| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: :( :( :( noch ein antimalware doc opfer.ratlos! :(Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
22.09.2010, 16:17
| #16 |
 |  :( :( :( noch ein antimalware doc opfer.ratlos! :( All processes killed ========== OTL ========== No active process named 2123905.exe was found! No active process named 28299.exe was found! No active process named xtkbs.exe was found! Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\mwcenrsaxo.exe not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\xtkbs.exe not found. File C:\Users\*****\AppData\Local\Temp\xtkbs.exe not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\mwcenrsaxo.exe not found. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\TaskMan not found. File C:\Users\*****\AppData\Roaming\ohydy.exe not found. D:\AUTOMODE moved successfully. Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\\helptvol:C:\Windows\system32\cleaosk.dll deleted successfully. File C:\Users\*****\AppData\Roaming\ohydy.exe not found. C:\Users\*****\AppData\Local\Windows Server folder moved successfully. C:\Users\*****\AppData\Roaming\B12491E320CBB39863A02EF2A3860B11 folder moved successfully. File C:\Windows\System32\drivers\xxbsdja.sys not found. File C:\Windows\System32\drivers\cnywu.sys not found. File C:\Users\*****\AppData\Local\aclcoreamd.exe not found. Folder C:\Users\*****\AppData\Roaming\B12491E320CBB39863A02EF2A3860B11\ not found. ADS C:\ProgramData\Temp:82591FF7 deleted successfully. ADS C:\ProgramData\Temp:3A6BC948 deleted successfully. ADS C:\ProgramData\Temp:AC9C6AC1 deleted successfully. ========== COMMANDS ========== C:\Windows\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully [EMPTYTEMP] User: admo ->Temp folder emptied: 97098 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Flash cache emptied: 41661 bytes User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Flash cache emptied: 41661 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Guest ->Temp folder emptied: 907864 bytes ->Temporary Internet Files folder emptied: 95647380 bytes ->Java cache emptied: 24497735 bytes ->FireFox cache emptied: 40747538 bytes ->Flash cache emptied: 5182 bytes User: ***** ->Temp folder emptied: 3369030875 bytes ->Temporary Internet Files folder emptied: 140718235 bytes ->Java cache emptied: 86498362 bytes ->FireFox cache emptied: 91061862 bytes ->Google Chrome cache emptied: 13818871 bytes ->Flash cache emptied: 472851 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 109051314 bytes RecycleBin emptied: 137918 bytes Total Files Cleaned = 3.789,00 mb OTL by OldTimer - Version 3.2.12.0 log created on 09222010_171019 Files\Folders moved on Reboot... Registry entries deleted on Reboot... ...ok erledigt!danke. is alles wieder gut oder gibts noch mehr zu machen?  |
|
22.09.2010, 20:19
| #17 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | :( :( :( noch ein antimalware doc opfer.ratlos! :( Dann bitte jetzt CF ausführen:
__________________ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
__________________ |
|
23.09.2010, 12:56
| #18 |
| | :( :( :( noch ein antimalware doc opfer.ratlos! :( phu also hab alles gemacht was ich sollte,...nur gestern als alles dann fertig war u er im prozess ca 3 mal neu gestartet hat ging weder mein inet noch sonstige programme (spiele etc). es stand dann immer in einem kleinen fenster dass der pfad geloescht wurde ( od so aehnlich, ich habs leider nicht aufgeschrieben) hab dann abgeschalten u heute geht wieder alles.
__________________hier ist die log datei: Combofix Logfile: Code:
ATTFilter ComboFix 10-09-22.02 - ***** 23.09.2010 0:12.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.2046.1338 [GMT 2:00]
Running from: c:\users\*****\Desktop\cofi.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\Mozilla Firefox\components\npclntax.xpt
c:\windows\system32\KBL.LOG
c:\windows\system32\muzapp.exe
Infected copy of c:\windows\system32\DRIVERS\RDPCDD.sys was found and disinfected
Restored copy from - Kitty ate it :p
.
((((((((((((((((((((((((( Files Created from 2010-08-22 to 2010-09-22 )))))))))))))))))))))))))))))))
.
2010-09-22 22:34 . 2010-09-22 22:37 -------- d-----w- c:\users\*****\AppData\Local\temp
2010-09-22 19:46 . 2010-09-22 19:46 -------- d-----w- c:\program files\CCleaner
2010-09-22 15:10 . 2010-09-22 15:10 -------- d-----w- C:\_OTL
2010-09-22 09:08 . 2010-09-22 09:08 -------- d-----w- c:\users\*****\AppData\Roaming\funkitron
2010-09-17 11:44 . 2010-09-17 11:44 -------- d-----w- c:\users\*****\AppData\Roaming\PC Suite
2010-09-17 11:44 . 2010-09-17 11:44 -------- d-----w- c:\programdata\PC Suite
2010-09-17 11:42 . 2009-09-19 05:30 98432 ----a-w- c:\windows\system32\drivers\ss_bbus.sys
2010-09-17 11:42 . 2009-09-19 05:30 14848 ----a-w- c:\windows\system32\drivers\ss_bmdfl.sys
2010-09-17 11:42 . 2009-09-19 05:30 12416 ----a-w- c:\windows\system32\drivers\ss_bcmnt.sys
2010-09-17 11:42 . 2009-09-19 05:30 12416 ----a-w- c:\windows\system32\drivers\ss_bcm.sys
2010-09-17 11:42 . 2009-09-19 05:30 123648 ----a-w- c:\windows\system32\drivers\ss_bmdm.sys
2010-09-17 11:38 . 2010-09-17 11:38 -------- d-----w- c:\program files\Common Files\Samsung
2010-09-08 21:33 . 2010-09-08 21:33 -------- d-----w- c:\users\admo\AppData\Roaming\Hewlett-Packard
2010-09-08 21:32 . 2010-09-08 21:32 -------- d-----w- c:\users\admo\AppData\Local\Hewlett-Packard
2010-09-08 21:32 . 2010-09-08 21:32 -------- d-----w- c:\users\admo\AppData\Local\QuickPlay
2010-09-08 21:32 . 2010-09-08 21:32 106408 ----a-w- c:\users\admo\AppData\Local\GDIPFONTCACHEV1.DAT
2010-09-08 21:31 . 2010-09-08 21:31 -------- d-----w- c:\users\admo\AppData\Roaming\Malwarebytes
2010-09-07 17:44 . 2010-09-07 17:44 -------- d-----w- c:\users\*****\AppData\Roaming\Malwarebytes
2010-09-07 17:44 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-07 17:44 . 2010-09-08 21:38 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-07 17:44 . 2010-09-07 17:44 -------- d-----w- c:\programdata\Malwarebytes
2010-09-07 17:44 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-06 20:21 . 2010-09-06 20:21 -------- d-----w- c:\users\*****\AppData\Roaming\PeerNetworking
2010-09-06 15:06 . 2010-09-06 15:06 -------- d-----w- c:\program files\Conduit
2010-09-06 15:06 . 2010-09-06 15:06 -------- d-----w- c:\program files\DVDVideoSoftTB
2010-09-06 15:06 . 2010-09-06 15:06 -------- d-----w- c:\users\*****\AppData\Roaming\DVDVideoSoftIEHelpers
2010-09-03 18:20 . 2010-05-27 20:08 81920 ----a-w- c:\windows\system32\iccvid.dll
2010-09-03 18:20 . 2010-06-11 16:16 274944 ----a-w- c:\windows\system32\schannel.dll
2010-09-03 18:20 . 2010-06-21 13:37 2037760 ----a-w- c:\windows\system32\win32k.sys
2010-09-03 18:20 . 2010-06-18 17:31 36864 ----a-w- c:\windows\system32\rtutils.dll
2010-09-03 18:19 . 2010-06-11 16:15 1248768 ----a-w- c:\windows\system32\msxml3.dll
2010-09-03 18:19 . 2010-06-08 17:35 3548040 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-09-03 18:19 . 2010-06-08 17:35 3600768 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-09-03 18:19 . 2010-06-18 15:04 302080 ----a-w- c:\windows\system32\drivers\srv.sys
2010-09-03 18:19 . 2010-06-18 15:04 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2010-09-03 18:19 . 2010-06-16 16:04 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-22 17:51 . 2008-12-12 13:06 -------- d-----w- c:\programdata\Google Updater
2010-09-22 09:07 . 2008-03-30 12:38 -------- d-----w- c:\programdata\WildTangent
2010-09-17 11:43 . 2007-10-24 15:26 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-09-17 11:42 . 2010-09-17 11:38 -------- d-----w- c:\program files\Samsung
2010-09-17 11:41 . 2010-09-17 11:41 -------- d-----w- c:\program files\DIFX
2010-09-17 11:41 . 2010-09-17 11:39 -------- d-----w- c:\program files\PC Connectivity Solution
2010-09-17 11:41 . 2010-09-17 11:38 -------- d-----w- c:\programdata\Samsung
2010-09-17 11:38 . 2010-09-17 11:38 -------- d-----w- c:\users\*****\AppData\Roaming\Samsung
2010-09-17 11:38 . 2010-09-17 11:38 -------- d-----w- c:\program files\MarkAny
2010-09-08 16:28 . 2008-11-05 19:17 -------- d-----w- c:\users\*****\AppData\Roaming\uTorrent
2010-09-05 19:34 . 2007-10-24 16:38 -------- d-----w- c:\program files\Microsoft Works
2010-09-05 19:22 . 2007-10-24 17:01 -------- d-----w- c:\programdata\Microsoft Help
2010-09-05 19:20 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-09-03 18:20 . 2008-11-28 22:12 -------- d-----w- c:\users\*****\AppData\Roaming\Skype
2010-09-03 17:54 . 2008-11-28 22:16 -------- d-----w- c:\users\*****\AppData\Roaming\skypePM
2010-06-26 06:05 . 2010-09-03 18:40 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-26 06:02 . 2010-09-03 18:40 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-06-26 06:02 . 2010-09-03 18:40 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-06-26 04:25 . 2010-09-03 18:40 133632 ----a-w- c:\windows\system32\ieUnatt.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\tbDVDV.dll" [2010-04-27 2393184]
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
2010-04-27 08:08 2393184 ----a-w- c:\program files\DVDVideoSoftTB\tbDVDV.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\tbDVDV.dll" [2010-04-27 2393184]
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{872B5B88-9DB5-4310-BDD0-AC189557E5F5}"= "c:\program files\DVDVideoSoftTB\tbDVDV.dll" [2010-04-27 2393184]
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KiesTrayAgent"="c:\program files\Samsung\Kies\" [X]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-12 39408]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan.lnk - c:\program files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-28 199184]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"RequireSignedAppInit_DLLs"=1 (0x1)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]
@="FSFilter System Recovery"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2009-12-22 135664]
R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys [2009-09-19 98432]
R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys [2009-09-19 14848]
R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys [2009-09-19 123648]
R3 ss_bserd;SAMSUNG USB Mobile Logging Driver;c:\windows\system32\DRIVERS\ss_bserd.sys [2009-09-19 100224]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S1 uigxrdr;uigxrdr;c:\windows\system32\DRIVERS\uigxrdr.sys [2008-07-29 272384]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
S2 dgdersvc;Device Error Recovery Service;c:\windows\system32\dgdersvc.exe [2009-12-22 95568]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2009-12-22 217088]
S2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [2008-06-10 222456]
S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [2009-12-22 18136]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2009-12-22 36640]
--- Other Services/Drivers In Memory ---
*Deregistered* - xxbsdja
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-08-23 17:34 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder
2010-09-22 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-28 08:10]
2010-09-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-22 20:12]
2010-09-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-22 20:12]
2010-06-15 c:\windows\Tasks\HPCeeScheduleFor*****.job
- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2007-10-24 18:58]
2010-09-22 c:\windows\Tasks\User_Feed_Synchronization-{8F90BF23-9CF4-4FB0-976F-A39A46C2B0C7}.job
- c:\windows\system32\msfeedssync.exe [2010-09-03 04:24]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.at/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_gb&c=81&bd=Pavilion&pf=laptop
uInternet Settings,ProxyOverride = *.local
IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-GB\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
DPF: {59136DB4-6CA3-4B40-8F2F-BBF84B6F1E91} - hxxps://stream.web.de/mail/activex/mail_upload_11213.cab
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game05.zylom.com/activex/zylomgamesplayer.cab
FF - ProfilePath - c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\mbf4as2b.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT2269050&SearchSource=13
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&q=
FF - component: c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\mbf4as2b.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\FFExternalAlert.dll
FF - component: c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\mbf4as2b.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\RadioWMPCore.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHANS REMOVED - - - -
SafeBoot-dmboot.sys
SafeBoot-dmio.sys
SafeBoot-dmload.sys
SafeBoot-dmadmin
SafeBoot-dmserver
SafeBoot-SRService
AddRemove-01_Simmental - c:\program files\SAMSUNG\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\SAMSUNG\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\SAMSUNG\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-07_Schorl - c:\program files\SAMSUNG\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-15_Symbian_Samsung_PC_DLC_Driver - c:\program files\SAMSUNG\USB Drivers\15_Symbian_Samsung_PC_DLC_Driver\Uninstall.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-09-23 00:37
Windows 6.0.6002 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\xxbsdja]
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\LEXBCES.EXE
c:\windows\System32\LEXPPS.EXE
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\crypserv.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\system32\WUDFHost.exe
c:\program files\HP\QuickPlay\Kernel\TV\QPSched.exe
c:\windows\system32\conime.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Completion time: 2010-09-23 00:48:27 - machine was rebooted
ComboFix-quarantined-files.txt 2010-09-22 22:48
Pre-Run: 10.630.643.712 bytes free
Post-Run: 10.577.039.360 bytes free
- - End Of File - - 0DBE6913B8DDFFD1BAA01C6E29212433
|
|
23.09.2010, 15:09
| #19 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | :( :( :( noch ein antimalware doc opfer.ratlos! :( Combofix - Scripten 1. Starte das Notepad (Start / Ausführen / notepad[Enter]) 2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein. Code:
ATTFilter Registry::
[-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\xxbsdja]
File::
c:\windows\system32\drivers\dgderdrv.sys
Driver:
dgderdrv
4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall. (Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !) 5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.  6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien: Combofix.txt Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
23.09.2010, 16:22
| #20 |
| | :( :( :( noch ein antimalware doc opfer.ratlos! :( ok erledigt. diesmal ist wieder dieser error gekomme als ich den inet explorer wieder oeffnen wollte "illegal operation attempted on a registry key that has been marked for deletion" ...erst wenn ich den laptop selbst noch mal ab u aufdrehe geht alles wieder...ist das normal? Combofix Logfile: Code:
ATTFilter ComboFix 10-09-22.02 - ***** 23.09.2010 16:34:20.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.2046.1288 [GMT 2:00]
Running from: c:\users\*****\Desktop\cofi.exe
Command switches used :: c:\users\*****\Desktop\CFScript.txt
* Created a new restore point
FILE ::
"c:\windows\system32\drivers\dgderdrv.sys"
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\drivers\dgderdrv.sys
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_dgderdrv
-------\Service_dgderdrv
((((((((((((((((((((((((( Files Created from 2010-08-23 to 2010-09-23 )))))))))))))))))))))))))))))))
.
2010-09-23 14:43 . 2010-09-23 14:53 -------- d-----w- c:\users\*****\AppData\Local\temp
2010-09-23 14:43 . 2010-09-23 14:43 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-09-23 14:43 . 2010-09-23 14:43 -------- d-----w- c:\users\Guest\AppData\Local\temp
2010-09-23 14:43 . 2010-09-23 14:43 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-09-23 14:43 . 2010-09-23 14:43 -------- d-----w- c:\users\admo\AppData\Local\temp
2010-09-23 14:32 . 2010-09-23 14:32 -------- d-----w- C:\32788R22FWJFW
2010-09-23 11:42 . 2010-09-23 14:53 -------- d-----w- c:\windows\system32\MpEngineStore
2010-09-22 22:53 . 2010-04-05 17:02 317952 ----a-w- c:\windows\system32\MP4SDECD.DLL
2010-09-22 22:51 . 2010-05-27 20:08 739328 ----a-w- c:\windows\system32\inetcomm.dll
2010-09-22 19:46 . 2010-09-22 19:46 -------- d-----w- c:\program files\CCleaner
2010-09-22 15:10 . 2010-09-22 15:10 -------- d-----w- C:\_OTL
2010-09-22 09:08 . 2010-09-22 09:08 -------- d-----w- c:\users\*****\AppData\Roaming\funkitron
2010-09-17 11:44 . 2010-09-17 11:44 -------- d-----w- c:\users\*****\AppData\Roaming\PC Suite
2010-09-17 11:44 . 2010-09-17 11:44 -------- d-----w- c:\programdata\PC Suite
2010-09-17 11:42 . 2009-09-19 05:30 98432 ----a-w- c:\windows\system32\drivers\ss_bbus.sys
2010-09-17 11:42 . 2009-09-19 05:30 14848 ----a-w- c:\windows\system32\drivers\ss_bmdfl.sys
2010-09-17 11:42 . 2009-09-19 05:30 12416 ----a-w- c:\windows\system32\drivers\ss_bcmnt.sys
2010-09-17 11:42 . 2009-09-19 05:30 12416 ----a-w- c:\windows\system32\drivers\ss_bcm.sys
2010-09-17 11:42 . 2009-09-19 05:30 123648 ----a-w- c:\windows\system32\drivers\ss_bmdm.sys
2010-09-17 11:38 . 2010-09-17 11:38 -------- d-----w- c:\program files\Common Files\Samsung
2010-09-08 21:33 . 2010-09-08 21:33 -------- d-----w- c:\users\admo\AppData\Roaming\Hewlett-Packard
2010-09-08 21:32 . 2010-09-08 21:32 -------- d-----w- c:\users\admo\AppData\Local\Hewlett-Packard
2010-09-08 21:32 . 2010-09-08 21:32 -------- d-----w- c:\users\admo\AppData\Local\QuickPlay
2010-09-08 21:32 . 2010-09-08 21:32 106408 ----a-w- c:\users\admo\AppData\Local\GDIPFONTCACHEV1.DAT
2010-09-08 21:31 . 2010-09-08 21:31 -------- d-----w- c:\users\admo\AppData\Roaming\Malwarebytes
2010-09-07 17:44 . 2010-09-07 17:44 -------- d-----w- c:\users\*****\AppData\Roaming\Malwarebytes
2010-09-07 17:44 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-07 17:44 . 2010-09-08 21:38 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-07 17:44 . 2010-09-07 17:44 -------- d-----w- c:\programdata\Malwarebytes
2010-09-07 17:44 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-06 20:21 . 2010-09-06 20:21 -------- d-----w- c:\users\*****\AppData\Roaming\PeerNetworking
2010-09-06 15:06 . 2010-09-06 15:06 -------- d-----w- c:\program files\Conduit
2010-09-06 15:06 . 2010-09-06 15:06 -------- d-----w- c:\program files\DVDVideoSoftTB
2010-09-06 15:06 . 2010-09-06 15:06 -------- d-----w- c:\users\*****\AppData\Roaming\DVDVideoSoftIEHelpers
2010-09-03 18:20 . 2010-05-27 20:08 81920 ----a-w- c:\windows\system32\iccvid.dll
2010-09-03 18:20 . 2010-06-11 16:16 274944 ----a-w- c:\windows\system32\schannel.dll
2010-09-03 18:20 . 2010-06-21 13:37 2037760 ----a-w- c:\windows\system32\win32k.sys
2010-09-03 18:20 . 2010-06-18 17:31 36864 ----a-w- c:\windows\system32\rtutils.dll
2010-09-03 18:19 . 2010-06-11 16:15 1248768 ----a-w- c:\windows\system32\msxml3.dll
2010-09-03 18:19 . 2010-06-08 17:35 3548040 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-09-03 18:19 . 2010-06-08 17:35 3600768 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-09-03 18:19 . 2010-06-18 15:04 302080 ----a-w- c:\windows\system32\drivers\srv.sys
2010-09-03 18:19 . 2010-06-18 15:04 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2010-09-03 18:19 . 2010-06-16 16:04 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-23 14:48 . 2009-03-04 16:30 -------- d-----w- c:\program files\Microsoft Silverlight
2010-09-23 11:43 . 2007-10-24 17:01 -------- d-----w- c:\programdata\Microsoft Help
2010-09-23 11:38 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-09-23 11:30 . 2008-03-30 12:38 -------- d-----w- c:\programdata\WildTangent
2010-09-23 11:30 . 2008-05-02 21:47 8268 ----a-w- c:\users\*****\AppData\Local\d3d9caps.dat
2010-09-22 22:52 . 2008-05-02 19:23 106408 ----a-w- c:\users\*****\AppData\Local\GDIPFONTCACHEV1.DAT
2010-09-22 17:51 . 2008-12-12 13:06 -------- d-----w- c:\programdata\Google Updater
2010-09-17 11:43 . 2007-10-24 15:26 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-09-17 11:42 . 2010-09-17 11:38 -------- d-----w- c:\program files\Samsung
2010-09-17 11:41 . 2010-09-17 11:41 -------- d-----w- c:\program files\DIFX
2010-09-17 11:41 . 2010-09-17 11:39 -------- d-----w- c:\program files\PC Connectivity Solution
2010-09-17 11:41 . 2010-09-17 11:38 -------- d-----w- c:\programdata\Samsung
2010-09-17 11:38 . 2010-09-17 11:38 -------- d-----w- c:\users\*****\AppData\Roaming\Samsung
2010-09-17 11:38 . 2010-09-17 11:38 -------- d-----w- c:\program files\MarkAny
2010-09-14 16:22 . 2009-02-23 22:30 1 ----a-w- c:\users\*****\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-09-13 23:58 . 2010-09-13 23:58 452104 ----a-w- c:\users\*****\AppData\Roaming\Real\Update\setup3.12\setup.exe
2010-09-08 16:28 . 2008-11-05 19:17 -------- d-----w- c:\users\*****\AppData\Roaming\uTorrent
2010-09-06 15:06 . 2010-09-06 15:06 52224 ----a-w- c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\mbf4as2b.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\FFExternalAlert.dll
2010-09-06 15:06 . 2010-09-06 15:06 101376 ----a-w- c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\mbf4as2b.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\RadioWMPCore.dll
2010-09-05 19:34 . 2007-10-24 16:38 -------- d-----w- c:\program files\Microsoft Works
2010-09-03 18:20 . 2008-11-28 22:12 -------- d-----w- c:\users\*****\AppData\Roaming\Skype
2010-09-03 17:54 . 2008-11-28 22:16 -------- d-----w- c:\users\*****\AppData\Roaming\skypePM
2010-07-03 16:20 . 2010-05-20 18:19 439816 ----a-w- c:\users\*****\AppData\Roaming\Real\Update\setup3.10\setup.exe
2010-06-26 06:05 . 2010-09-03 18:40 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-26 06:02 . 2010-09-03 18:40 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-06-26 06:02 . 2010-09-03 18:40 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-06-26 04:25 . 2010-09-03 18:40 133632 ----a-w- c:\windows\system32\ieUnatt.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\tbDVDV.dll" [2010-04-27 2393184]
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
2010-04-27 08:08 2393184 ----a-w- c:\program files\DVDVideoSoftTB\tbDVDV.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\tbDVDV.dll" [2010-04-27 2393184]
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{872B5B88-9DB5-4310-BDD0-AC189557E5F5}"= "c:\program files\DVDVideoSoftTB\tbDVDV.dll" [2010-04-27 2393184]
[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KiesTrayAgent"="c:\program files\Samsung\Kies\" [X]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-12 39408]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan.lnk - c:\program files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-28 199184]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"RequireSignedAppInit_DLLs"=1 (0x1)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]
@="FSFilter System Recovery"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 dgdersvc;Device Error Recovery Service;c:\windows\system32\dgdersvc.exe [2009-12-22 95568]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2009-12-22 135664]
R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys [2009-09-19 98432]
R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys [2009-09-19 14848]
R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys [2009-09-19 123648]
R3 ss_bserd;SAMSUNG USB Mobile Logging Driver;c:\windows\system32\DRIVERS\ss_bserd.sys [2009-09-19 100224]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2009-12-22 217088]
S2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [2008-06-10 222456]
--- Other Services/Drivers In Memory ---
*Deregistered* - xxbsdja
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-08-23 17:34 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder
2010-09-23 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-28 08:10]
2010-09-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-22 20:12]
2010-09-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-22 20:12]
2010-06-15 c:\windows\Tasks\HPCeeScheduleFor*****.job
- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2007-10-24 18:58]
2010-09-23 c:\windows\Tasks\User_Feed_Synchronization-{8F90BF23-9CF4-4FB0-976F-A39A46C2B0C7}.job
- c:\windows\system32\msfeedssync.exe [2010-09-03 04:24]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.at/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_gb&c=81&bd=Pavilion&pf=laptop
uInternet Settings,ProxyOverride = *.local
IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-GB\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
DPF: {59136DB4-6CA3-4B40-8F2F-BBF84B6F1E91} - hxxps://stream.web.de/mail/activex/mail_upload_11213.cab
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game05.zylom.com/activex/zylomgamesplayer.cab
FF - ProfilePath - c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\mbf4as2b.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT2269050&SearchSource=13
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&q=
FF - component: c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\mbf4as2b.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\FFExternalAlert.dll
FF - component: c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\mbf4as2b.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\RadioWMPCore.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-09-23 16:51
Windows 6.0.6002 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\xxbsdja]
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Other Running Processes ------------------------
.
c:\windows\servicing\TrustedInstaller.exe
c:\windows\System32\LEXBCES.EXE
c:\windows\System32\LEXPPS.EXE
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\crypserv.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\system32\WUDFHost.exe
c:\program files\HP\QuickPlay\Kernel\TV\QPSched.exe
c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
c:\windows\system32\conime.exe
c:\windows\System32\mrt.exe
c:\windows\system32\wbem\unsecapp.exe
.
**************************************************************************
.
Completion time: 2010-09-23 17:01:42 - machine was rebooted
ComboFix-quarantined-files.txt 2010-09-23 15:01
ComboFix2.txt 2010-09-22 22:48
Pre-Run: 9.718.607.872 bytes free
Post-Run: 9.610.960.896 bytes free
Current=1 Default=1 Failed=0 LastKnownGood=1 Sets=1,2,3,4
- - End Of File - - DC51F7900051C9753376BF48ABC77622
DANKEEEEE ARNE!!! |
|
23.09.2010, 21:06
| #21 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | :( :( :( noch ein antimalware doc opfer.ratlos! :( Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus Anschließend den bootkit_remover herunterladen. Entpacke das Tool in einen eigenen Ordner auf dem Desktop und führe in diesem Ordner die Datei remove.exe aus. Wenn Du Windows Vista oder Windows 7 verwendest, musst Du die remover.exe über ein Rechtsklick => als Administrator ausführen Ein schwarzes Fenster wird sich öffnen und automatisch nach bösartigen Veränderungen im MBR suchen. Poste dann bitte, ob es Veränderungen gibt und wenn ja in welchem device. Am besten alles posten was die remover.exe ausgibt.
__________________ --> :( :( :( noch ein antimalware doc opfer.ratlos! :( |
|
| Themen zu :( :( :( noch ein antimalware doc opfer.ratlos! :( |
| ?????, adware.180solutions, adware.hotbar, adware.seekmo, adware.softomate, adware.zango, anti-malware, antimalware, appdata, backdoor.bot, dateien, desktop.ini, doppelt, driver, firefox, foren, forum, funktioniert, install, langsam, mbam, microsoft, mozilla, neu, nicht mehr, programdata, recycler, roaming, rogue.antimalwaredoctor, setup, software, trojan.agent, version, virus, worm.autorun.b |
Linear-Darstellung
