wurden:
Kontoname: SYSTEM
Kontodomäne: NT-AUTORITÄT
Anmelde-GUID: {00000000-0000-0000-0000-000000000000}
Zielserver:
Zielservername: localhost
Weitere Informationen: localhost
Prozessinformationen:
Prozess-ID: 0x1f4
Prozessname: C:\Windows\System32\services.exe
Netzwerkinformationen:
Netzwerkadresse: -
Port: -
Dieses Ereignis wird bei einem Anmeldeversuch durch einen Prozess generiert, wenn ausdrücklich die Anmeldeinformationen des Kontos angegeben werden. Dies ist normalerweise der Fall in Batch-Konfigurationen, z. B. bei geplanten Aufgaben oder wenn der Befehl "runas" verwendet wird.
Record Number: 5
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100205195727.692146-000
Event Type: Überwachung erfolgreich
User:
Computer Name: 26L2233B1-13
Event Code: 4902
Message: Eine Benutzerrichtlinien-Überwachungstabelle wurde erstellt.
Anzahl von Elementen: 0
Richtlinienkennung: 0x60934
Record Number: 4
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100205195723.058916-000
Event Type: Überwachung erfolgreich
User:
Computer Name: 26L2233B1-13
Event Code: 4624
Message: Ein Konto wurde erfolgreich angemeldet.
Antragsteller:
Sicherheits-ID: S-1-0-0
Kontoname: -
Kontodomäne: -
Anmelde-ID: 0x0
Anmeldetyp: 0
Neue Anmeldung:
Sicherheits-ID: S-1-5-18
Kontoname: SYSTEM
Kontodomäne: NT-AUTORITÄT
Anmelde-ID: 0x3e7
Anmelde-GUID: {00000000-0000-0000-0000-000000000000}
Prozessinformationen:
Prozess-ID: 0x4
Prozessname:
Netzwerkinformationen:
Arbeitsstationsname: -
Quellnetzwerkadresse: -
Quellport: -
Detaillierte Authentifizierungsinformationen:
Anmeldeprozess: -
Authentifizierungspaket: -
Übertragene Dienste: -
Paketname (nur NTLM): -
Schlüssellänge: 0
Dieses Ereignis wird beim Erstellen einer Anmeldesitzung generiert. Es wird auf dem Computer generiert, auf den zugegriffen wurde.
Die Antragstellerfelder geben das Konto auf dem lokalen System an, von dem die Anmeldung angefordert wurde. Dies ist meistens ein Dienst wie der Serverdienst oder ein lokaler Prozess wie "Winlogon.exe" oder "Services.exe".
Das Anmeldetypfeld gibt den jeweiligen Anmeldetyp an. Die häufigsten Typen sind 2 (interaktiv) und 3 (Netzwerk).
Die Felder für die neue Anmeldung geben das Konto an, für das die Anmeldung erstellt wurde, d. h. das angemeldete Konto.
Die Netzwerkfelder geben die Quelle einer Remoteanmeldeanforderung an. der Arbeitsstationsname ist nicht immer verfügbar und kann in manchen Fällen leer bleiben.
Die Felder für die Authentifizierungsinformationen enthalten detaillierte Informationen zu dieser speziellen Anmeldeanforderung.
- Die Anmelde-GUID ist ein eindeutiger Bezeichner, der verwendet werden kann, um dieses Ereignis mit einem KDC-Ereignis zu korrelieren.
- Die übertragenen Dienste geben an, welche Zwischendienste an der Anmeldeanforderung beteiligt waren.
- Der Paketname gibt das in den NTLM-Protokollen verwendete Unterprotokoll an.
- Die Schlüssellänge gibt die Länge des generierten Sitzungsschlüssels an. Wenn kein Sitzungsschlüssel angefordert wurde, ist dieser Wert 0.
Record Number: 3
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100205195721.966909-000
Event Type: Überwachung erfolgreich
User:
Computer Name: 26L2233B1-13
Event Code: 4608
Message: Windows wird gestartet.
Dieses Ereignis wird protokolliert, wenn LSASS.EXE gestartet und das Überwachungssubsystem initialisiert wird.
Record Number: 2
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20100205195721.966909-000
Event Type: Überwachung erfolgreich
User:
Computer Name: 26L2233B1-13
Event Code: 4634
Message: Ein Konto wurde abgemeldet.
Antragsteller:
Sicherheits-ID: S-1-5-7
Kontoname: ANONYMOUS LOGON
Kontodomäne: NT AUTHORITY
Anmelde-ID: 0x1f2f0
Anmeldetyp: 3
Dieses Ereignis wird generiert, wenn eine Anmeldesitzung zerstört wird. Es kann anhand des Wertes der Anmelde-ID positiv mit einem Anmeldeereignis korreliert werden. Anmelde-IDs sind nur zwischen Neustarts auf demselben Computer eindeutig.
Record Number: 1
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20080121025830.171200-000
Event Type: Überwachung erfolgreich
User:
======Environment variables======
"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Intel\WiFi\bin\;C:\Program Files\Common Files\DivX Shared\;D:\Programme\QuickTime\QTSystem\;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 23 Stepping 6, GenuineIntel
"PROCESSOR_REVISION"=1706
"NUMBER_OF_PROCESSORS"=2
"TRACE_FORMAT_SEARCH_PATH"=\\NTREL202.ntdev.corp.microsoft.com\4F18C3A5-CA09-4DBD-B6FC-219FDD4C6BE0\TraceFormat
"DFSTRACINGON"=FALSE
"asl.log"=Destination=file;OnFirstLog=command,environment
"CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip
"PSModulePath"=%SystemRoot%\system32\WindowsPowerShell\v1.0\Modules\
-----------------EOF-----------------
Ich hoffe, ich habe nun nichts falsch gemacht. Vielleicht reichen die bereitgestellten Informationen schon aus, um das Problem zu lösen. Weil ich nicht kompetent genug bin, bin ich da ganz auf euch angewiesen. Für Hilfe jeder Art möchte ich mich trotzdem schon einmal im Voraus bedanken: Vielen Dank! |
|
08.07.2010, 06:57
| #2 | |
| /// Helfer-Team    | Viren, Trojaner, Malware auf meinem PC. AntiVir findet, löscht und findet wieder. Hallo und Herzlich Willkommen!
__________________Zitat:
- Die Anweisungen bitte gründlich lesen und immer streng einhalten, da ich die Reihenfolge nach bestimmten Kriterien vorbereitet habe: 1. lade Dir HijackThis 2.0.2 von *von hier* herunter HijackThis starten→ "Do a system scan and save a logfile" klicken→ das erhaltene Logfile "markieren" → "kopieren"→ hier in deinem Thread (rechte Maustaste) "einfügen" 2. Bitte Versteckte - und Systemdateien sichtbar machen den Link hier anklicken: System-Dateien und -Ordner unter XP und Vista sichtbar machen Am Ende unserer Arbeit, kannst wieder rückgängig machen! 3. → Lade Dir HJTscanlist.zip herunter → entpacke die Datei auf deinem Desktop → Bei WindowsXP Home musst vor dem Scan zusätzlich tasklist.zip installieren → per Doppelklick starten → Wähle dein Betriebsystem aus - Vista → Wenn Du gefragt wirst, die Option "Einstellung" (1) - scanlist" wählen → Nach kurzer Zeit sollte sich Dein Editor öffnen und die Datei hjtscanlist.txt präsentieren → Bitte kopiere den Inhalt hier in Deinen Thread. 4. Ich würde gerne noch all deine installierten Programme sehen: Lade dir das Tool CCleaner herunter installieren ("Füge CCleaner Yahoo! Toolbar hinzu" abwählen)→ starten→ falls nötig - unter Options settings-> "german" einstellen dann klick auf "Extra (um die installierten Programme auch anzuzeigen)→ weiter auf "Als Textdatei speichern..." wird eine Textdatei (*.txt) erstellt, kopiere dazu den Inhalt und füge ihn da ein 5. Um einen tieferen Einblick in dein System, um eine mögliche Infektion mit einem Rootkit/Info v.wikipedia.org) aufzuspüren, werden wir ein Tool - Gmer - einsetzen :
** keine Verbindung zu einem Netzwerk und Internet - WLAN nicht vergessen Wenn der Scan beendet ist, bitte alle Programme und Tools wieder aktivieren! 6. Lade und installiere das Tool RootRepeal herunter
Damit dein Thread übersichtlicher und schön lesbar bleibt, am besten nutze den Code-Tags für deinen Post: → vor dein log schreibst du:[code] hier kommt dein logfile rein → dahinter:[/code] ** Möglichst nicht ins internet gehen, kein Online-Banking, File-sharing, Chatprogramme usw grußCoverflow |
|
08.07.2010, 10:40
| #3 |
| | Viren, Trojaner, Malware auf meinem PC. AntiVir findet, löscht und findet wieder. Danke dir, für die ausführliche Beschreibung der folgenden Analyseschritte. Ich will gleich beginnen, alles nacheinander abzuarbeiten. Zuvor noch ein paar grundlegende Informationen, die du vielleicht wissen musst.
__________________CCleaner und Malwarebytes AntiMalware habe ich nicht über den von euch zur Verfügung gestellten Link heruntergeladen, sondern von chip*de bezogen. Der Download, auf den ihr hier verlinkt, funktionierte bei mir gestern Nacht nicht. Ich denke, das bereitet aber keinerlei Probleme und will deshalb gleich die Ergebnisse präsentieren: (1) HijackThis 2.0.2 Code:
ATTFilter Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:12:05, on 08.07.2010 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v7.00 (7.00.6002.18005) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe D:\Programme\Avira\AntiVir Desktop\avgnt.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe D:\Programme\iTunes\iTunesHelper.exe C:\Program Files\Citrix\ICA Client\concentr.exe C:\Program Files\Windows Sidebar\sidebar.exe D:\Programme\DAEMON Tools Lite\DTLite.exe C:\Program Files\Citrix\ICA Client\wfcrun32.exe C:\Windows\System32\mobsync.exe D:\Programme\Mozilla\firefox.exe D:\Programme\Mozilla\plugin-container.exe C:\Windows\system32\SearchFilterHost.exe D:\Programme\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe O4 - HKLM\..\Run: [avgnt] "D:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Programme\Adobe\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "D:\Programme\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "D:\Programme\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [ConnectionCenter] "C:\Program Files\Citrix\ICA Client\concentr.exe" /startup O4 - HKLM\..\Run: [ Malwarebytes Anti-Malware (reboot)] "D:\Programme\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [DAEMON Tools Lite] "D:\Programme\DAEMON Tools Lite\DTLite.exe" -autorun O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-21-6710304-3433624121-992636011-1001\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'postgres') O4 - Global Startup: VPN Client.lnk = ? O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Cool Hand Poker - {00000000-0000-0000-0000-000000000000} - C:\MicroGaming\Poker\coolhandMPP\MPPoker.exe (HKCU) O13 - Gopher Prefix: O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O18 - Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll O18 - Filter hijack: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - D:\Programme\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - D:\Programme\Avira\AntiVir Desktop\avguard.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe O23 - Service: Dienst "Bonjour" (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\Windows\system32\brsvc01a.exe O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe O23 - Service: Dragon Age: Origins - Inhaltsupdater (DAUpdaterSvc) - BioWare - D:\Programme\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe O23 - Service: PostgreSQL Server 8.4 (postgresql-8.4) - PostgreSQL Global Development Group - C:/Program Files/PostgreSQL/8.4/bin/pg_ctl.exe O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe -- End of file - 7491 bytes (3) HJTScanList Code:
ATTFilter
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
º º
hjtscanlist v2.0
º º
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Microsoft Windows [Version 6.0.6002]
C:
C:\hiberfil.sys ---------
C:\pagefile.sys ---------
08.07.2010 01:27 C:\rsit --------- 0
08.07.2010 01:27 C:\Program Files --------- 12288
08.07.2010 01:20 C:\Windows --------- 20480
08.07.2010 00:55 C:\ProgramData --------- 8192
06.07.2010 13:47 C:\System Volume Information --------- 24576
18.05.2010 01:00 C:\HMArchive --------- 0
10.05.2010 10:58 C:\Users --------- 4096
13.04.2010 20:40 C:\MicroGaming --------- 0
20.02.2010 18:08 C:\Boot --------- 4096
12.02.2010 11:21 C:\MSOCache --------- 0
10.02.2010 19:01 C:\Brother --------- 0
07.02.2010 22:43 C:\Intel --------- 0
05.02.2010 22:12 C:\$Recycle.Bin --------- 0
05.02.2010 22:10 C:\Programme --------- 0
05.02.2010 22:10 C:\Dokumente und Einstellungen --------- 0
11.04.2009 08:36 C:\bootmgr --------- 333257
21.01.2008 04:32 C:\PerfLogs --------- 0
02.11.2006 15:02 C:\Documents and Settings --------- 0
18.09.2006 23:43 C:\config.sys --------- 10
18.09.2006 23:43 C:\autoexec.bat --------- 24
----------------------------------------
C:\Windows
08.07.2010 10:54 C:\Windows\WindowsUpdate.log --------- 2096557
08.07.2010 10:51 C:\Windows\bootstat.dat --------- 67584
08.07.2010 01:20 C:\Windows\PFRO.log --------- 590
18.05.2010 02:02 C:\Windows\HMHud.INI --------- 0
09.05.2010 19:53 C:\Windows\VPNInstall.MIF --------- 1594
08.05.2010 22:36 C:\Windows\win.ini --------- 243
13.04.2010 20:42 C:\Windows\pp.enc --------- 59
14.03.2010 20:00 C:\Windows\avisplitter.ini --------- 38
19.02.2010 17:41 C:\Windows\BRWMARK.INI --------- 469
10.02.2010 19:04 C:\Windows\BRPP2KA.INI --------- 27
10.02.2010 19:02 C:\Windows\Brfaxrx.ini --------- 66
10.02.2010 19:02 C:\Windows\brpcfx.ini --------- 84
10.02.2010 19:02 C:\Windows\Brpfx04a.ini --------- 212
24.06.2009 10:43 C:\Windows\RtlExUpd.dll --------- 831488
11.04.2009 08:27 C:\Windows\explorer.exe --------- 2926592
14.02.2008 14:07 C:\Windows\Updates.txt --------- 10
21.01.2008 04:43 C:\Windows\WindowsShell.Manifest --------- 749
21.01.2008 04:24 C:\Windows\regedit.exe --------- 134656
21.01.2008 04:24 C:\Windows\bfsvc.exe --------- 58880
21.01.2008 04:24 C:\Windows\fveupdate.exe --------- 13312
21.01.2008 04:24 C:\Windows\HelpPane.exe --------- 498176
21.01.2008 04:23 C:\Windows\notepad.exe --------- 151040
02.11.2006 14:35 C:\Windows\WMSysPr9.prx --------- 316640
02.11.2006 14:34 C:\Windows\twunk_16.exe --------- 49680
02.11.2006 14:34 C:\Windows\twain_32.dll --------- 50688
02.11.2006 14:34 C:\Windows\twunk_32.exe --------- 31232
02.11.2006 14:34 C:\Windows\twain.dll --------- 94784
02.11.2006 11:45 C:\Windows\winhlp32.exe --------- 9216
02.11.2006 11:45 C:\Windows\hh.exe --------- 14848
02.11.2006 09:46 C:\Windows\mib.bin --------- 43131
19.09.2006 13:41 C:\Windows\HomePremium.xml --------- 8328
18.09.2006 23:46 C:\Windows\system.ini --------- 219
18.09.2006 23:43 C:\Windows\_default.pif --------- 707
18.09.2006 23:43 C:\Windows\winhelp.exe --------- 256192
18.09.2006 23:30 C:\Windows\msdfmap.ini --------- 1405
10.12.2004 17:35 C:\Windows\brunin03.dll --------- 147456
28.11.2003 19:57 C:\Windows\brdfxspd.dat --------- 0
15.11.2001 02:00 C:\Windows\CVRPAGE.bmp --------- 6224
----------------------------------------
C:\Windows\System
02.11.2006 14:34 C:\Windows\System\mciseq.drv --------- 25264
02.11.2006 14:34 C:\Windows\System\mciwave.drv --------- 28160
02.11.2006 14:34 C:\Windows\System\avifile.dll --------- 109456
02.11.2006 14:34 C:\Windows\System\avicap.dll --------- 69584
02.11.2006 14:34 C:\Windows\System\mciavi.drv --------- 73376
02.11.2006 14:34 C:\Windows\System\msvideo.dll --------- 126912
02.11.2006 09:10 C:\Windows\System\OLESVR.DLL --------- 24064
02.11.2006 09:10 C:\Windows\System\WFWNET.DRV --------- 12704
02.11.2006 09:10 C:\Windows\System\COMMDLG.DLL --------- 32816
02.11.2006 09:10 C:\Windows\System\TIMER.DRV --------- 4048
02.11.2006 09:10 C:\Windows\System\MMSYSTEM.DLL --------- 68992
02.11.2006 09:10 C:\Windows\System\mmtask.tsk --------- 1152
02.11.2006 09:10 C:\Windows\System\mouse.drv --------- 2032
02.11.2006 09:10 C:\Windows\System\vga.drv --------- 2176
02.11.2006 09:10 C:\Windows\System\sound.drv --------- 1744
02.11.2006 09:10 C:\Windows\System\keyboard.drv --------- 2000
02.11.2006 09:10 C:\Windows\System\SHELL.DLL --------- 5120
02.11.2006 09:10 C:\Windows\System\system.drv --------- 3360
18.09.2006 23:43 C:\Windows\System\ver.dll --------- 9008
18.09.2006 23:43 C:\Windows\System\olecli.dll --------- 82944
18.09.2006 23:43 C:\Windows\System\lzexpand.dll --------- 9936
18.09.2006 23:35 C:\Windows\System\stdole.tlb --------- 5532
----------------------------------------
C:\Windows\System32
08.07.2010 11:18 C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 --------- 3712
08.07.2010 11:18 C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 --------- 3712
08.07.2010 01:20 C:\Windows\system32\drivers --------- 65536
06.07.2010 21:12 C:\Windows\system32\Tasks --------- 4096
03.07.2010 14:55 C:\Windows\system32\catroot2 --------- 4096
03.07.2010 11:47 C:\Windows\system32\perfh009.dat --------- 595996
03.07.2010 11:47 C:\Windows\system32\perfc009.dat --------- 104070
03.07.2010 11:47 C:\Windows\system32\perfh007.dat --------- 628742
03.07.2010 11:47 C:\Windows\system32\perfc007.dat --------- 126454
03.07.2010 11:47 C:\Windows\system32\PerfStringBackup.INI --------- 1445310
29.06.2010 13:08 C:\Windows\system32\catroot --------- 4096
22.06.2010 22:35 C:\Windows\system32\de-DE --------- 196608
22.06.2010 22:35 C:\Windows\system32\WindowsPowerShell --------- 0
22.06.2010 22:24 C:\Windows\system32\en-US --------- 4096
22.06.2010 13:57 C:\Windows\system32\LogFiles --------- 0
15.06.2010 23:49 C:\Windows\system32\jupdate-1.6.0_20-b02.log --------- 3217
13.06.2010 12:50 C:\Windows\system32\WDI --------- 4096
09.06.2010 21:58 C:\Windows\system32\FNTCACHE.DAT --------- 1733096
09.06.2010 21:48 C:\Windows\system32\wbem --------- 65536
28.05.2010 21:37 C:\Windows\system32\mrt.exe --------- 32472008
26.05.2010 19:06 C:\Windows\system32\atmlib.dll --------- 34304
26.05.2010 16:47 C:\Windows\system32\atmfd.dll --------- 289792
21.05.2010 14:14 C:\Windows\system32\MpSigStub.exe --------- 221568
04.05.2010 21:15 C:\Windows\system32\wininet.dll --------- 834048
04.05.2010 21:15 C:\Windows\system32\urlmon.dll --------- 1176064
04.05.2010 21:12 C:\Windows\system32\mshtmled.dll --------- 477184
04.05.2010 21:12 C:\Windows\system32\mshtml.dll --------- 3602944
04.05.2010 21:10 C:\Windows\system32\ieui.dll --------- 180736
04.05.2010 21:10 C:\Windows\system32\iepeers.dll --------- 193024
04.05.2010 21:10 C:\Windows\system32\ieframe.dll --------- 6080000
04.05.2010 21:10 C:\Windows\system32\ieapfltr.dll --------- 380928
04.05.2010 20:37 C:\Windows\system32\ieencode.dll --------- 78336
01.05.2010 16:13 C:\Windows\system32\win32k.sys --------- 2037248
23.04.2010 16:13 C:\Windows\system32\tzres.dll --------- 2048
16.04.2010 18:43 C:\Windows\system32\Apphlpdm.dll --------- 28672
16.04.2010 16:39 C:\Windows\system32\GameUXLegacyGDFs.dll --------- 4240384
12.04.2010 17:29 C:\Windows\system32\javaws.exe --------- 153376
12.04.2010 17:29 C:\Windows\system32\javaw.exe --------- 145184
12.04.2010 17:29 C:\Windows\system32\java.exe --------- 145184
12.04.2010 17:29 C:\Windows\system32\deployJava1.dll --------- 411368
08.04.2010 13:20 C:\Windows\system32\dns-sd.exe --------- 107808
08.04.2010 13:20 C:\Windows\system32\dnssd.dll --------- 91424
06.04.2010 14:20 C:\Windows\system32\jupdate-1.6.0_19-b04.log --------- 4626
05.04.2010 19:01 C:\Windows\system32\asycfilt.dll --------- 67072
01.04.2010 02:15 C:\Windows\system32\pt-BR --------- 0
01.04.2010 02:15 C:\Windows\system32\it-IT --------- 0
01.04.2010 02:15 C:\Windows\system32\bg-BG --------- 0
01.04.2010 02:15 C:\Windows\system32\he-IL --------- 0
01.04.2010 02:15 C:\Windows\system32\pt-PT --------- 0
01.04.2010 02:15 C:\Windows\system32\pl-PL --------- 0
01.04.2010 02:15 C:\Windows\system32\uk-UA --------- 0
01.04.2010 02:15 C:\Windows\system32\ko-KR --------- 0
01.04.2010 02:15 C:\Windows\system32\hu-HU --------- 0
01.04.2010 02:15 C:\Windows\system32\hr-HR --------- 0
01.04.2010 02:15 C:\Windows\system32\zh-HK --------- 0
01.04.2010 02:15 C:\Windows\system32\sl-SI --------- 0
01.04.2010 02:15 C:\Windows\system32\el-GR --------- 0
01.04.2010 02:15 C:\Windows\system32\nl-NL --------- 0
01.04.2010 02:15 C:\Windows\system32\fr-FR --------- 0
01.04.2010 02:15 C:\Windows\system32\fi-FI --------- 0
01.04.2010 02:15 C:\Windows\system32\sr-Latn-CS --------- 0
01.04.2010 02:15 C:\Windows\system32\tr-TR --------- 0
01.04.2010 02:15 C:\Windows\system32\th-TH --------- 0
01.04.2010 02:15 C:\Windows\system32\sv-SE --------- 0
01.04.2010 02:15 C:\Windows\system32\es-ES --------- 0
01.04.2010 02:15 C:\Windows\system32\lv-LV --------- 0
01.04.2010 02:15 C:\Windows\system32\lt-LT --------- 0
01.04.2010 02:15 C:\Windows\system32\zh-TW --------- 0
01.04.2010 02:15 C:\Windows\system32\sk-SK --------- 0
01.04.2010 02:15 C:\Windows\system32\et-EE --------- 0
01.04.2010 02:15 C:\Windows\system32\cs-CZ --------- 0
01.04.2010 02:15 C:\Windows\system32\zh-CN --------- 0
01.04.2010 02:15 C:\Windows\system32\ja-JP --------- 0
01.04.2010 02:15 C:\Windows\system32\ar-SA --------- 0
01.04.2010 02:15 C:\Windows\system32\ro-RO --------- 0
01.04.2010 02:15 C:\Windows\system32\ru-RU --------- 0
01.04.2010 02:15 C:\Windows\system32\nb-NO --------- 0
01.04.2010 02:15 C:\Windows\system32\da-DK --------- 0
18.03.2010 14:03 C:\Windows\system32\wrap_oal.dll --------- 413696
18.03.2010 14:03 C:\Windows\system32\OpenAL32.dll --------- 110592
18.03.2010 13:16 C:\Windows\system32\msvcr100_clr0400.dll --------- 771424
17.03.2010 21:53 C:\Windows\system32\QuickTime.qts --------- 69632
17.03.2010 21:53 C:\Windows\system32\QuickTimeVR.qtx --------- 94208
14.03.2010 20:00 C:\Windows\system32\pndx5016.dll --------- 6656
14.03.2010 20:00 C:\Windows\system32\pncrt.dll --------- 278528
14.03.2010 20:00 C:\Windows\system32\pndx5032.dll --------- 5632
14.03.2010 20:00 C:\Windows\system32\rmoc3260.dll --------- 185920
12.03.2010 20:31 C:\Windows\system32\AGEIA --------- 0
04.03.2010 19:33 C:\Windows\system32\vbscript.dll --------- 430080
23.02.2010 19:30 C:\Windows\system32\NDF --------- 0
21.02.2010 01:06 C:\Windows\system32\nshhttp.dll --------- 24064
21.02.2010 01:05 C:\Windows\system32\httpapi.dll --------- 30720
19.02.2010 18:24 C:\Windows\system32\ca-ES --------- 0
19.02.2010 18:24 C:\Windows\system32\XPSViewer --------- 0
19.02.2010 18:24 C:\Windows\system32\oobe --------- 4096
19.02.2010 18:24 C:\Windows\system32\migration --------- 4096
19.02.2010 18:24 C:\Windows\system32\eu-ES --------- 0
19.02.2010 18:24 C:\Windows\system32\AdvancedInstallers --------- 0
19.02.2010 18:24 C:\Windows\system32\setup --------- 0
19.02.2010 18:24 C:\Windows\system32\SLUI --------- 0
----------------------------------------
C:\Windows\Prefetch
----------------------------------------
C:\Windows\Tasks
08.07.2010 10:51 C:\Windows\Tasks\SA.DAT --------- 6
08.07.2010 02:09 C:\Windows\Tasks\SCHEDLGU.TXT --------- 32534
07.07.2010 13:00 C:\Windows\Tasks\User_Feed_Synchronization-{A39CB0E9-224B-49F3-A4EA-4874F36B50CC}.job --------- 416
----------------------------------------
C:\Windows\Temp
----------------------------------------
C:\Users\Lars\AppData\Local\Temp
08.07.2010 11:20 C:\Users\++++\AppData\Local\Temp\Lars.bmp --------- 31832
08.07.2010 11:18 C:\Users\++++\AppData\Local\Temp\plugtmp --------- 4096
08.07.2010 11:16 C:\Users\++++\AppData\Local\Temp\flaB0F8.tmp --------- 16364505
08.07.2010 10:56 C:\Users\++++\AppData\Local\Temp\jusched.log --------- 976
08.07.2010 10:51 C:\Users\++++\AppData\Local\Temp\WPDNSE --------- 0
08.07.2010 10:51 C:\Users\++++\AppData\Local\Temp\AdobeARM.log --------- 1870
08.07.2010 01:11 C:\Users\++++\AppData\Local\Temp\516.exe --------- 133632
08.07.2010 00:48 C:\Users\++++\AppData\Local\Temp\Low --------- 0
08.07.2010 00:39 C:\Users\++++\AppData\Local\Temp\Jcqk_vgn.htm.part --------- 0
08.07.2010 00:34 C:\Users\++++\AppData\Local\Temp\125.exe --------- 133632
07.07.2010 14:04 C:\Users\++++\AppData\Local\Temp\wmplog01.sqm --------- 1394
07.07.2010 14:03 C:\Users\++++\AppData\Local\Temp\wmplog00.sqm --------- 1394
07.07.2010 13:05 C:\Users\++++\AppData\Local\Temp\762.exe --------- 133632
07.07.2010 12:59 C:\Users\++++\AppData\Local\Temp\886.exe --------- 133632
----------------------------------------
C:\Program Files
08.07.2010 01:27 C:\Program Files\trend micro --------- 0
22.06.2010 22:24 C:\Program Files\Microsoft.NET --------- 0
15.06.2010 23:49 C:\Program Files\Java --------- 0
10.06.2010 15:00 C:\Program Files\InstallShield Installation Information --------- 4096
09.06.2010 21:55 C:\Program Files\Windows Mail --------- 4096
28.05.2010 17:33 C:\Program Files\Citrix --------- 0
10.05.2010 22:33 C:\Program Files\iPod --------- 0
10.05.2010 22:31 C:\Program Files\Bonjour --------- 4096
10.05.2010 11:14 C:\Program Files\PSQLINSTALL --------- 0
10.05.2010 10:59 C:\Program Files\hminstalllog.txt --------- 66794
10.05.2010 10:57 C:\Program Files\PostgreSQL --------- 0
09.05.2010 19:52 C:\Program Files\Common Files --------- 4096
09.05.2010 19:52 C:\Program Files\Cisco Systems --------- 0
21.04.2010 15:03 C:\Program Files\Adobe --------- 0
01.04.2010 02:15 C:\Program Files\Windows Portable Devices --------- 0
25.03.2010 21:52 C:\Program Files\DivX --------- 0
18.03.2010 14:03 C:\Program Files\OpenAL --------- 0
15.03.2010 14:23 C:\Program Files\Movie Maker --------- 4096
12.03.2010 20:31 C:\Program Files\AGEIA Technologies --------- 8192
19.02.2010 18:25 C:\Program Files\Windows Calendar --------- 0
19.02.2010 18:24 C:\Program Files\Windows Sidebar --------- 4096
19.02.2010 18:24 C:\Program Files\Internet Explorer --------- 4096
19.02.2010 18:24 C:\Program Files\Windows Media Player --------- 4096
19.02.2010 18:24 C:\Program Files\Windows Collaboration --------- 4096
19.02.2010 18:24 C:\Program Files\Windows Journal --------- 4096
19.02.2010 18:24 C:\Program Files\Windows Photo Gallery --------- 4096
19.02.2010 18:24 C:\Program Files\Windows Defender --------- 4096
12.02.2010 11:33 C:\Program Files\Microsoft Works --------- 4096
12.02.2010 11:28 C:\Program Files\MSBuild --------- 0
12.02.2010 11:28 C:\Program Files\Microsoft Office --------- 4096
12.02.2010 11:28 C:\Program Files\Microsoft Visual Studio --------- 0
12.02.2010 11:24 C:\Program Files\Microsoft Visual Studio 8 --------- 0
10.02.2010 19:01 C:\Program Files\Brother --------- 0
09.02.2010 15:56 C:\Program Files\Skype --------- 0
09.02.2010 15:42 C:\Program Files\Apple Software Update --------- 4096
08.02.2010 23:19 C:\Program Files\Realtek --------- 0
08.02.2010 23:16 C:\Program Files\Cisco --------- 0
08.02.2010 23:16 C:\Program Files\Intel --------- 0
07.02.2010 22:52 C:\Program Files\Temp --------- 0
07.02.2010 22:49 C:\Program Files\RALINK --------- 0
07.02.2010 22:48 C:\Program Files\DIFX --------- 0
05.02.2010 22:10 C:\Program Files\Windows NT --------- 4096
05.02.2010 22:10 C:\Program Files\Gemeinsame Dateien --------- 0
21.01.2008 04:43 C:\Program Files\desktop.ini --------- 174
02.11.2006 15:01 C:\Program Files\Uninstall Information --------- 0
02.11.2006 14:37 C:\Program Files\Microsoft Games --------- 4096
02.11.2006 14:37 C:\Program Files\Reference Assemblies --------- 0
----------------------------------------
C:\ProgramData\..
++++
postgres
Public
Default
desktop.ini
Default User
All Users
----------------------------------------
C:\Windows\system32\drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
----------------------------------------
Abbildname PID Sitzungsname Sitz.-Nr. Speichernutzung
========================= ======== ================ =========== ===============
System Idle Process 0 Services 0 24 K
System 4 Services 0 3.676 K
smss.exe 452 Services 0 736 K
csrss.exe 548 Services 0 6.408 K
wininit.exe 600 Services 0 3.936 K
csrss.exe 612 Console 1 24.400 K
services.exe 644 Services 0 6.736 K
lsass.exe 656 Services 0 8.172 K
lsm.exe 664 Services 0 3.992 K
svchost.exe 796 Services 0 6.336 K
nvvsvc.exe 868 Services 0 3.592 K
svchost.exe 896 Services 0 6.908 K
svchost.exe 932 Services 0 42.500 K
svchost.exe 992 Services 0 12.468 K
svchost.exe 1020 Services 0 72.932 K
svchost.exe 1052 Services 0 48.652 K
audiodg.exe 1112 Services 0 18.904 K
SLsvc.exe 1152 Services 0 12.408 K
svchost.exe 1184 Services 0 11.748 K
winlogon.exe 1316 Console 1 5.716 K
svchost.exe 1384 Services 0 14.156 K
wlanext.exe 1500 Services 0 14.724 K
brsvc01a.exe 1536 Services 0 2.488 K
brss01a.exe 1552 Services 0 2.528 K
spoolsv.exe 1604 Services 0 12.352 K
sched.exe 1656 Services 0 1.596 K
svchost.exe 1668 Services 0 15.656 K
nvvsvc.exe 1908 Console 1 6.980 K
dwm.exe 792 Console 1 3.708 K
taskeng.exe 940 Console 1 11.912 K
explorer.exe 616 Console 1 50.656 K
taskeng.exe 2108 Services 0 5.544 K
avguard.exe 2252 Services 0 14.000 K
AppleMobileDeviceService. 2280 Services 0 3.756 K
MSASCui.exe 2288 Console 1 8.948 K
mDNSResponder.exe 2304 Services 0 4.924 K
RtHDVCpl.exe 2312 Console 1 11.456 K
cvpnd.exe 2336 Services 0 6.800 K
avgnt.exe 2344 Console 1 2.312 K
GrooveMonitor.exe 2376 Console 1 7.136 K
EvtEng.exe 2404 Services 0 15.872 K
svchost.exe 2620 Services 0 5.144 K
jusched.exe 2644 Console 1 3.580 K
pg_ctl.exe 2820 Services 0 6.364 K
iTunesHelper.exe 2860 Console 1 11.860 K
concentr.exe 2868 Console 1 5.712 K
sidebar.exe 2920 Console 1 33.880 K
DTLite.exe 3000 Console 1 9.204 K
RegSrvc.exe 3132 Services 0 4.172 K
postgres.exe 3152 Services 0 9.532 K
svchost.exe 3168 Services 0 8.456 K
svchost.exe 3224 Services 0 1.984 K
SearchIndexer.exe 3244 Services 0 18.680 K
postgres.exe 3476 Services 0 7.048 K
postgres.exe 3488 Services 0 6.804 K
postgres.exe 3496 Services 0 7.220 K
postgres.exe 3504 Services 0 6.540 K
WUDFHost.exe 3548 Services 0 4.824 K
wfcrun32.exe 3572 Console 1 7.844 K
mobsync.exe 2616 Console 1 6.460 K
WmiPrvSE.exe 464 Services 0 5.804 K
iPodService.exe 2652 Services 0 5.192 K
firefox.exe 3852 Console 1 109.776 K
plugin-container.exe 556 Console 1 73.420 K
cmd.exe 1168 Console 1 2.996 K
conime.exe 304 Console 1 3.340 K
SearchFilterHost.exe 3188 Services 0 5.096 K
tasklist.exe 1856 Console 1 4.664 K
WmiPrvSE.exe 3200 Services 0 5.624 K
***** Ende des Scans 08.07.2010 um 11:27:40,05 ***
Code:
ATTFilter Adobe Flash Player 10 ActiveX Adobe Systems Incorporated 17.03.2010 10.0.45.2
Adobe Flash Player 10 Plugin Adobe Systems Incorporated 15.06.2010 10.1.53.64
Adobe Photoshop CS3 Adobe Systems Incorporated 20.04.2010 10.0
Adobe Reader 9.3.3 - Deutsch Adobe Systems Incorporated 02.07.2010 245,5MB 9.3.3
Apple Application Support Apple Inc. 05.04.2010 39,7MB 1.2.1
Apple Mobile Device Support Apple Inc. 09.05.2010 19,7MB 3.0.1.3
Apple Software Update Apple Inc. 08.02.2010 2,16MB 2.1.1.116
Avira AntiVir Personal - Free Antivirus Avira GmbH 07.02.2010 76,4MB
Azurewave Wireless LAN RaLink 06.02.2010 1,93MB 1.00.0000
Bonjour Apple Inc. 09.05.2010 0,76MB 2.0.1.2
Brother MFL-Pro Suite Brother Industries, Ltd. 09.02.2010 4,92MB 1.00
CCleaner Piriform 07.07.2010 2,85MB 2.33
Cisco Systems VPN Client 5.0.06.0110 Cisco Systems, Inc. 08.05.2010 12,3MB 5.0.6
Citrix Online Plug-in - Web Citrix Systems, Inc. 27.05.2010 14,5MB 12.0.0.6410
Cool Hand Poker 12.04.2010 26,5MB 1.0.0.1863
Counter-Strike Valve 16.03.2010 33,8MB
Counter-Strike: Source Valve 19.03.2010 140,4MB
DivX Codec DivX, Inc. 16.02.2010 1,57MB 6.9.1
DivX Converter DivX, Inc. 16.02.2010 45,3MB 7.1.0
DivX Player DivX, Inc. 16.02.2010 8,43MB 7.2.0
DivX Plus DirectShow Filters DivX, Inc. 16.02.2010 1,58MB
DivX Plus Web Player DivX,Inc. 16.02.2010 8,77MB 2.0.0
DivX-Setup DivX, Inc. 24.03.2010 1,77MB 1.0.0.450
Dragon Age: Origins Electronic Arts, Inc. 11.03.2010 18.617,6MB 1.00
GoeMobile - Cisco VPN Client 5.0.06.0110 GoeMobile 08.05.2010 25,5MB 5.0.06.0110
HijackThis 2.0.2 TrendMicro 07.07.2010 0,39MB 2.0.2
Holdem Manager 09.05.2010 90,4MB
Intel(R) PROSet/Wireless WiFi-Software Intel(R) Corporation 07.02.2010 78,3MB 12.00.0004
iTunes Apple Inc. 09.05.2010 160,0MB 9.1.1.12
Java(TM) 6 Update 20 Sun Microsystems, Inc. 14.03.2010 95,0MB 6.0.200
K-Lite Mega Codec Pack 5.8.3 24.03.2010 49,6MB 5.8.3
Malwarebytes' Anti-Malware Malwarebytes Corporation 07.07.2010 3,90MB
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU Microsoft Corporation 12.02.2010 37,0MB
Microsoft .NET Framework 3.5 SP1 Microsoft Corporation 09.02.2010 37,0MB
Microsoft .NET Framework 4 Client Profile Microsoft Corporation 21.06.2010 120,3MB 4.0.30319
Microsoft .NET Framework 4 Client Profile DEU Language Pack Microsoft Corporation 21.06.2010 24,5MB 4.0.30319
Microsoft Office Enterprise 2007 Microsoft Corporation 11.02.2010 624,1MB 12.0.6425.1000
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 17.02.2010 0,41MB 8.0.56336
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 07.02.2010 0,58MB 9.0.30729
Mozilla Firefox (3.6) Mozilla 07.02.2010 27,9MB 3.6 (de)
Mozilla Firefox (3.6.6) Mozilla 27.06.2010 33,6MB 3.6.6 (de)
No23 Recorder No23 15.06.2010 2,44MB 2.1.0.3
NVIDIA Drivers NVIDIA Corporation 06.02.2010 2.654,4MB 1.4
NVIDIA PhysX NVIDIA Corporation 11.03.2010 119,9MB 9.09.0203
Octoshape add-in for Adobe Flash Player 26.03.2010 2,64MB
Octoshape Streaming Services 26.03.2010 0,75MB
OpenAL 17.03.2010 0,75MB
OpenOffice.org 3.0 OpenOffice.org 11.02.2010 331,8MB 3.0.9379
PokerStars PokerStars 07.05.2010 62,6MB
PokerStrategy.com Equilator PokerStrategy.com 09.06.2010 38,3MB 1.8.1.0
PostgreSQL 8.4 PostgreSQL Global Development Group 09.05.2010 454,5MB 8.4
QuickTime Apple Inc. 05.04.2010 73,8MB 7.66.71.0
Realtek 8169 8168 8101E 8102E Ethernet Driver Realtek 07.02.2010 1,67MB 1.00.0000
Realtek High Definition Audio Driver Realtek Semiconductor Corp. 06.02.2010 10,9MB 6.0.1.5898
Skype Toolbars Skype Technologies S.A. 08.02.2010 5,25MB 1.0.4051
Skype™ 4.1 Skype Technologies S.A. 08.02.2010 31,1MB 4.1.179
Steam Valve Corporation 16.03.2010 1,49MB 1.0.0.0
VLC media player 1.0.5 VideoLAN Team 05.03.2010 76,1MB 1.0.5
Windows Driver Package - Intel (NETw5v32) net (04/27/2008 12.0.0.73) Intel 06.02.2010 04/27/2008 12.0.0.73
Windows Media Player Firefox Plugin Microsoft Corp 16.03.2010 0,29MB 1.0.0.8
WinRAR 04.06.2010 3,78MB
Vielen Dank! |
|
08.07.2010, 10:56
| #4 |
| | Viren, Trojaner, Malware auf meinem PC. AntiVir findet, löscht und findet wieder. (5) Wenn ich GMER herunterlade (ob als .zip oder .exe), sobald ich das Programm starte, lädt er das entsprechende Fenster, scheint dann kurz ein paar Ordner zu durchlaufen und erklärt mir anschließend: "Gmer.exe funktioniert nicht mehr - Windows kann online nach einer Lösung für das Problem suchen [...]". Einen entsprechenden Log kann ich deshalb nicht posten. (6) RootRepeal Code:
ATTFilter ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time: 2010/07/08 11:48
Program Version: Version 1.3.5.0
Windows Version: Windows Vista SP2
==================================================
Drivers
-------------------
Name: a2ltuhh3.SYS
Image Path: C:\Windows\System32\Drivers\a2ltuhh3.SYS
Address: 0x8A597000 Size: 233472 File Visible: - Signed: -
Status: -
Name: acpi.sys
Image Path: C:\Windows\system32\drivers\acpi.sys
Address: 0x807AF000 Size: 286720 File Visible: - Signed: -
Status: -
Name: ACPI_HAL
Image Path: \Driver\ACPI_HAL
Address: 0x8204C000 Size: 3903488 File Visible: - Signed: -
Status: -
Name: afd.sys
Image Path: C:\Windows\system32\drivers\afd.sys
Address: 0x909A6000 Size: 294912 File Visible: - Signed: -
Status: -
Name: atapi.sys
Image Path: C:\Windows\system32\drivers\atapi.sys
Address: 0x8265F000 Size: 32768 File Visible: - Signed: -
Status: -
Name: ataport.SYS
Image Path: C:\Windows\system32\drivers\ataport.SYS
Address: 0x82667000 Size: 122880 File Visible: - Signed: -
Status: -
Name: ATMFD.DLL
Image Path: C:\Windows\System32\ATMFD.DLL
Address: 0x982D0000 Size: 311296 File Visible: - Signed: -
Status: -
Name: avgio.sys
Image Path: D:\Programme\Avira\AntiVir Desktop\avgio.sys
Address: 0x90606000 Size: 6144 File Visible: - Signed: -
Status: -
Name: avgntflt.sys
Image Path: C:\Windows\system32\DRIVERS\avgntflt.sys
Address: 0x902A2000 Size: 81920 File Visible: - Signed: -
Status: -
Name: avipbb.sys
Image Path: C:\Windows\system32\DRIVERS\avipbb.sys
Address: 0x8F3C7000 Size: 114688 File Visible: - Signed: -
Status: -
Name: BATTC.SYS
Image Path: C:\Windows\system32\DRIVERS\BATTC.SYS
Address: 0x805E7000 Size: 40960 File Visible: - Signed: -
Status: -
Name: Beep.SYS
Image Path: C:\Windows\System32\Drivers\Beep.SYS
Address: 0x90906000 Size: 28672 File Visible: - Signed: -
Status: -
Name: BOOTVID.dll
Image Path: C:\Windows\system32\BOOTVID.dll
Address: 0x80488000 Size: 32768 File Visible: - Signed: -
Status: -
Name: bowser.sys
Image Path: C:\Windows\system32\DRIVERS\bowser.sys
Address: 0x9E497000 Size: 102400 File Visible: - Signed: -
Status: -
Name: cdd.dll
Image Path: C:\Windows\System32\cdd.dll
Address: 0x98320000 Size: 57344 File Visible: - Signed: -
Status: -
Name: cdfs.sys
Image Path: C:\Windows\system32\DRIVERS\cdfs.sys
Address: 0x90236000 Size: 90112 File Visible: - Signed: -
Status: -
Name: cdrom.sys
Image Path: C:\Windows\system32\DRIVERS\cdrom.sys
Address: 0x8A57F000 Size: 98304 File Visible: - Signed: -
Status: -
Name: CI.dll
Image Path: C:\Windows\system32\CI.dll
Address: 0x804D1000 Size: 917504 File Visible: - Signed: -
Status: -
Name: CLASSPNP.SYS
Image Path: C:\Windows\system32\drivers\CLASSPNP.SYS
Address: 0x8A7A1000 Size: 135168 File Visible: - Signed: -
Status: -
Name: CLFS.SYS
Image Path: C:\Windows\system32\CLFS.SYS
Address: 0x80490000 Size: 266240 File Visible: - Signed: -
Status: -
Name: CmBatt.sys
Image Path: C:\Windows\system32\DRIVERS\CmBatt.sys
Address: 0x8EDD7000 Size: 14208 File Visible: - Signed: -
Status: -
Name: compbatt.sys
Image Path: C:\Windows\system32\DRIVERS\compbatt.sys
Address: 0x807FD000 Size: 10496 File Visible: - Signed: -
Status: -
Name: crashdmp.sys
Image Path: C:\Windows\System32\Drivers\crashdmp.sys
Address: 0x9024C000 Size: 53248 File Visible: - Signed: -
Status: -
Name: crcdisk.sys
Image Path: C:\Windows\system32\drivers\crcdisk.sys
Address: 0x8A7C2000 Size: 36864 File Visible: - Signed: -
Status: -
Name: ctxusbm.sys
Image Path: C:\Windows\system32\DRIVERS\ctxusbm.sys
Address: 0x8F3B3000 Size: 81920 File Visible: - Signed: -
Status: -
Name: CVPNDRVA.sys
Image Path: C:\Windows\system32\Drivers\CVPNDRVA.sys
Address: 0xA3408000 Size: 589824 File Visible: - Signed: -
Status: -
Name: dfsc.sys
Image Path: C:\Windows\System32\Drivers\dfsc.sys
Address: 0x8F39C000 Size: 94208 File Visible: - Signed: -
Status: -
Name: disk.sys
Image Path: C:\Windows\system32\drivers\disk.sys
Address: 0x8A790000 Size: 69632 File Visible: - Signed: -
Status: -
Name: dne2000.sys
Image Path: C:\Windows\system32\DRIVERS\dne2000.sys
Address: 0x8A5DF000 Size: 126592 File Visible: - Signed: -
Status: -
Name: drmk.sys
Image Path: C:\Windows\system32\drivers\drmk.sys
Address: 0x908BE000 Size: 151552 File Visible: - Signed: -
Status: -
Name: dump_dumpata.sys
Image Path: C:\Windows\System32\Drivers\dump_dumpata.sys
Address: 0x90259000 Size: 45056 File Visible: No Signed: -
Status: -
Name: dump_msahci.sys
Image Path: C:\Windows\System32\Drivers\dump_msahci.sys
Address: 0x90264000 Size: 40960 File Visible: No Signed: -
Status: -
Name: Dxapi.sys
Image Path: C:\Windows\System32\drivers\Dxapi.sys
Address: 0x9026E000 Size: 40960 File Visible: - Signed: -
Status: -
Name: dxgkrnl.sys
Image Path: C:\Windows\System32\drivers\dxgkrnl.sys
Address: 0x8E55C000 Size: 659456 File Visible: - Signed: -
Status: -
Name: ecache.sys
Image Path: C:\Windows\System32\drivers\ecache.sys
Address: 0x8A769000 Size: 159744 File Visible: - Signed: -
Status: -
Name: fileinfo.sys
Image Path: C:\Windows\system32\drivers\fileinfo.sys
Address: 0x826CF000 Size: 65536 File Visible: - Signed: -
Status: -
Name: fltmgr.sys
Image Path: C:\Windows\system32\drivers\fltmgr.sys
Address: 0x8269D000 Size: 204800 File Visible: - Signed: -
Status: -
Name: Fs_Rec.SYS
Image Path: C:\Windows\System32\Drivers\Fs_Rec.SYS
Address: 0x908F6000 Size: 36864 File Visible: - Signed: -
Status: -
Name: fwpkclnt.sys
Image Path: C:\Windows\System32\drivers\fwpkclnt.sys
Address: 0x8A4F7000 Size: 110592 File Visible: - Signed: -
Status: -
Name: GEARAspiWDM.sys
Image Path: C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
Address: 0x8EDF9000 Size: 21120 File Visible: - Signed: -
Status: -
Name: hal.dll
Image Path: C:\Windows\system32\hal.dll
Address: 0x82019000 Size: 208896 File Visible: - Signed: -
Status: -
Name: HDAudBus.sys
Image Path: C:\Windows\system32\DRIVERS\HDAudBus.sys
Address: 0x82750000 Size: 577536 File Visible: - Signed: -
Status: -
Name: HIDCLASS.SYS
Image Path: C:\Windows\system32\DRIVERS\HIDCLASS.SYS
Address: 0x9020B000 Size: 65536 File Visible: - Signed: -
Status: -
Name: HIDPARSE.SYS
Image Path: C:\Windows\system32\DRIVERS\HIDPARSE.SYS
Address: 0x90916000 Size: 28672 File Visible: - Signed: -
Status: -
Name: hidusb.sys
Image Path: C:\Windows\system32\DRIVERS\hidusb.sys
Address: 0x8A3F6000 Size: 36864 File Visible: - Signed: -
Status: -
Name: HTTP.sys
Image Path: C:\Windows\system32\drivers\HTTP.sys
Address: 0x9E40D000 Size: 446464 File Visible: - Signed: -
Status: -
Name: i8042prt.sys
Image Path: C:\Windows\system32\DRIVERS\i8042prt.sys
Address: 0x8EDDB000 Size: 77824 File Visible: - Signed: -
Status: -
Name: intelppm.sys
Image Path: C:\Windows\system32\DRIVERS\intelppm.sys
Address: 0x8A5D0000 Size: 61440 File Visible: - Signed: -
Status: -
Name: kbdclass.sys
Image Path: C:\Windows\system32\DRIVERS\kbdclass.sys
Address: 0x8EDEE000 Size: 45056 File Visible: - Signed: -
Status: -
Name: kbdhid.sys
Image Path: C:\Windows\system32\DRIVERS\kbdhid.sys
Address: 0x90223000 Size: 36864 File Visible: - Signed: -
Status: -
Name: kdcom.dll
Image Path: C:\Windows\system32\kdcom.dll
Address: 0x80400000 Size: 28672 File Visible: - Signed: -
Status: -
Name: ks.sys
Image Path: C:\Windows\system32\DRIVERS\ks.sys
Address: 0x8F274000 Size: 172032 File Visible: - Signed: -
Status: -
Name: ksecdd.sys
Image Path: C:\Windows\System32\Drivers\ksecdd.sys
Address: 0x826DF000 Size: 462848 File Visible: - Signed: -
Status: -
Name: kxldapoc.sys
Image Path: C:\Users\Lars\AppData\Local\Temp\kxldapoc.sys
Address: 0xA35B3000 Size: 93056 File Visible: No Signed: -
Status: -
Name: lltdio.sys
Image Path: C:\Windows\system32\DRIVERS\lltdio.sys
Address: 0x90366000 Size: 65536 File Visible: - Signed: -
Status: -
Name: luafv.sys
Image Path: C:\Windows\system32\drivers\luafv.sys
Address: 0x90287000 Size: 110592 File Visible: - Signed: -
Status: -
Name: mcupdate_GenuineIntel.dll
Image Path: C:\Windows\system32\mcupdate_GenuineIntel.dll
Address: 0x80407000 Size: 458752 File Visible: - Signed: -
Status: -
Name: monitor.sys
Image Path: C:\Windows\system32\DRIVERS\monitor.sys
Address: 0x90278000 Size: 61440 File Visible: - Signed: -
Status: -
Name: mouclass.sys
Image Path: C:\Windows\system32\DRIVERS\mouclass.sys
Address: 0x8EA00000 Size: 45056 File Visible: - Signed: -
Status: -
Name: mouhid.sys
Image Path: C:\Windows\system32\DRIVERS\mouhid.sys
Address: 0x9021B000 Size: 32768 File Visible: - Signed: -
Status: -
Name: mountmgr.sys
Image Path: C:\Windows\System32\drivers\mountmgr.sys
Address: 0x8264F000 Size: 65536 File Visible: - Signed: -
Status: -
Name: mpsdrv.sys
Image Path: C:\Windows\System32\drivers\mpsdrv.sys
Address: 0x9E4B0000 Size: 86016 File Visible: - Signed: -
Status: -
Name: mrxdav.sys
Image Path: C:\Windows\system32\drivers\mrxdav.sys
Address: 0x9E4C5000 Size: 135168 File Visible: - Signed: -
Status: -
Name: mrxsmb.sys
Image Path: C:\Windows\system32\DRIVERS\mrxsmb.sys
Address: 0x9E4E6000 Size: 126976 File Visible: - Signed: -
Status: -
Name: mrxsmb10.sys
Image Path: C:\Windows\system32\DRIVERS\mrxsmb10.sys
Address: 0x9E505000 Size: 233472 File Visible: - Signed: -
Status: -
Name: mrxsmb20.sys
Image Path: C:\Windows\system32\DRIVERS\mrxsmb20.sys
Address: 0x9E53E000 Size: 98304 File Visible: - Signed: -
Status: -
Name: msahci.sys
Image Path: C:\Windows\system32\drivers\msahci.sys
Address: 0x82685000 Size: 40960 File Visible: - Signed: -
Status: -
Name: Msfs.SYS
Image Path: C:\Windows\System32\Drivers\Msfs.SYS
Address: 0x9095A000 Size: 45056 File Visible: - Signed: -
Status: -
Name: msisadrv.sys
Image Path: C:\Windows\system32\drivers\msisadrv.sys
Address: 0x807F5000 Size: 32768 File Visible: - Signed: -
Status: -
Name: msiscsi.sys
Image Path: C:\Windows\system32\DRIVERS\msiscsi.sys
Address: 0x8A37B000 Size: 192512 File Visible: - Signed: -
Status: -
Name: msrpc.sys
Image Path: C:\Windows\system32\drivers\msrpc.sys
Address: 0x8A315000 Size: 176128 File Visible: - Signed: -
Status: -
Name: mssmbios.sys
Image Path: C:\Windows\system32\DRIVERS\mssmbios.sys
Address: 0x8F29E000 Size: 40960 File Visible: - Signed: -
Status: -
Name: mup.sys
Image Path: C:\Windows\System32\Drivers\mup.sys
Address: 0x8A75A000 Size: 61440 File Visible: - Signed: -
Status: -
Name: ndis.sys
Image Path: C:\Windows\system32\drivers\ndis.sys
Address: 0x8A20A000 Size: 1093632 File Visible: - Signed: -
Status: -
Name: ndistapi.sys
Image Path: C:\Windows\system32\DRIVERS\ndistapi.sys
Address: 0x8A3EB000 Size: 45056 File Visible: - Signed: -
Status: -
Name: ndisuio.sys
Image Path: C:\Windows\system32\DRIVERS\ndisuio.sys
Address: 0x903A0000 Size: 40960 File Visible: - Signed: -
Status: -
Name: ndiswan.sys
Image Path: C:\Windows\system32\DRIVERS\ndiswan.sys
Address: 0x8F207000 Size: 143360 File Visible: - Signed: -
Status: -
Name: NDProxy.SYS
Image Path: C:\Windows\System32\Drivers\NDProxy.SYS
Address: 0x8F2EA000 Size: 69632 File Visible: - Signed: -
Status: -
Name: netbios.sys
Image Path: C:\Windows\system32\DRIVERS\netbios.sys
Address: 0x909EE000 Size: 57344 File Visible: - Signed: -
Status: -
Name: netbt.sys
Image Path: C:\Windows\System32\DRIVERS\netbt.sys
Address: 0x8F2FB000 Size: 204800 File Visible: - Signed: -
Status: -
Name: NETIO.SYS
Image Path: C:\Windows\system32\drivers\NETIO.SYS
Address: 0x8A340000 Size: 241664 File Visible: - Signed: -
Status: -
Name: NETw5v32.sys
Image Path: C:\Windows\system32\DRIVERS\NETw5v32.sys
Address: 0x8EA0E000 Size: 3698688 File Visible: - Signed: -
Status: -
Name: Npfs.SYS
Image Path: C:\Windows\System32\Drivers\Npfs.SYS
Address: 0x90965000 Size: 57344 File Visible: - Signed: -
Status: -
Name: nsiproxy.sys
Image Path: C:\Windows\system32\drivers\nsiproxy.sys
Address: 0x8F392000 Size: 40960 File Visible: - Signed: -
Status: -
Name: Ntfs.sys
Image Path: C:\Windows\System32\Drivers\Ntfs.sys
Address: 0x8A609000 Size: 1114112 File Visible: - Signed: -
Status: -
Name: ntkrnlpa.exe
Image Path: C:\Windows\system32\ntkrnlpa.exe
Address: 0x8204C000 Size: 3903488 File Visible: - Signed: -
Status: -
Name: Null.SYS
Image Path: C:\Windows\System32\Drivers\Null.SYS
Address: 0x908FF000 Size: 28672 File Visible: - Signed: -
Status: -
Name: nvBridge.kmd
Image Path: C:\Windows\system32\DRIVERS\nvBridge.kmd
Address: 0x8E55A000 Size: 8192 File Visible: - Signed: -
Status: -
Name: nvhda32v.sys
Image Path: C:\Windows\system32\drivers\nvhda32v.sys
Address: 0x908E3000 Size: 77824 File Visible: - Signed: -
Status: -
Name: nvlddmkm.sys
Image Path: C:\Windows\system32\DRIVERS\nvlddmkm.sys
Address: 0x8DC04000 Size: 9786752 File Visible: - Signed: -
Status: -
Name: nwifi.sys
Image Path: C:\Windows\system32\DRIVERS\nwifi.sys
Address: 0x90376000 Size: 172032 File Visible: - Signed: -
Status: -
Name: pacer.sys
Image Path: C:\Windows\system32\DRIVERS\pacer.sys
Address: 0x8F32D000 Size: 90112 File Visible: - Signed: -
Status: -
Name: partmgr.sys
Image Path: C:\Windows\System32\drivers\partmgr.sys
Address: 0x805D8000 Size: 61440 File Visible: - Signed: -
Status: -
Name: pci.sys
Image Path: C:\Windows\system32\drivers\pci.sys
Address: 0x805B1000 Size: 159744 File Visible: - Signed: -
Status: -
Name: PCIIDEX.SYS
Image Path: C:\Windows\system32\drivers\PCIIDEX.SYS
Address: 0x8268F000 Size: 57344 File Visible: - Signed: -
Status: -
Name: peauth.sys
Image Path: C:\Windows\system32\drivers\peauth.sys
Address: 0xA3498000 Size: 909312 File Visible: - Signed: -
Status: -
Name: PnpManager
Image Path: \Driver\PnpManager
Address: 0x8204C000 Size: 3903488 File Visible: - Signed: -
Status: -
Name: portcls.sys
Image Path: C:\Windows\system32\drivers\portcls.sys
Address: 0x90891000 Size: 184320 File Visible: - Signed: -
Status: -
Name: PSHED.dll
Image Path: C:\Windows\system32\PSHED.dll
Address: 0x80477000 Size: 69632 File Visible: - Signed: -
Status: -
Name: rasacd.sys
Image Path: C:\Windows\System32\DRIVERS\rasacd.sys
Address: 0x90973000 Size: 36864 File Visible: - Signed: -
Status: -
Name: rasl2tp.sys
Image Path: C:\Windows\system32\DRIVERS\rasl2tp.sys
Address: 0x827DD000 Size: 94208 File Visible: - Signed: -
Status: -
Name: raspppoe.sys
Image Path: C:\Windows\system32\DRIVERS\raspppoe.sys
Address: 0x8F22A000 Size: 61440 File Visible: - Signed: -
Status: -
Name: raspptp.sys
Image Path: C:\Windows\system32\DRIVERS\raspptp.sys
Address: 0x8F239000 Size: 81920 File Visible: - Signed: -
Status: -
Name: rassstp.sys
Image Path: C:\Windows\system32\DRIVERS\rassstp.sys
Address: 0x8F24D000 Size: 86016 File Visible: - Signed: -
Status: -
Name: RAW
Image Path: \FileSystem\RAW
Address: 0x8204C000 Size: 3903488 File Visible: - Signed: -
Status: -
Name: rdbss.sys
Image Path: C:\Windows\system32\DRIVERS\rdbss.sys
Address: 0x8F356000 Size: 245760 File Visible: - Signed: -
Status: -
Name: RDPCDD.sys
Image Path: C:\Windows\System32\DRIVERS\RDPCDD.sys
Address: 0x9094A000 Size: 32768 File Visible: - Signed: -
Status: -
Name: rdpencdd.sys
Image Path: C:\Windows\system32\drivers\rdpencdd.sys
Address: 0x90952000 Size: 32768 File Visible: - Signed: -
Status: -
Name: rootrepeal.sys
Image Path: C:\Windows\system32\drivers\rootrepeal.sys
Address: 0xA35CA000 Size: 49152 File Visible: No Signed: -
Status: -
Name: rspndr.sys
Image Path: C:\Windows\system32\DRIVERS\rspndr.sys
Address: 0x903AA000 Size: 77824 File Visible: - Signed: -
Status: -
Name: RTKVHDA.sys
Image Path: C:\Windows\system32\drivers\RTKVHDA.sys
Address: 0x90608000 Size: 2657344 File Visible: - Signed: -
Status: -
Name: Rtlh86.sys
Image Path: C:\Windows\system32\DRIVERS\Rtlh86.sys
Address: 0x8ED95000 Size: 270336 File Visible: - Signed: -
Status: -
Name: SCSIPORT.SYS
Image Path: C:\Windows\System32\Drivers\SCSIPORT.SYS
Address: 0x80789000 Size: 155648 File Visible: - Signed: -
Status: -
Name: secdrv.SYS
Image Path: C:\Windows\System32\Drivers\secdrv.SYS
Address: 0xA3576000 Size: 40960 File Visible: - Signed: -
Status: -
Name: serscan.sys
Image Path: C:\Windows\system32\DRIVERS\serscan.sys
Address: 0x8A7F8000 Size: 32768 File Visible: - Signed: -
Status: -
Name: smb.sys
Image Path: C:\Windows\system32\DRIVERS\smb.sys
Address: 0x90992000 Size: 81920 File Visible: - Signed: -
Status: -
Name: spdk.sys
Image Path: C:\Windows\System32\Drivers\spdk.sys
Address: 0x8068D000 Size: 995328 File Visible: No Signed: -
Status: -
Name: spldr.sys
Image Path: C:\Windows\System32\Drivers\spldr.sys
Address: 0x8A752000 Size: 32768 File Visible: - Signed: -
Status: -
Name: spsys.sys
Image Path: C:\Windows\system32\drivers\spsys.sys
Address: 0x902B6000 Size: 720896 File Visible: - Signed: -
Status: -
Name: sptd
Image Path: \Driver\sptd
Address: 0x00000000 Size: 0 File Visible: No Signed: -
Status: -
Name: srv.sys
Image Path: C:\Windows\System32\DRIVERS\srv.sys
Address: 0x9E57D000 Size: 319488 File Visible: - Signed: -
Status: -
Name: srv2.sys
Image Path: C:\Windows\System32\DRIVERS\srv2.sys
Address: 0x9E556000 Size: 159744 File Visible: - Signed: -
Status: -
Name: srvnet.sys
Image Path: C:\Windows\System32\DRIVERS\srvnet.sys
Address: 0x9E47A000 Size: 118784 File Visible: - Signed: -
Status: -
Name: ssmdrv.sys
Image Path: C:\Windows\system32\DRIVERS\ssmdrv.sys
Address: 0x90600000 Size: 23040 File Visible: - Signed: -
Status: -
Name: storport.sys
Image Path: C:\Windows\system32\DRIVERS\storport.sys
Address: 0x8A3AA000 Size: 266240 File Visible: - Signed: -
Status: -
Name: swenum.sys
Image Path: C:\Windows\system32\DRIVERS\swenum.sys
Address: 0x8F272000 Size: 4992 File Visible: - Signed: -
Status: -
Name: tcpip.sys
Image Path: C:\Windows\System32\drivers\tcpip.sys
Address: 0x8A40D000 Size: 958464 File Visible: - Signed: -
Status: -
Name: tcpipreg.sys
Image Path: C:\Windows\System32\drivers\tcpipreg.sys
Address: 0xA3580000 Size: 49152 File Visible: - Signed: -
Status: -
Name: TDI.SYS
Image Path: C:\Windows\system32\DRIVERS\TDI.SYS
Address: 0x8A400000 Size: 45056 File Visible: - Signed: -
Status: -
Name: tdx.sys
Image Path: C:\Windows\system32\DRIVERS\tdx.sys
Address: 0x9097C000 Size: 90112 File Visible: - Signed: -
Status: -
Name: termdd.sys
Image Path: C:\Windows\system32\DRIVERS\termdd.sys
Address: 0x8F262000 Size: 65536 File Visible: - Signed: -
Status: -
Name: TSDDD.dll
Image Path: C:\Windows\System32\TSDDD.dll
Address: 0x982B0000 Size: 36864 File Visible: - Signed: -
Status: -
Name: tunmp.sys
Image Path: C:\Windows\system32\DRIVERS\tunmp.sys
Address: 0x8A600000 Size: 36864 File Visible: - Signed: -
Status: -
Name: tunnel.sys
Image Path: C:\Windows\system32\DRIVERS\tunnel.sys
Address: 0x8A7ED000 Size: 45056 File Visible: - Signed: -
Status: -
Name: umbus.sys
Image Path: C:\Windows\system32\DRIVERS\umbus.sys
Address: 0x8F2A8000 Size: 53248 File Visible: - Signed: -
Status: -
Name: USBD.SYS
Image Path: C:\Windows\system32\DRIVERS\USBD.SYS
Address: 0x9090D000 Size: 8192 File Visible: - Signed: -
Status: -
Name: usbehci.sys
Image Path: C:\Windows\system32\DRIVERS\usbehci.sys
Address: 0x8A570000 Size: 61440 File Visible: - Signed: -
Status: -
Name: usbhub.sys
Image Path: C:\Windows\system32\DRIVERS\usbhub.sys
Address: 0x8F2B5000 Size: 217088 File Visible: - Signed: -
Status: -
Name: USBPORT.SYS
Image Path: C:\Windows\system32\DRIVERS\USBPORT.SYS
Address: 0x8A532000 Size: 253952 File Visible: - Signed: -
Status: -
Name: USBSTOR.SYS
Image Path: C:\Windows\system32\DRIVERS\USBSTOR.SYS
Address: 0x8F3E3000 Size: 86016 File Visible: - Signed: -
Status: -
Name: usbuhci.sys
Image Path: C:\Windows\system32\DRIVERS\usbuhci.sys
Address: 0x8A527000 Size: 45056 File Visible: - Signed: -
Status: -
Name: vga.sys
Image Path: C:\Windows\System32\drivers\vga.sys
Address: 0x9091D000 Size: 49152 File Visible: - Signed: -
Status: -
Name: VIDEOPRT.SYS
Image Path: C:\Windows\System32\drivers\VIDEOPRT.SYS
Address: 0x90929000 Size: 135168 File Visible: - Signed: -
Status: -
Name: volmgr.sys
Image Path: C:\Windows\system32\drivers\volmgr.sys
Address: 0x805F1000 Size: 61440 File Visible: - Signed: -
Status: -
Name: volmgrx.sys
Image Path: C:\Windows\System32\drivers\volmgrx.sys
Address: 0x82605000 Size: 303104 File Visible: - Signed: -
Status: -
Name: volsnap.sys
Image Path: C:\Windows\system32\drivers\volsnap.sys
Address: 0x8A719000 Size: 233472 File Visible: - Signed: -
Status: -
Name: wanarp.sys
Image Path: C:\Windows\system32\DRIVERS\wanarp.sys
Address: 0x8F343000 Size: 77824 File Visible: - Signed: -
Status: -
Name: watchdog.sys
Image Path: C:\Windows\System32\drivers\watchdog.sys
Address: 0x8A51B000 Size: 49152 File Visible: - Signed: -
Status: -
Name: Wdf01000.sys
Image Path: C:\Windows\system32\drivers\Wdf01000.sys
Address: 0x80604000 Size: 507904 File Visible: - Signed: -
Status: -
Name: WDFLDR.SYS
Image Path: C:\Windows\system32\drivers\WDFLDR.SYS
Address: 0x80680000 Size: 53248 File Visible: - Signed: -
Status: -
Name: Win32k
Image Path: \Driver\Win32k
Address: 0x98090000 Size: 2109440 File Visible: - Signed: -
Status: -
Name: win32k.sys
Image Path: C:\Windows\System32\win32k.sys
Address: 0x98090000 Size: 2109440 File Visible: - Signed: -
Status: -
Name: wmiacpi.sys
Image Path: C:\Windows\system32\DRIVERS\wmiacpi.sys
Address: 0x8A512000 Size: 36864 File Visible: - Signed: -
Status: -
Name: WMILIB.SYS
Image Path: C:\Windows\System32\Drivers\WMILIB.SYS
Address: 0x80780000 Size: 36864 File Visible: - Signed: -
Status: -
Name: WMIxWDM
Image Path: \Driver\WMIxWDM
Address: 0x8204C000 Size: 3903488 File Visible: - Signed: -
Status: -
Name: WUDFPf.sys
Image Path: C:\Windows\system32\DRIVERS\WUDFPf.sys
Address: 0xA35A1000 Size: 73728 File Visible: - Signed: -
Status: -
Name: WUDFRd.sys
Image Path: C:\Windows\system32\DRIVERS\WUDFRd.sys
Address: 0xA358C000 Size: 83328 File Visible: - Signed: -
Status: -
Name: x10ufx2.sys
Image Path: C:\Windows\System32\Drivers\x10ufx2.sys
Address: 0x9022C000 Size: 40960 File Visible: - Signed: -
Status: -
Code:
ATTFilter ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time: 2010/07/08 11:48
Program Version: Version 1.3.5.0
Windows Version: Windows Vista SP2
==================================================
Stealth Objects
-------------------
Object: Hidden Code [Driver: Ntfs, IRP_MJ_CREATE]
Process: System Address: 0x8552c1f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLOSE]
Process: System Address: 0x8552c1f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_READ]
Process: System Address: 0x8552c1f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_WRITE]
Process: System Address: 0x8552c1f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x8552c1f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x8552c1f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_EA]
Process: System Address: 0x8552c1f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_EA]
Process: System Address: 0x8552c1f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x8552c1f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x8552c1f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_VOLUME_INFORMATION]
Process: System Address: 0x8552c1f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x8552c1f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x8552c1f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8552c1f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_SHUTDOWN]
Process: System Address: 0x8552c1f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x8552c1f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLEANUP]
Process: System Address: 0x8552c1f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_SECURITY]
Process: System Address: 0x8552c1f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_SECURITY]
Process: System Address: 0x8552c1f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_QUOTA]
Process: System Address: 0x8552c1f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_QUOTA]
Process: System Address: 0x8552c1f8 Size: 121
Object: Hidden Code [Driver: Ntfs, IRP_MJ_PNP]
Process: System Address: 0x8552c1f8 Size: 121
Object: Hidden Code [Driver: atapi, IRP_MJ_CREATE]
Process: System Address: 0x8552a1f8 Size: 121
Object: Hidden Code [Driver: atapi, IRP_MJ_CLOSE]
Process: System Address: 0x8552a1f8 Size: 121
Object: Hidden Code [Driver: atapi, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8552a1f8 Size: 121
Object: Hidden Code [Driver: atapi, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x8552a1f8 Size: 121
Object: Hidden Code [Driver: atapi, IRP_MJ_POWER]
Process: System Address: 0x8552a1f8 Size: 121
Object: Hidden Code [Driver: atapi, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x8552a1f8 Size: 121
Object: Hidden Code [Driver: atapi, IRP_MJ_PNP]
Process: System Address: 0x8552a1f8 Size: 121
Object: Hidden Code [Driver: cdrom, IRP_MJ_CREATE]
Process: System Address: 0x864991f8 Size: 121
Object: Hidden Code [Driver: cdrom, IRP_MJ_CLOSE]
Process: System Address: 0x864991f8 Size: 121
Object: Hidden Code [Driver: cdrom, IRP_MJ_READ]
Process: System Address: 0x864991f8 Size: 121
Object: Hidden Code [Driver: cdrom, IRP_MJ_WRITE]
Process: System Address: 0x864991f8 Size: 121
Object: Hidden Code [Driver: cdrom, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x864991f8 Size: 121
Object: Hidden Code [Driver: cdrom, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x864991f8 Size: 121
Object: Hidden Code [Driver: cdrom, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x864991f8 Size: 121
Object: Hidden Code [Driver: cdrom, IRP_MJ_SHUTDOWN]
Process: System Address: 0x864991f8 Size: 121
Object: Hidden Code [Driver: cdrom, IRP_MJ_POWER]
Process: System Address: 0x864991f8 Size: 121
Object: Hidden Code [Driver: cdrom, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x864991f8 Size: 121
Object: Hidden Code [Driver: cdrom, IRP_MJ_PNP]
Process: System Address: 0x864991f8 Size: 121
Object: Hidden Code [Driver: USBSTORЍ摍, IRP_MJ_CREATE]
Process: System Address: 0x8fe941f8 Size: 121
Object: Hidden Code [Driver: USBSTORЍ摍, IRP_MJ_CLOSE]
Process: System Address: 0x8fe941f8 Size: 121
Object: Hidden Code [Driver: USBSTORЍ摍, IRP_MJ_READ]
Process: System Address: 0x8fe941f8 Size: 121
Object: Hidden Code [Driver: USBSTORЍ摍, IRP_MJ_WRITE]
Process: System Address: 0x8fe941f8 Size: 121
Object: Hidden Code [Driver: USBSTORЍ摍, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8fe941f8 Size: 121
Object: Hidden Code [Driver: USBSTORЍ摍, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x8fe941f8 Size: 121
Object: Hidden Code [Driver: USBSTORЍ摍, IRP_MJ_POWER]
Process: System Address: 0x8fe941f8 Size: 121
Object: Hidden Code [Driver: USBSTORЍ摍, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x8fe941f8 Size: 121
Object: Hidden Code [Driver: USBSTORЍ摍, IRP_MJ_PNP]
Process: System Address: 0x8fe941f8 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_CREATE]
Process: System Address: 0x864a11f8 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_CLOSE]
Process: System Address: 0x864a11f8 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x864a11f8 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x864a11f8 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_POWER]
Process: System Address: 0x864a11f8 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x864a11f8 Size: 121
Object: Hidden Code [Driver: usbuhci, IRP_MJ_PNP]
Process: System Address: 0x864a11f8 Size: 121
Object: Hidden Code [Driver: a2ltuhh3Ї灓摴, IRP_MJ_CREATE]
Process: System Address: 0x865dc1f8 Size: 121
Object: Hidden Code [Driver: a2ltuhh3Ї灓摴, IRP_MJ_CLOSE]
Process: System Address: 0x865dc1f8 Size: 121
Object: Hidden Code [Driver: a2ltuhh3Ї灓摴, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x865dc1f8 Size: 121
Object: Hidden Code [Driver: a2ltuhh3Ї灓摴, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x865dc1f8 Size: 121
Object: Hidden Code [Driver: a2ltuhh3Ї灓摴, IRP_MJ_POWER]
Process: System Address: 0x865dc1f8 Size: 121
Object: Hidden Code [Driver: a2ltuhh3Ї灓摴, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x865dc1f8 Size: 121
Object: Hidden Code [Driver: a2ltuhh3Ї灓摴, IRP_MJ_PNP]
Process: System Address: 0x865dc1f8 Size: 121
Object: Hidden Code [Driver: Smb, IRP_MJ_CREATE]
Process: System Address: 0x8f501500 Size: 121
Object: Hidden Code [Driver: Smb, IRP_MJ_CLOSE]
Process: System Address: 0x8f501500 Size: 121
Object: Hidden Code [Driver: Smb, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8f501500 Size: 121
Object: Hidden Code [Driver: Smb, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x8f501500 Size: 121
Object: Hidden Code [Driver: Smb, IRP_MJ_CLEANUP]
Process: System Address: 0x8f501500 Size: 121
Object: Hidden Code [Driver: Smb, IRP_MJ_PNP]
Process: System Address: 0x8f501500 Size: 121
Object: Hidden Code [Driver: netbt, IRP_MJ_CREATE]
Process: System Address: 0x8f4bb500 Size: 121
Object: Hidden Code [Driver: netbt, IRP_MJ_CLOSE]
Process: System Address: 0x8f4bb500 Size: 121
Object: Hidden Code [Driver: netbt, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8f4bb500 Size: 121
Object: Hidden Code [Driver: netbt, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x8f4bb500 Size: 121
Object: Hidden Code [Driver: netbt, IRP_MJ_CLEANUP]
Process: System Address: 0x8f4bb500 Size: 121
Object: Hidden Code [Driver: netbt, IRP_MJ_PNP]
Process: System Address: 0x8f4bb500 Size: 121
Object: Hidden Code [Driver: iScsiPrtЃ浍楓瑠赔, IRP_MJ_CREATE]
Process: System Address: 0x8663c1f8 Size: 121
Object: Hidden Code [Driver: iScsiPrtЃ浍楓瑠赔, IRP_MJ_CLOSE]
Process: System Address: 0x8663c1f8 Size: 121
Object: Hidden Code [Driver: iScsiPrtЃ浍楓瑠赔, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8663c1f8 Size: 121
Object: Hidden Code [Driver: iScsiPrtЃ浍楓瑠赔, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x8663c1f8 Size: 121
Object: Hidden Code [Driver: iScsiPrtЃ浍楓瑠赔, IRP_MJ_POWER]
Process: System Address: 0x8663c1f8 Size: 121
Object: Hidden Code [Driver: iScsiPrtЃ浍楓瑠赔, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x8663c1f8 Size: 121
Object: Hidden Code [Driver: iScsiPrtЃ浍楓瑠赔, IRP_MJ_PNP]
Process: System Address: 0x8663c1f8 Size: 121
Object: Hidden Code [Driver: volmgr, IRP_MJ_CREATE]
Process: System Address: 0x855281f8 Size: 121
Object: Hidden Code [Driver: volmgr, IRP_MJ_READ]
Process: System Address: 0x855281f8 Size: 121
Object: Hidden Code [Driver: volmgr, IRP_MJ_WRITE]
Process: System Address: 0x855281f8 Size: 121
Object: Hidden Code [Driver: volmgr, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x855281f8 Size: 121
Object: Hidden Code [Driver: volmgr, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x855281f8 Size: 121
Object: Hidden Code [Driver: volmgr, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x855281f8 Size: 121
Object: Hidden Code [Driver: volmgr, IRP_MJ_SHUTDOWN]
Process: System Address: 0x855281f8 Size: 121
Object: Hidden Code [Driver: volmgr, IRP_MJ_CLEANUP]
Process: System Address: 0x855281f8 Size: 121
Object: Hidden Code [Driver: volmgr, IRP_MJ_POWER]
Process: System Address: 0x855281f8 Size: 121
Object: Hidden Code [Driver: volmgr, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x855281f8 Size: 121
Object: Hidden Code [Driver: volmgr, IRP_MJ_PNP]
Process: System Address: 0x855281f8 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_CREATE]
Process: System Address: 0x864ea1f8 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_CLOSE]
Process: System Address: 0x864ea1f8 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x864ea1f8 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x864ea1f8 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_POWER]
Process: System Address: 0x864ea1f8 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x864ea1f8 Size: 121
Object: Hidden Code [Driver: usbehci, IRP_MJ_PNP]
Process: System Address: 0x864ea1f8 Size: 121
Object: Hidden Code [Driver: msahci, IRP_MJ_POWER]
Process: System Address: 0x8552b1f8 Size: 121
Object: Hidden Code [Driver: msahci, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x8552b1f8 Size: 121
Object: Hidden Code [Driver: msahci, IRP_MJ_PNP]
Process: System Address: 0x8552b1f8 Size: 121
Object: Hidden Code [Driver: mrxsmb챠薎І晖呁잀饜, IRP_MJ_CREATE]
Process: System Address: 0x8645a1f8 Size: 121
Object: Hidden Code [Driver: mrxsmb챠薎І晖呁잀饜, IRP_MJ_CREATE_NAMED_PIPE]
Process: System Address: 0x8645a1f8 Size: 121
Object: Hidden Code [Driver: mrxsmb챠薎І晖呁잀饜, IRP_MJ_CLOSE]
Process: System Address: 0x8645a1f8 Size: 121
Object: Hidden Code [Driver: mrxsmb챠薎І晖呁잀饜, IRP_MJ_READ]
Process: System Address: 0x8645a1f8 Size: 121
Object: Hidden Code [Driver: mrxsmb챠薎І晖呁잀饜, IRP_MJ_WRITE]
Process: System Address: 0x8645a1f8 Size: 121
Object: Hidden Code [Driver: mrxsmb챠薎І晖呁잀饜, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x8645a1f8 Size: 121
Object: Hidden Code [Driver: mrxsmb챠薎І晖呁잀饜, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x8645a1f8 Size: 121
Object: Hidden Code [Driver: mrxsmb챠薎І晖呁잀饜, IRP_MJ_QUERY_EA]
Process: System Address: 0x8645a1f8 Size: 121
Object: Hidden Code [Driver: mrxsmb챠薎І晖呁잀饜, IRP_MJ_SET_EA]
Process: System Address: 0x8645a1f8 Size: 121
Object: Hidden Code [Driver: mrxsmb챠薎І晖呁잀饜, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x8645a1f8 Size: 121
Object: Hidden Code [Driver: mrxsmb챠薎І晖呁잀饜, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x8645a1f8 Size: 121
Object: Hidden Code [Driver: mrxsmb챠薎І晖呁잀饜, IRP_MJ_SET_VOLUME_INFORMATION]
Process: System Address: 0x8645a1f8 Size: 121
Object: Hidden Code [Driver: mrxsmb챠薎І晖呁잀饜, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x8645a1f8 Size: 121
Object: Hidden Code [Driver: mrxsmb챠薎І晖呁잀饜, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x8645a1f8 Size: 121
Object: Hidden Code [Driver: mrxsmb챠薎І晖呁잀饜, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8645a1f8 Size: 121
Object: Hidden Code [Driver: mrxsmb챠薎І晖呁잀饜, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x8645a1f8 Size: 121
Object: Hidden Code [Driver: mrxsmb챠薎І晖呁잀饜, IRP_MJ_SHUTDOWN]
Process: System Address: 0x8645a1f8 Size: 121
Object: Hidden Code [Driver: mrxsmb챠薎І晖呁잀饜, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x8645a1f8 Size: 121
Object: Hidden Code [Driver: mrxsmb챠薎І晖呁잀饜, IRP_MJ_CLEANUP]
Process: System Address: 0x8645a1f8 Size: 121
Object: Hidden Code [Driver: mrxsmb챠薎І晖呁잀饜, IRP_MJ_CREATE_MAILSLOT]
Process: System Address: 0x8645a1f8 Size: 121
Object: Hidden Code [Driver: mrxsmb챠薎І晖呁잀饜, IRP_MJ_QUERY_SECURITY]
Process: System Address: 0x8645a1f8 Size: 121
Object: Hidden Code [Driver: mrxsmb챠薎І晖呁잀饜, IRP_MJ_SET_SECURITY]
Process: System Address: 0x8645a1f8 Size: 121
Object: Hidden Code [Driver: mrxsmb챠薎І晖呁잀饜, IRP_MJ_POWER]
Process: System Address: 0x8645a1f8 Size: 121
Object: Hidden Code [Driver: mrxsmb챠薎І晖呁잀饜, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x8645a1f8 Size: 121
Object: Hidden Code [Driver: mrxsmb챠薎І晖呁잀饜, IRP_MJ_DEVICE_CHANGE]
Process: System Address: 0x8645a1f8 Size: 121
Object: Hidden Code [Driver: mrxsmb챠薎І晖呁잀饜, IRP_MJ_QUERY_QUOTA]
Process: System Address: 0x8645a1f8 Size: 121
Object: Hidden Code [Driver: mrxsmb챠薎І晖呁잀饜, IRP_MJ_SET_QUOTA]
Process: System Address: 0x8645a1f8 Size: 121
Object: Hidden Code [Driver: mrxsmb챠薎І晖呁잀饜, IRP_MJ_PNP]
Process: System Address: 0x8645a1f8 Size: 121
Object: Hidden Code [Driver: cdfsЍ䵆汳`䡌赝䡌赝돠蘴䠠赝퍠艫, IRP_MJ_CREATE]
Process: System Address: 0x8644e1f8 Size: 121
Object: Hidden Code [Driver: cdfsЍ䵆汳`䡌赝䡌赝돠蘴䠠赝퍠艫, IRP_MJ_CLOSE]
Process: System Address: 0x8644e1f8 Size: 121
Object: Hidden Code [Driver: cdfsЍ䵆汳`䡌赝䡌赝돠蘴䠠赝퍠艫, IRP_MJ_READ]
Process: System Address: 0x8644e1f8 Size: 121
Object: Hidden Code [Driver: cdfsЍ䵆汳`䡌赝䡌赝돠蘴䠠赝퍠艫, IRP_MJ_WRITE]
Process: System Address: 0x8644e1f8 Size: 121
Object: Hidden Code [Driver: cdfsЍ䵆汳`䡌赝䡌赝돠蘴䠠赝퍠艫, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x8644e1f8 Size: 121
Object: Hidden Code [Driver: cdfsЍ䵆汳`䡌赝䡌赝돠蘴䠠赝퍠艫, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x8644e1f8 Size: 121
Object: Hidden Code [Driver: cdfsЍ䵆汳`䡌赝䡌赝돠蘴䠠赝퍠艫, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x8644e1f8 Size: 121
Object: Hidden Code [Driver: cdfsЍ䵆汳`䡌赝䡌赝돠蘴䠠赝퍠艫, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x8644e1f8 Size: 121
Object: Hidden Code [Driver: cdfsЍ䵆汳`䡌赝䡌赝돠蘴䠠赝퍠艫, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x8644e1f8 Size: 121
Object: Hidden Code [Driver: cdfsЍ䵆汳`䡌赝䡌赝돠蘴䠠赝퍠艫, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8644e1f8 Size: 121
Object: Hidden Code [Driver: cdfsЍ䵆汳`䡌赝䡌赝돠蘴䠠赝퍠艫, IRP_MJ_SHUTDOWN]
Process: System Address: 0x8644e1f8 Size: 121
Object: Hidden Code [Driver: cdfsЍ䵆汳`䡌赝䡌赝돠蘴䠠赝퍠艫, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x8644e1f8 Size: 121
Object: Hidden Code [Driver: cdfsЍ䵆汳`䡌赝䡌赝돠蘴䠠赝퍠艫, IRP_MJ_CLEANUP]
Process: System Address: 0x8644e1f8 Size: 121
Object: Hidden Code [Driver: cdfsЍ䵆汳`䡌赝䡌赝돠蘴䠠赝퍠艫, IRP_MJ_PNP]
Process: System Address: 0x8644e1f8 Size: 121
Vielen Dank! |
|
09.07.2010, 05:57
| #5 |
| /// Helfer-Team | Viren, Trojaner, Malware auf meinem PC. AntiVir findet, löscht und findet wieder. hi Reinigung und Systemprüfung : 1. alle Anwendungen schließen → Ordner für temporäre Dateien bitte leeren (Ordnerinhalt markieren-> löschen) lösche nur den Inhalt der Ordner, nicht die Ordner selbst! - Dateien, die noch in Benutzung sind, nicht löschbar, also versuche es bitte nicht mit "Gewalt"!. c:\windows\temp - anschließend den Papierkorb leeren 2. reinige dein System mit Ccleaner:
3.
4. Auch auf USB-Sticks, selbstgebrannten Datenträgern, externen Festplatten und anderen Datenträgern können Viren transportiert werden. Man muss daher durch regelmäßige Prüfungen auf Schäden, die durch Malware verursacht worden sein können, überwacht werden. Hierfür sind ser gut geegnet und empfohlen, die auf dem Speichermedium gesicherten Daten, mit Hilfe des kostenlosen Online Scanners zu prüfen. → Also alle vorhandenen externen Laufwerke inkl. evtl. vorhandener USB-Sticks an den Rechner anschließen, aber dabei die Shift-Taste gedrückt halten, damit die Autorun-Funktion nicht ausgeführt wird. Außerdem kann man die Autostarteigenschaft auch ausschalten: → Windows-Sicherheit: Datenträger-Autorun deaktivieren- bebilderte Anleitung v.Leonidas/3dcenter.org → Autorun/Autoplay gezielt für Laufwerkstypen oder -buchstaben abschalten/wintotal.de → Diese Silly -Beschreibung stützt die Annahme, dass er über einen USB-Stick kam. Die Ursache ist durch formatieren des Sticks aus der Welt geschafft, Du solltest darauf achten, dass dort keine Datei autorun.inf wieder auftaucht und etwas wählerisch sein, wo Du deinen Stick reinsteckst. → Den kompletten Rechner (also das ganze System) zu überprüfen (Systemprüfung ohne Säuberung) mit Kaspersky Online Scanner/klicke hier → um mit dem Vorgang fortzufahren klicke auf "Accept" → dann wähle "My computer" aus - Es dauert einige Zeit, bis ein Komplett-Scan durch gelaufen ist, also bitte um Geduld! Es kann einige Zeit dauern, bis der Scan abgeschlossen ist - je nach Größe der Festplatte eine oder mehrere Stunden - also Geduld... → Report angezeigt, klicke auf "Save as" - den bitte kopieren und in deinem Thread hier einfügen Vor dem Scan Einstellungen im Internet Explorer: → "Extras→ Internetoptionen→ Sicherheit": → alles auf Standardstufe stellen → Active X erlauben - damit die neue Virendefinitionen installiert werden können |
|
10.07.2010, 05:27
| #6 |
| | Viren, Trojaner, Malware auf meinem PC. AntiVir findet, löscht und findet wieder. (1) Die temporären Dateien sind gelöscht. (2) Durch CCleaner wurden alle Fehler behoben. (3) Das Ergebnis-Protokoll von SUPERAntiSpyware ist folgendes: Code:
ATTFilter SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com
Generated 07/09/2010 at 06:08 PM
Application Version : 4.40.1002
Core Rules Database Version : 5177
Trace Rules Database Version: 2989
Scan type : Complete Scan
Total Scan Time : 00:35:02
Memory items scanned : 710
Memory threats detected : 0
Registry items scanned : 8928
Registry threats detected : 1
File items scanned : 29193
File threats detected : 1
Malware.Trace
HKU\S-1-5-21-6710304-3433624121-992636011-1000\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON#SHELL
Trojan.Unclassified/Loader-Suspicious
D:\RVG SOFTWARE\HOLDEM MANAGER\LOADER.EXE
Code:
ATTFilter --------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Friday, July 9, 2010
Operating system: Microsoft Windows Vista Home Premium Edition, 32-bit Service Pack 2 (build 6002)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Friday, July 09, 2010 12:38:57
Records in database: 4242247
--------------------------------------------------------------------------------
Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes
Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
Scan statistics:
Objects scanned: 183548
Threats found: 5
Infected objects found: 5
Suspicious objects found: 0
Scan duration: 02:54:54
File name / Threat / Threats count
C:\Users\++++\AppData\Local\Xenocode\ApplianceCaches\HoldemManager.exe_v7BC20518\Native\STUBEXE\@APPDIR@\DBControlPanel.exe Infected: Backdoor.Win32.Poison.awex 1
C:\Users\++++\AppData\Local\Xenocode\ApplianceCaches\HoldemManager.exe_v7BC20518\Native\STUBEXE\@WINDIR@\Microsoft.NET\Framework\v2.0.50727\csc.exe Infected: Backdoor.Win32.Poison.awgh 1
C:\Users\++++\AppData\Local\Xenocode\ApplianceCaches\HoldemManager.exe_v7BC20518\Native\STUBEXE\@WINDIR@\Microsoft.NET\Framework\v2.0.50727\cvtres.exe Infected: Backdoor.Win32.Poison.awgg 1
C:\Users\++++\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44\5473416c-11d200de Infected: Exploit.Java.Agent.f 1
D:\Eigene Dateien\Poker\Alles\Dokumente, Hände etc\Theorie\Verschiedenes\Bücher\40 Poker EBooks\40PS_EBKS\HoldemIndicatorSetup.exe Infected: Trojan-Downloader.Win32.Genome.evm 1
Selected area has been scanned.
Vielen Dank! |
|
10.07.2010, 07:23
| #7 |
| /// Helfer-Team | Viren, Trojaner, Malware auf meinem PC. AntiVir findet, löscht und findet wieder. hi weiterhin alle vorhandenen externen Laufwerke inkl. evtl. vorhandener USB-Sticks an den Rechner anschließen, aber dabei die Shift-Taste gedrückt halten, damit die Autorun-Funktion nicht ausgeführt wird. 1. - Malware-Scan mit a-squared Free [/color][/b] - Ohne Hintergrundwächter durchsucht a-squared den Computer auf div. schädlichen Programmen. - Also lade a-squared Free von Emsisoft herunter - Update das Programm und lass dein rechner komplett scannen - Am Ende des Scans alle Funde löschen lassen und über den Button "Bericht speichern" das Log speichern und hier in den Thread posten. 2. Führe dann einen Komplett-Systemcheck mit Nod32 - die Scanergebnis als *.txt Dateien speichern) - (ESET Online Scanner Vor dem Scan Einstellungen im Internet Explorer: - "Extras→ Internetoptionen→ Sicherheit": - alles auf Standardstufe stellen - Active X erlauben ** Wie ist den aktuellen Zustand des Rechners? |
|
| Themen zu Viren, Trojaner, Malware auf meinem PC. AntiVir findet, löscht und findet wieder. |
| 32-bit, antivir, antivir guard, avgntflt.sys, avira, benutzerprofildienst, bonjour, browser, cisco vpn, desktop, device driver, diagnostics, drvstore, error, firefox, flash player, fontcache, hdaudio.sys, hijack, hijackthis, home, home premium, install.exe, kompetent, local\temp, log-datei, malware, malwarebytes' anti-malware, msiexec, msiexec.exe, nicht zu löschen, nvlddmkm.sys, plug-in, programdata, realtek, scan, security, senden, server, software, start menu, starten, system, trojaner, viren, windows |
Linear-Darstellung
