| |
| |||||||
Log-Analyse und Auswertung: Antimalware Doctor: Forumsanleitung zum Entfernen befolgt, System jetzt ok?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
23.08.2010, 22:13
| #1 | |||
| |  Antimalware Doctor: Forumsanleitung zum Entfernen befolgt, System jetzt ok? Ich hatte vor zwei Tagen urplötzlich den Antimalware Doctor auf dem PC, nach einem halben Nervenzusammenbruch hab ich dann dieses Forum entdeckt und die Anleitung zum Entfernen dieses vermaledeiten Virus' befolgt. Seitdem hab ich Avira und Malwarebyte's AM dutzendmal laufen lassen, die letzten Male haben sie nichts mehr gefunden. Vom ersten Eindruck her ist mein Pc wieder ok, ich krieg keine nervigen Meldungen mehr, Geschwindigkeit ist normal, das Windows-Sicherheitssystem-Symbol ist weg und das Programmicon ebenfalls. Aber ist mein System jetzt wirklich sauber? CCleaner hab ich durchgeführt, der HijackLog ist allerdings von davor (hab es danach gelesen, dass es anders rum durchgeführt werden soll). Hier der HijackLog: RSIT Logfile: Code:
ATTFilter Logfile of random's system information tool 1.08 (written by random/random) Run by user at 2010-08-23 21:53:07 Microsoft® Windows Vista™ Home Premium Service Pack 2 System drive C: has 217 GB (71%) free of 305 GB Total RAM: 2010 MB (46% free) Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 21:53:46, on 23.08.2010 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v7.00 (7.00.6002.18005) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\System32\WLTRAY.EXE C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\Program Files\HP\HP Software Update\hpwuschd2.exe C:\Program Files\DellTPad\Apoint.exe C:\Program Files\IDT\WDM\sttray.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Visagesoft\eXPert PDF\vspdfprsrv.exe C:\Program Files\Epson Software\Event Manager\EEventManager.exe C:\Windows\system32\igfxsrvc.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\DellTPad\ApMsgFwd.exe C:\Program Files\DellTPad\HidFind.exe C:\Program Files\DellTPad\Apntex.exe C:\Windows\system32\conime.exe C:\Windows\system32\NOTEPAD.EXE C:\Windows\explorer.exe C:\Users\user\Desktop\RSIT.exe C:\Program Files\trend micro\user.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe O4 - HKLM\..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [vspdfprsrv.exe] C:\Program Files\Visagesoft\eXPert PDF\vspdfprsrv.exe --background O4 - HKLM\..\Run: [EEventManager] C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [EPSON Stylus SX600FW(Netzwerk)] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIEKE.EXE /FU "C:\Windows\TEMP\E_SBFC5.tmp" /EF "HKCU" O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST') O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - h**p://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_22764d41\aestsrv.exe O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: EpsonBidirectionalService - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_22764d41\STacSV.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE O23 - Service: Marvell Yukon Service (yksvc) - Unknown owner - RUNDLL32.EXE (file missing) -- End of file - 6880 bytes ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-06-19 75200] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9421DD08-935F-4701-A9CA-22DF90AC4EA6}] Easy Photo Print - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll [2008-04-02 266240] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - Easy Photo Print - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll [2008-04-02 266240] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-21 1008184] "Broadcom Wireless Manager UI"=C:\Windows\system32\WLTRAY.exe [2008-06-02 3563520] "IgfxTray"=C:\Windows\system32\igfxtray.exe [2008-09-11 150040] "HotKeysCmds"=C:\Windows\system32\hkcmd.exe [2008-09-11 170520] "Persistence"=C:\Windows\system32\igfxpers.exe [2008-09-11 145944] "avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153] "HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2008-12-08 54576] ""= [] "Apoint"=C:\Program Files\DellTPad\Apoint.exe [2010-01-18 274432] "SysTrayApp"=C:\Program Files\IDT\WDM\sttray.exe [2009-11-07 495708] "TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2010-03-02 202256] "QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-11-11 417792] "vspdfprsrv.exe"=C:\Program Files\Visagesoft\eXPert PDF\vspdfprsrv.exe [2006-05-04 998912] "EEventManager"=C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe [2008-05-07 591696] "WinampAgent"=C:\Program Files\Winamp\winampa.exe [2010-07-12 74752] "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-06-20 35760] "Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-06-09 976832] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-04-11 1233920] "EPSON Stylus SX600FW(Netzwerk)"=C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIEKE.EXE [2008-03-06 188928] "WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-21 202240] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares] C:\Program Files\Ares\Ares.exe [2008-12-13 882176] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] C:\Windows\system32\igfxdev.dll [2008-05-21 208896] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "EnableUIADesktopToggle"=0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "BindDirectlyToPropertySetStorage"=0 [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] ======List of files/folders created in the last 1 months====== 2010-08-23 21:53:08 ----D---- C:\Program Files\trend micro 2010-08-23 21:53:07 ----D---- C:\rsit 2010-08-20 22:59:02 ----D---- C:\Users\user\AppData\Roaming\Malwarebytes 2010-08-20 22:58:35 ----A---- C:\Windows\system32\drivers\mbamswissarmy.sys 2010-08-20 22:58:30 ----D---- C:\ProgramData\Malwarebytes 2010-08-20 22:58:29 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2010-08-20 22:58:29 ----A---- C:\Windows\system32\drivers\mbam.sys 2010-08-20 21:09:06 ----SHD---- C:\Users\user\AppData\Roaming\lowsec 2010-08-20 21:08:53 ----D---- C:\Users\user\AppData\Roaming\7D1A8EFA7CDC8B78B4D54FEF40E74FC3 2010-08-12 13:19:32 ----A---- C:\Windows\system32\ntkrnlpa.exe 2010-08-12 13:19:31 ----A---- C:\Windows\system32\ntoskrnl.exe 2010-08-12 13:19:27 ----A---- C:\Windows\system32\iccvid.dll 2010-08-12 13:19:22 ----A---- C:\Windows\system32\mshtml.dll 2010-08-12 13:19:20 ----A---- C:\Windows\system32\wininet.dll 2010-08-12 13:19:20 ----A---- C:\Windows\system32\urlmon.dll 2010-08-12 13:19:20 ----A---- C:\Windows\system32\mshtmled.dll 2010-08-12 13:19:20 ----A---- C:\Windows\system32\iepeers.dll 2010-08-12 13:19:20 ----A---- C:\Windows\system32\ieframe.dll 2010-08-12 13:19:19 ----A---- C:\Windows\system32\ieencode.dll 2010-08-12 13:19:19 ----A---- C:\Windows\system32\ieapfltr.dll 2010-08-12 13:19:13 ----A---- C:\Windows\system32\schannel.dll 2010-08-12 13:18:52 ----A---- C:\Windows\system32\win32k.sys 2010-08-12 13:18:48 ----A---- C:\Windows\system32\rtutils.dll 2010-08-12 13:18:12 ----A---- C:\Windows\system32\msxml3.dll 2010-08-12 13:18:07 ----A---- C:\Windows\system32\drivers\srv2.sys 2010-08-12 13:18:07 ----A---- C:\Windows\system32\drivers\srv.sys 2010-08-12 13:17:58 ----A---- C:\Windows\system32\drivers\tcpip.sys 2010-08-03 19:29:59 ----A---- C:\Windows\system32\shell32.dll ======List of files/folders modified in the last 1 months====== 2010-08-23 21:53:20 ----D---- C:\Windows\Prefetch 2010-08-23 21:53:16 ----D---- C:\Windows\Temp 2010-08-23 21:53:08 ----RD---- C:\Program Files 2010-08-23 18:04:25 ----SHD---- C:\System Volume Information 2010-08-22 22:49:59 ----D---- C:\Windows\system32\drivers 2010-08-22 22:49:59 ----D---- C:\Windows\PCHEALTH 2010-08-21 08:57:56 ----D---- C:\Windows\inf 2010-08-21 00:18:24 ----D---- C:\Windows\Minidump 2010-08-21 00:18:18 ----D---- C:\Windows 2010-08-20 22:58:30 ----HD---- C:\ProgramData 2010-08-20 22:14:46 ----D---- C:\Windows\Logs 2010-08-19 18:53:29 ----D---- C:\Windows\system32\catroot2 2010-08-14 19:27:47 ----D---- C:\Windows\Debug 2010-08-13 15:57:03 ----D---- C:\Windows\Microsoft.NET 2010-08-13 15:56:20 ----RSD---- C:\Windows\assembly 2010-08-13 13:40:50 ----D---- C:\Users\user\AppData\Roaming\Winamp 2010-08-12 22:04:55 ----D---- C:\Windows\winsxs 2010-08-12 21:51:40 ----D---- C:\Windows\System32 2010-08-12 21:51:38 ----D---- C:\Program Files\Movie Maker 2010-08-12 16:24:30 ----SHD---- C:\Windows\Installer 2010-08-12 16:24:29 ----HD---- C:\Config.Msi 2010-08-12 16:24:29 ----D---- C:\ProgramData\Microsoft Help 2010-08-12 16:19:53 ----D---- C:\Windows\system32\catroot 2010-08-12 16:19:44 ----D---- C:\Program Files\Windows Mail 2010-08-11 17:58:57 ----D---- C:\Program Files\Common Files\Adobe 2010-08-11 17:58:29 ----D---- C:\ProgramData\Adobe 2010-08-10 10:19:44 ----SD---- C:\ProgramData\Microsoft 2010-08-10 10:15:52 ----SD---- C:\Users\user\AppData\Roaming\Microsoft 2010-08-03 20:09:31 ----A---- C:\Windows\system32\mrt.exe ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R0 PxHelp20;PxHelp20; C:\Windows\System32\Drivers\PxHelp20.sys [2009-04-28 44944] R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys [2009-02-13 11608] R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2009-03-30 96104] R1 ssmdrv;ssmdrv; C:\Windows\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520] R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2009-12-07 56816] R3 ApfiltrService;Alps Touch Pad Filter Driver for Windows x86; C:\Windows\system32\DRIVERS\Apfiltr.sys [2009-12-26 237104] R3 BCM42RLY;BCM42RLY; C:\Windows\system32\drivers\BCM42RLY.sys [2008-06-02 18424] R3 BCM43XX;Treiber für Dell Wireless WLAN Karte; C:\Windows\system32\DRIVERS\bcmwl6.sys [2008-06-02 1207288] R3 igfx;igfx; C:\Windows\system32\DRIVERS\igdkmd32.sys [2008-05-21 2369536] R3 RTSTOR;Realtek USB 2.0 Card Reader; C:\Windows\system32\drivers\RTSTOR.SYS [2008-07-17 69664] R3 STHDA;IDT High Definition Audio CODEC; C:\Windows\system32\DRIVERS\stwrt.sys [2009-11-07 420864] R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller; C:\Windows\system32\DRIVERS\yk60x86.sys [2008-07-24 304128] S3 Dot4;MS IEEE-1284.4-Treiber; C:\Windows\system32\DRIVERS\Dot4.sys [2008-01-21 131584] S3 Dot4Print;Druckerklassentreiber für IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2008-01-21 16384] S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2008-01-21 36864] S3 drmkaud;Microsoft Kernel-DRM-Audioentschlüsselung; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632] S3 HdAudAddService;Microsoft 1.1 UAA-Funktionstreiber für High Definition Audio-Dienst; C:\Windows\system32\drivers\HdAudio.sys [2009-04-11 236544] S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192] S3 MSPCLOCK;Microsoft Proxy für Streaming Clock; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888] S3 MSPQM;Microsoft Proxy für Streaming Quality Manager; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504] S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016] S3 usbscan;USB-Scannertreiber; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-21 35328] S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-10-01 40448] S3 WSDPrintDevice;WSD-Druckunterstützung durch UMB; C:\Windows\system32\DRIVERS\WSDPrint.sys [2008-01-21 16896] S3 WSDScan;WSD-Scanunterstützung durch UMB; C:\Windows\system32\DRIVERS\WSDScan.sys [2009-04-11 19968] S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328] S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656] S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6; C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [2007-09-11 124832] R2 AESTFilters;Andrea ST Filters Service; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_22764d41\aestsrv.exe [2009-03-03 81920] R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289] R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-07-21 185089] R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-08-28 144672] R2 EpsonBidirectionalService;EpsonBidirectionalService; C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe [2006-12-19 94208] R2 STacSV;Audio Service; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_22764d41\STacSV.exe [2009-11-07 229458] R2 wltrysvc;Dell Wireless WLAN Tray Service; C:\Windows\System32\WLTRYSVC.EXE [2008-06-02 24064] R2 yksvc;Marvell Yukon Service; ykx32coinst,serviceStartProc [] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] S2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-21 21504] S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-21 21504] S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-10-11 654848] S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-21 21504] S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-20 136120] S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712] S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184] S3 WPFFontCache_v0400;@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100; C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504] -----------------EOF----------------- Hier der Log von Malwarebyte's AM beim letzten Fund: Zitat:
Seitdem hab ich AMA zweimal laufen lassen, nichts gefunden, hier der letzte Log: Zitat:
Hier der Log von der erfolgreichen - da nichts gefunden - Avira-Suche heute: Zitat:
Braucht ihr noch irgendeinen Log? Ich kenne mich damit leider noch nicht so gut aus. Vielen Dank schonmal! |
| Themen zu Antimalware Doctor: Forumsanleitung zum Entfernen befolgt, System jetzt ok? |
| antivir, antivir guard, audiodg.exe, avgntflt.sys, avira, bho, browser, desktop, device driver, diagnostics, druck, entfernen, error, expert pdf, fontcache, google, hdaudio.sys, hijackthis, home, home premium, internet, internet explorer, karte, local\temp, logfile, netzwerk, nt.dll, object, plug-in, programdata, proxy, realtek, registry, rogue.antimalwaredoctor, software, svchost.exe, system, usb 2.0, versteckte objekte, verweise, virus, virus gefunden, warnung, winhelp.exe |
Baum-Darstellung