| |
| |||||||
Log-Analyse und Auswertung: TR/Crypt.XPACK.Gen3 backdoor/trojanWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
26.09.2010, 11:32
| #1 |
 |  TR/Crypt.XPACK.Gen3 backdoor/trojan Hi, ein Freund von mir bekommt seit gestern ständig folgende Nachricht von Avira Antivir (Definitionen vom 25.9): TR/Crypt.XPACK.Gen3 gefunden in mshtuota.dll (befindet sich in C:\Windows\). Diese Nachricht kommt alle paar Minuten, manchmal auch gleich 20mal hintereinander. Ich habe es zwei mal geschafft per Teamviewer remote Zugriff zu erhalten und habe ansonsten versucht es per Telefon mit ihm zu lösen. Jedoch ohne Erfolg. Ich habe auch noch eine Malwarebytes logfile aus dem Abgesicherten Modus, wenn die weiterhilft. Spybot S&D kann auch nicht ausgeführt werden. Wenn man es ausführen will, passiert nichts - und die Datei ist auch nicht im Taskmanager zu sehen. Avira Antivir hat er einmal eine Systemprüfung machen lassen, und die .dll war auch in Quarantäne - sie wird aber anscheinend immer wieder neu erstellt und im normalen Modus lässt sie sich nicht löschen. Hier ist die HijackThis Logfile (normaler modus). Ich habe sie auch nochmal angehängt. HiJackthis Logfile: HiJackthis Logfile: Code:
ATTFilter Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:30:25, on 26.09.2010 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Programme\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe C:\Programme\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\system32\Rundll32.exe C:\Programme\Creative\SBAudigy\Surround Mixer\CTSysVol.exe C:\ibmtools\aptezbtn\aptezbp.exe C:\Programme\ScanSoft\OmniPageSE\opware32.exe C:\WINDOWS\RTHDCPL.EXE C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe C:\Programme\Logitech\QuickCam10\QuickCam10.exe C:\Programme\Java\jre6\bin\jusched.exe C:\Programme\a-squared Free\a2service.exe C:\Programme\iTunes\iTunesHelper.exe C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avgnt.exe C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\Bonjour\mDNSResponder.exe C:\Programme\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\Programme\Java\jre6\bin\jqs.exe C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe C:\Programme\RocketDock\RocketDock.exe C:\WINDOWS\system32\svchost.exe C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\system32\UTSCSI.EXE C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\ibmtools\aptezbtn\rakusb.exe C:\Programme\iPod\bin\iPodService.exe C:\WINDOWS\system32\wscntfy.exe C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe C:\Programme\Gemeinsame Dateien\Logishrd\LQCVFX\COCIManager.exe C:\Programme\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\System32\svchost.exe C:\DOKUME~1\Family\LOKALE~1\Temp\TeamViewer\Version5\TeamViewer.exe c:\dokume~1\family\lokale~1\temp\teamviewer\version5\TeamViewer_Desktop.exe C:\Programme\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.faz.net/ O2 - BHO: Adobe PDF Reader Link Helper - {X} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {X} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {X} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {X} - C:\Programme\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {X} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Easy-WebPrint - {X} - C:\Programme\Canon Drucker\Easy-WebPrint\Toolband.dll O3 - Toolbar: Adobe PDF - {X} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [ATICCC] "C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper O4 - HKLM\..\Run: [CTSysVol] C:\Programme\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [AEZBProc] c:\ibmtools\aptezbtn\aptezbp.exe O4 - HKLM\..\Run: [Omnipage] C:\Programme\ScanSoft\OmniPageSE\opware32.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [REGSHAVE] C:\Programme\REGSHAVE\REGSHAVE.EXE /AUTORUN O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe" O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Programme\Logitech\QuickCam10\QuickCam10.exe" /hide O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [MbWzdFPAP-EXL580] C:\WINDOWS\system32\FPAP-EXL580\PdtGuide.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime Alternative\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [avgnt] "C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [NokiaMServer] C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer /watchfiles startup O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebyte' Anti-Malware\mbamgui.exe /install /silent O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [{X}] "C:\Dokumente und Einstellungen\Family\Anwendungsdaten\Haboac\ynywi.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: RocketDock.exe.lnk = C:\Programme\RocketDock\RocketDock.exe O4 - Global Startup: Catalyst System Tray.lnk = C:\Programme\ATI Technologies\ATI.ACE\CLI.exe O8 - Extra context menu item: Append to existing PDF - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Easy-WebPrint - Drucken - res://C:\Programme\Canon Drucker\Easy-WebPrint\Resource.dll/RC_Print.html O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - res://C:\Programme\Canon Drucker\Easy-WebPrint\Resource.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint - Vorschau - res://C:\Programme\Canon Drucker\Easy-WebPrint\Resource.dll/RC_Preview.html O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - res://C:\Programme\Canon Drucker\Easy-WebPrint\Resource.dll/RC_AddToList.html O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Recherchieren - {X} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {X} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {X} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {X} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {X} - C:\Programme\Messenger\msmsgs.exe O12 - Plugin for .UVR: C:\Programme\Internet Explorer\Plugins\NPUPano.dll O16 - DPF: {X} (CInstallLPCtrl Object) - hxxp://u3.sandisk.com/download/apps/LPInstaller.CAB O17 - HKLM\System\CCS\Services\Tcpip\..\{X}: NameServer = 93.188.162.81,93.188.161.221 O17 - HKLM\System\CCS\Services\Tcpip\..\{X}: NameServer = 93.188.162.81,93.188.161.221 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 93.188.162.81,93.188.161.221 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 93.188.162.81,93.188.161.221 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 93.188.162.81,93.188.161.221 O18 - Protocol: skype4com - {X} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Programme\a-squared Free\a2service.exe O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Programme\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe O23 - Service: LVCOMSer - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\SrvLnch\SrvLnch.exe O23 - Service: ServiceLayer - Nokia - C:\Programme\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: CLCV0 (UTSCSI) - Unknown owner - C:\WINDOWS\system32\UTSCSI.EXE -- End of file - 11587 bytes --- --- --- HijackThis logfile (safe mode): HiJackthis Logfile: Code:
ATTFilter Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:53:31, on 26.09.2010 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Safe mode Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Programme\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Programme\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing O2 - BHO: Adobe PDF Reader Link Helper - {X} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {X} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {X} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {X} - C:\Programme\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {X} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Easy-WebPrint - {X} - C:\Programme\Canon Drucker\Easy-WebPrint\Toolband.dll O3 - Toolbar: Adobe PDF - {X} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [ATICCC] "C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper O4 - HKLM\..\Run: [CTSysVol] C:\Programme\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [AEZBProc] c:\ibmtools\aptezbtn\aptezbp.exe O4 - HKLM\..\Run: [Omnipage] C:\Programme\ScanSoft\OmniPageSE\opware32.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [REGSHAVE] C:\Programme\REGSHAVE\REGSHAVE.EXE /AUTORUN O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe" O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Programme\Logitech\QuickCam10\QuickCam10.exe" /hide O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [MbWzdFPAP-EXL580] C:\WINDOWS\system32\FPAP-EXL580\PdtGuide.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime Alternative\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [avgnt] "C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [NokiaMServer] C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer /watchfiles startup O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Catalyst System Tray.lnk = C:\Programme\ATI Technologies\ATI.ACE\CLI.exe O9 - Extra button: Recherchieren - {X} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {X} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {X} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {X} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {X} - C:\Programme\Messenger\msmsgs.exe O12 - Plugin for .UVR: C:\Programme\Internet Explorer\Plugins\NPUPano.dll O16 - DPF: {X} (CInstallLPCtrl Object) - hxxp://u3.sandisk.com/download/apps/LPInstaller.CAB O17 - HKLM\System\CCS\Services\Tcpip\..\{X}: NameServer = 93.188.162.81,93.188.161.221 O17 - HKLM\System\CCS\Services\Tcpip\..\{X}: NameServer = 93.188.162.81,93.188.161.221 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 93.188.162.81,93.188.161.221 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 93.188.162.81,93.188.161.221 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 93.188.162.81,93.188.161.221 O18 - Protocol: skype4com - {X} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Programme\a-squared Free\a2service.exe O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Programme\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe O23 - Service: LVCOMSer - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\SrvLnch\SrvLnch.exe O23 - Service: ServiceLayer - Nokia - C:\Programme\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: CLCV0 (UTSCSI) - Unknown owner - C:\WINDOWS\system32\UTSCSI.EXE -- End of file - 7406 bytes Geändert von aware (26.09.2010 um 12:12 Uhr) |
|
26.09.2010, 18:35
| #2 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  TR/Crypt.XPACK.Gen3 backdoor/trojanZitat:
 Mit Updates habt Ihr es wohl nicht so? Warum fehlen zB das SP3 und der IE8?  Poste bitte auch das Log von malwarebytes
__________________ |
|
26.09.2010, 19:37
| #3 |
| | TR/Crypt.XPACK.Gen3 backdoor/trojan Hi,
__________________IE 6 wird nicht verwendet. Er benutzt Opera 10.x. SP 2 - whoa, okay, das wird er wenn die Sache hier überstanden ist mal updaten  . Danke für den Hinweis. Ich konnte jetzt via Remote Zugriff Malwarebytes ausführen (musste dafür die mbam Ausführdatei umbenennen). Code:
ATTFilter Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Datenbank Version: 4698
Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180
26.09.2010 20:12:08
mbam-log-2010-09-26 (20-12-08).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|)
Durchsuchte Objekte: 265279
Laufzeit: 56 Minute(n), 29 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{cedf0066-c38d-6af7-7e21-dc8b84e4561a} (Trojan.ZbotR.Gen) -> Quarantined and deleted successfully.
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
C:\System Volume Information\_restore{E54C5E8B-4A92-4942-9788-26A2E6AA05E0}\RP943\A0240294.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
Geändert von aware (26.09.2010 um 19:51 Uhr) |
|
26.09.2010, 20:00
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | TR/Crypt.XPACK.Gen3 backdoor/trojan Der IE ist ein integraler Systembestandteil von Windows, auch bei Nichtbenutzung muss der IE immer aktuell gehalten werden!! Systemscan mit OTL Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
__________________ Logfiles bitte immer in CODE-Tags posten |
|
26.09.2010, 20:09
| #5 |
| | TR/Crypt.XPACK.Gen3 backdoor/trojan OTL.txt OTL Logfile: Code:
ATTFilter OTL logfile created on: 26.09.2010 20:59:13 - Run 1 OTL by OldTimer - Version 3.2.14.1 Folder = C:\Dokumente und Einstellungen\Family\Desktop Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1.023,00 Mb Total Physical Memory | 263,00 Mb Available Physical Memory | 26,00% Memory free 924,00 Mb Paging File | 221,00 Mb Available in Paging File | 24,00% Paging File free Paging file location(s): [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 18,00 Gb Total Space | 2,01 Gb Free Space | 11,14% Space Free | Partition Type: NTFS Drive D: | 273,24 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Drive E: | 131,05 Gb Total Space | 93,95 Gb Free Space | 71,69% Space Free | Partition Type: NTFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: PC-ONE Current User Name: Family Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Dokumente und Einstellungen\Family\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Dokumente und Einstellungen\Family\Lokale Einstellungen\Temp\TeamViewer\Version5\TeamViewer.exe (TeamViewer GmbH) PRC - c:\Dokumente und Einstellungen\Family\Lokale Einstellungen\Temp\TeamViewer\Version5\TeamViewer_Desktop.exe (TeamViewer GmbH) PRC - C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer.exe (Nokia) PRC - C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.) PRC - C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.) PRC - C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Programme\a-squared Free\a2service.exe (Emsi Software GmbH) PRC - C:\Programme\Lavasoft\Ad-Aware\aawservice.exe (Lavasoft) PRC - C:\WINDOWS\system32\UTSCSI.EXE () PRC - C:\Programme\RocketDock\RocketDock.exe () PRC - C:\Programme\Logitech\QuickCam10\QuickCam10.exe () PRC - C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe (Logitech Inc.) PRC - C:\Programme\Gemeinsame Dateien\LogiShrd\LQCVFX\COCIManager.exe (Logitech Inc.) PRC - C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.) PRC - C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe (Logitech Inc.) PRC - C:\Programme\ATI Technologies\ATI.ACE\CLI.exe (ATI Technologies Inc.) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) PRC - C:\Programme\Creative\SBAudigy\Surround Mixer\CTSysVol.exe (Creative Technology Ltd) PRC - C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.) PRC - C:\Programme\ScanSoft\OmniPageSE\opware32.exe (ScanSoft, Inc) PRC - C:\ibmtools\aptezbtn\aptezbp.exe (IBM Corporation) PRC - C:\ibmtools\aptezbtn\rakusb.exe (IBM) ========== Modules (SafeList) ========== MOD - C:\Dokumente und Einstellungen\Family\Desktop\OTL.exe (OldTimer Tools) MOD - c:\Dokumente und Einstellungen\Family\Lokale Einstellungen\Temp\TeamViewer\Version5\TV.dll (TeamViewer GmbH) MOD - C:\WINDOWS\mshtuota.dll () MOD - C:\Programme\RocketDock\RocketDock.dll () MOD - C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcInj.dll (Logitech Inc.) MOD - C:\WINDOWS\system32\framedyn.dll (Microsoft Corporation) MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2649_x-ww_aac16c8b\comctl32.dll (Microsoft Corporation) MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation) MOD - C:\Programme\ScanSoft\OmniPageSE\ophook32.dll (ScanSoft, Inc) ========== Win32 Services (SafeList) ========== SRV - (ServiceLayer) -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe (Nokia) SRV - (AntiVirService) -- C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (Apple Mobile Device) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.) SRV - (AntiVirSchedulerService) -- C:\Programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (a2free) -- C:\Programme\a-squared Free\a2service.exe (Emsi Software GmbH) SRV - (aawservice) -- C:\Programme\Lavasoft\Ad-Aware\aawservice.exe (Lavasoft) SRV - (UTSCSI) -- C:\WINDOWS\system32\UTSCSI.EXE () SRV - (FLEXnet Licensing Service) -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.) SRV - (LVSrvLauncher) -- C:\Programme\Gemeinsame Dateien\LogiShrd\SrvLnch\SrvLnch.exe (Logitech Inc.) SRV - (LVPrcSrv) -- C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.) SRV - (LVCOMSer) -- C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe (Logitech Inc.) SRV - (KPF4) -- C:\Programme\Sunbelt Software\Personal Firewall\kpf4ss.exe (Sunbelt Software) SRV - (UleadBurningHelper) -- C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.) SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation) SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (GMSIPCI) -- D:\INSTALL\GMSIPCI.SYS File not found DRV - (truecrypt) -- C:\WINDOWS\system32\drivers\truecrypt.sys (TrueCrypt Foundation) DRV - (UsbserFilt) -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys (Nokia) DRV - (upperdev) -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys (Nokia) DRV - (nmwcdc) -- C:\WINDOWS\system32\drivers\ccdcmbo.sys (Nokia) DRV - (nmwcd) -- C:\WINDOWS\system32\drivers\ccdcmb.sys (Nokia) DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH) DRV - (silabser) -- C:\WINDOWS\system32\drivers\silabser.sys (Silicon Laboratories) DRV - (silabenm) -- C:\WINDOWS\system32\drivers\silabenm.sys (Silicon Laboratories, Inc.) DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH) DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH) DRV - (WDC_SAM) -- C:\WINDOWS\system32\drivers\wdcsam.sys (Western Digital Technologies) DRV - (avgio) -- C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avgio.sys (Avira GmbH) DRV - (pccsmcfd) -- C:\WINDOWS\system32\drivers\pccsmcfd.sys (Nokia) DRV - (sscdmdm) -- C:\WINDOWS\system32\drivers\sscdmdm.sys (MCCI Corporation) DRV - (sscdmdfl) -- C:\WINDOWS\system32\drivers\sscdmdfl.sys (MCCI Corporation) DRV - (sscdbus) SAMSUNG USB Composite Device driver (WDM) -- C:\WINDOWS\system32\drivers\sscdbus.sys (MCCI Corporation) DRV - (AnyDVD) -- C:\WINDOWS\system32\drivers\AnyDVD.sys (SlySoft, Inc.) DRV - (ElbyCDIO) -- C:\WINDOWS\system32\drivers\ElbyCDIO.sys (Elaborate Bytes AG) DRV - (LVPr2Mon) -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys () DRV - (LVMVDrv) -- C:\WINDOWS\system32\drivers\LVMVdrv.sys (Logitech Inc.) DRV - (LVcKap) -- C:\WINDOWS\system32\drivers\Lvckap.sys () DRV - (MotDev) -- C:\WINDOWS\system32\drivers\motodrv.sys (Motorola Inc) DRV - (motmodem) -- C:\WINDOWS\system32\drivers\motmodem.sys (Motorola) DRV - (StarOpen) -- C:\WINDOWS\System32\drivers\StarOpen.sys () DRV - (khips) -- C:\WINDOWS\system32\drivers\khips.sys (Sunbelt Software) DRV - (fwdrv) -- C:\WINDOWS\system32\drivers\fwdrv.sys (Sunbelt Software) DRV - (m5288) -- C:\WINDOWS\system32\DRIVERS\m5288.sys (ULi Electronics Inc.) DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.) DRV - (P17) -- C:\WINDOWS\system32\drivers\P17.sys (Creative Technology Ltd.) DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.) DRV - (ULI5261XP) -- C:\WINDOWS\system32\drivers\ULILAN51.SYS (ULi Electronics Inc.) DRV - (AmdK8) -- C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices) DRV - (ossrv) -- C:\WINDOWS\system32\drivers\ctoss2k.sys (Creative Technology Ltd.) DRV - (ctsfm2k) -- C:\WINDOWS\system32\drivers\ctsfm2k.sys (Creative Technology Ltd) DRV - (TTLOOPHE) -- C:\WINDOWS\system32\drivers\ttloophe.sys (TechnoTrend AG) DRV - (SAA7146n) TT DVB-PCI driver (SAA7146n) -- C:\WINDOWS\system32\drivers\saa7146n.sys (TechnoTrend AG) DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\Hdaudbus.sys (Windows (R) Server 2003 DDK provider) DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation) DRV - (GVCplDrv) -- C:\WINDOWS\System32\drivers\GVCplDrv.sys () DRV - (AliIde) -- C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.faz.net/ IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\software\mozilla\Firefox\extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Programme\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2010.06.29 00:22:03 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Programme\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2010.06.29 00:22:04 | 000,000,000 | ---D | M] [2010.09.06 13:36:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Family\Anwendungsdaten\Mozilla\Extensions O1 HOSTS File: ([2010.09.26 19:13:29 | 000,396,758 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 .supercocklol.com O1 - Hosts: 127.0.0.1 www..webloyalty.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 123topsearch.com O1 - Hosts: 127.0.0.1 www.123topsearch.com O1 - Hosts: 127.0.0.1 www.132.com O1 - Hosts: 127.0.0.1 132.com O1 - Hosts: 127.0.0.1 136136.net O1 - Hosts: 127.0.0.1 www.136136.net O1 - Hosts: 13698 more lines... O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon Drucker\Easy-WebPrint\Toolband.dll () O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKCU\..\Toolbar\ShellBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [AEZBProc] c:\ibmtools\aptezbtn\aptezbp.exe (IBM Corporation) O4 - HKLM..\Run: [ATICCC] C:\Programme\ATI Technologies\ATI.ACE\cli.exe (ATI Technologies Inc.) O4 - HKLM..\Run: [avgnt] C:\Programme\Antivir Avira\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [CTSysVol] C:\Programme\Creative\SBAudigy\Surround Mixer\CTSysVol.exe (Creative Technology Ltd) O4 - HKLM..\Run: [Easy-PrintToolBox] C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE (CANON INC.) O4 - HKLM..\Run: [LogitechCommunicationsManager] C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe (Logitech Inc.) O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Programme\Logitech\QuickCam10\QuickCam10.exe () O4 - HKLM..\Run: [ Malwarebytes Anti-Malware (reboot)] C:\Programme\Malwarebyte' Anti-Malware\abc.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [MbWzdFPAP-EXL580] C:\WINDOWS\system32\FPAP-EXL580\PdtGuide.exe () O4 - HKLM..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe (Microsoft Corporation) O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh) O4 - HKLM..\Run: [NokiaMServer] C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer.exe (Nokia) O4 - HKLM..\Run: [Omnipage] C:\Programme\ScanSoft\OmniPageSE\opware32.exe (ScanSoft, Inc) O4 - HKLM..\Run: [P17Helper] C:\WINDOWS\System32\P17.dll () O4 - HKLM..\Run: [QuickTime Task] C:\Programme\QuickTime Alternative\QTTask.exe (Apple Inc.) O4 - HKLM..\Run: [REGSHAVE] C:\Programme\REGSHAVE\REGSHAVE.EXE (FUJI PHOTO FILM CO., LTD.) O4 - HKCU..\Run: [] File not found O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Catalyst System Tray.lnk = C:\Programme\ATI Technologies\ATI.ACE\CLI.exe (ATI Technologies Inc.) O4 - Startup: C:\Dokumente und Einstellungen\Family\Startmenü\Programme\Autostart\RocketDock.exe.lnk = C:\Programme\RocketDock\RocketDock.exe () O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ClassicShell = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoThemesTab = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewContextMenu = 0 O8 - Extra context menu item: Append to existing PDF - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Convert link target to existing PDF - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Convert selected links to existing PDF - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Convert selection to existing PDF - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Convert to Adobe PDF - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Easy-WebPrint - Drucken - C:\Programme\Canon Drucker\Easy-WebPrint\Resource.dll () O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - C:\Programme\Canon Drucker\Easy-WebPrint\Resource.dll () O8 - Extra context menu item: Easy-WebPrint - Vorschau - C:\Programme\Canon Drucker\Easy-WebPrint\Resource.dll () O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - C:\Programme\Canon Drucker\Easy-WebPrint\Resource.dll () O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O12 - Plugin for: .UVR - C:\Programme\Internet Explorer\PLUGINS\NPUPano.dll (Ulead Systems, Inc.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14) O16 - DPF: {8BC53B30-32E4-4ED3-BEF9-DB761DB77453} hxxp://u3.sandisk.com/download/apps/LPInstaller.CAB (CInstallLPCtrl Object) O16 - DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab (Java Plug-in 1.4.2) O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Family\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Family\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.08.18 00:29:25 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2007.07.30 14:05:08 | 000,000,057 | R--- | M] () - D:\autorun.bat -- [ CDFS ] O32 - AutoRun File - [2003.02.23 00:00:00 | 000,000,045 | R--- | M] () - D:\autorun.inf -- [ CDFS ] O32 - AutoRun File - [2004.04.30 23:00:00 | 000,000,967 | R--- | M] () - D:\autorun.pif -- [ CDFS ] O33 - MountPoints2\{13564db2-07ae-11df-8a6b-00d05c224f6e}\Shell - "" = AutoRun O33 - MountPoints2\{13564db2-07ae-11df-8a6b-00d05c224f6e}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{13564db2-07ae-11df-8a6b-00d05c224f6e}\Shell\AutoRun\command - "" = N:\WD SmartWare.exe -- File not found O33 - MountPoints2\{2c6b4270-d5b4-11de-89f0-00d05c224f6e}\Shell\AutoRun\command - "" = J:\start.bat -- File not found O33 - MountPoints2\{48e61bc8-027f-11dd-84df-00d05c224f6e}\Shell - "" = AutoRun O33 - MountPoints2\{48e61bc8-027f-11dd-84df-00d05c224f6e}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{48e61bc8-027f-11dd-84df-00d05c224f6e}\Shell\AutoRun\command - "" = J:\PdtStart.exe -- File not found O33 - MountPoints2\{6953400c-2042-11de-87fd-00d05c224f6e}\Shell - "" = AutoRun O33 - MountPoints2\{6953400c-2042-11de-87fd-00d05c224f6e}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{6953400c-2042-11de-87fd-00d05c224f6e}\Shell\AutoRun\command - "" = J:\LaunchU3.exe -- File not found O33 - MountPoints2\{6953400d-2042-11de-87fd-00d05c224f6e}\Shell\AutoRun\command - "" = K:\LaunchU3.exe -- File not found O33 - MountPoints2\{7902d9be-37ab-11dc-8281-00d05c224f6e}\Shell\AutoRun\command - "" = J:\wd_windows_tools\setup.exe -- File not found O33 - MountPoints2\{a4c85e91-9734-11db-811d-00d05c224f6e}\Shell\AutoRun\command - "" = J:\wd_windows_tools\setup.exe -- File not found O33 - MountPoints2\{a9f2fc13-1654-11de-87e5-00d05c224f6e}\Shell\AutoRun\command - "" = Start.exe O33 - MountPoints2\{ad770e30-fabc-11de-8a46-00d05c224f6e}\Shell\AutoRun\command - "" = K:\start.bat -- File not found O33 - MountPoints2\{ad770e31-fabc-11de-8a46-00d05c224f6e}\Shell\AutoRun\command - "" = J:\start.bat -- File not found O33 - MountPoints2\{c8420a6b-8d03-11df-8c30-00d05c224f6e}\Shell - "" = AutoRun O33 - MountPoints2\{c8420a6b-8d03-11df-8c30-00d05c224f6e}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{c8420a6b-8d03-11df-8c30-00d05c224f6e}\Shell\AutoRun\command - "" = L:\PdtStart.exe -- File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe () O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O36 - AppCertDlls: helpsass - (C:\WINDOWS\mshtuota.dll) - C:\WINDOWS\mshtuota.dll () O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010.09.26 20:57:42 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Family\Desktop\OTL.exe [2010.09.26 19:03:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Family\Anwendungsdaten\Malwarebytes [2010.09.26 11:27:53 | 000,000,000 | ---D | C] -- C:\Programme\Trend Micro [2010.09.26 10:40:44 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010.09.26 10:40:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes [2010.09.26 10:40:38 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2010.09.26 10:40:38 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebyte' Anti-Malware [2010.09.26 10:31:37 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Family\Anwendungsdaten\TeamViewer [2010.09.25 23:22:05 | 000,000,000 | ---D | C] -- C:\Programme\TeamViewer [2006.08.18 12:36:24 | 000,065,536 | R--- | C] ( ) -- C:\WINDOWS\System32\A3d.dll [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010.09.26 21:01:43 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Family\Desktop\OTL.exe [2010.09.26 20:58:09 | 014,417,920 | ---- | M] () -- C:\Dokumente und Einstellungen\Family\NTUSER.DAT [2010.09.26 20:12:23 | 000,054,016 | ---- | M] () -- C:\WINDOWS\System32\drivers\richmtr.sys [2010.09.26 19:33:32 | 000,000,593 | ---- | M] () -- C:\WINDOWS\win.ini [2010.09.26 19:33:32 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini [2010.09.26 19:33:32 | 000,000,211 | -HS- | M] () -- C:\boot.ini [2010.09.26 19:13:29 | 000,396,758 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2010.09.26 12:39:20 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010.09.26 12:39:10 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010.09.26 11:51:06 | 000,000,330 | ---- | M] () -- C:\WINDOWS\System32\drivers\fwdrv.err [2010.09.26 11:27:53 | 000,001,704 | ---- | M] () -- C:\Dokumente und Einstellungen\Family\Desktop\HijackThis.lnk [2010.09.25 23:22:07 | 000,000,601 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\TeamViewer 5.lnk [2010.09.24 14:59:25 | 000,025,713 | ---- | M] () -- C:\WINDOWS\CSTBox.INI [2010.09.24 13:32:22 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\Family\ntuser.ini [2010.09.24 13:30:35 | 000,000,140 | ---- | M] () -- C:\WINDOWS\prestopm.INI [2010.09.23 22:30:00 | 000,000,212 | ---- | M] () -- C:\WINDOWS\tasks\Backup-Anweisung.job [2010.09.21 09:36:10 | 000,050,688 | ---- | M] () -- C:\WINDOWS\mshtuota.dll [2010.09.10 11:52:01 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job [2010.09.09 22:58:40 | 000,000,578 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Opera.lnk [2010.09.07 17:16:57 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files Created - No Company Name ========== [2010.09.26 20:12:23 | 000,054,016 | ---- | C] () -- C:\WINDOWS\System32\drivers\richmtr.sys [2010.09.26 11:27:53 | 000,001,704 | ---- | C] () -- C:\Dokumente und Einstellungen\Family\Desktop\HijackThis.lnk [2010.09.25 23:22:06 | 000,000,601 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\TeamViewer 5.lnk [2010.09.21 09:36:10 | 000,050,688 | ---- | C] () -- C:\WINDOWS\mshtuota.dll [2009.12.31 23:49:53 | 000,000,447 | ---- | C] () -- C:\Dokumente und Einstellungen\Family\Anwendungsdaten\artresize.ini [2009.08.19 18:12:33 | 000,000,000 | ---- | C] () -- C:\WINDOWS\pcvcdvw.INI [2009.08.19 17:40:11 | 000,000,062 | ---- | C] () -- C:\WINDOWS\pcvcdbr.INI [2008.07.19 16:15:36 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\LauncherAccess.dt [2008.07.19 16:08:32 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys [2008.07.12 17:01:18 | 000,001,359 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\QTSBandwidthCache [2008.07.10 22:01:10 | 000,000,040 | -HS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\.zreglib [2008.05.07 16:15:37 | 000,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI [2007.12.12 00:34:56 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2007.12.12 00:33:14 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\dtu100.dll.manifest [2007.12.12 00:33:14 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\dpl100.dll.manifest [2007.12.12 00:32:28 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll [2007.08.29 16:16:54 | 000,001,720 | ---- | C] () -- C:\WINDOWS\wininit.ini [2007.05.11 17:30:16 | 000,025,888 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys [2007.05.11 17:27:58 | 002,107,808 | ---- | C] () -- C:\WINDOWS\System32\drivers\Lvckap.sys [2007.04.20 20:23:26 | 000,000,030 | ---- | C] () -- C:\WINDOWS\Iedit_.INI [2006.12.30 21:34:21 | 000,000,072 | ---- | C] () -- C:\WINDOWS\Pex.INI [2006.12.30 21:31:51 | 000,000,294 | ---- | C] () -- C:\WINDOWS\ULead32.ini [2006.12.23 19:24:23 | 000,000,029 | ---- | C] () -- C:\WINDOWS\Battle.ini [2006.08.25 13:10:02 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\Change.dll [2006.08.23 22:25:04 | 000,025,713 | ---- | C] () -- C:\WINDOWS\CSTBox.INI [2006.08.23 17:34:42 | 000,000,029 | ---- | C] () -- C:\WINDOWS\DEBUGSM.INI [2006.08.23 15:13:59 | 000,001,267 | ---- | C] () -- C:\WINDOWS\DVB-TV.INI [2006.08.23 11:30:51 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2006.08.23 11:30:50 | 000,089,088 | ---- | C] () -- C:\Dokumente und Einstellungen\Family\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2006.08.22 22:37:31 | 000,000,036 | ---- | C] () -- C:\WINDOWS\MixBKS.INI [2006.08.22 21:45:02 | 000,000,061 | ---- | C] () -- C:\Dokumente und Einstellungen\Family\Anwendungsdaten\sversion.ini [2006.08.22 20:47:14 | 000,000,000 | ---- | C] () -- C:\WINDOWS\OpPrintServer.INI [2006.08.22 20:43:29 | 000,008,704 | ---- | C] () -- C:\WINDOWS\System32\CNMVS79.DLL [2006.08.22 20:15:04 | 000,000,140 | ---- | C] () -- C:\WINDOWS\prestopm.INI [2006.08.22 19:53:07 | 000,011,776 | ---- | C] () -- C:\WINDOWS\System32\pmsbfn32.dll [2006.08.22 19:52:23 | 000,000,074 | ---- | C] () -- C:\WINDOWS\PMINI.ini [2006.08.22 19:49:38 | 000,000,509 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI [2006.08.22 18:28:08 | 000,005,632 | ---- | C] () -- C:\WINDOWS\ezbtndll.dll [2006.08.22 18:28:08 | 000,005,120 | ---- | C] () -- C:\WINDOWS\rakdll.dll [2006.08.18 14:56:16 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html [2006.08.18 13:52:15 | 000,000,225 | ---- | C] () -- C:\WINDOWS\cdplayer.ini [2006.08.18 13:13:54 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2006.08.18 12:36:24 | 000,053,248 | R--- | C] () -- C:\WINDOWS\System32\P17CPI.dll [2006.08.18 12:36:20 | 000,064,512 | R--- | C] () -- C:\WINDOWS\System32\P17.dll [2006.08.18 12:16:07 | 000,000,139 | ---- | C] () -- C:\Dokumente und Einstellungen\Family\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat [2006.08.18 12:11:11 | 000,023,040 | R--- | C] () -- C:\WINDOWS\System32\drivers\GVCplDrv.sys [2006.07.12 10:27:54 | 000,240,640 | ---- | C] () -- C:\WINDOWS\System32\PhotomatixLib.dll [2006.07.12 10:03:56 | 000,107,520 | ---- | C] () -- C:\WINDOWS\System32\PhotomatixLib3.dll [2006.05.08 12:20:08 | 000,212,992 | ---- | C] () -- C:\WINDOWS\System32\PhotomatixLib2.dll [2006.02.05 18:23:50 | 000,205,824 | ---- | C] () -- C:\WINDOWS\System32\pmtf1.dll [2006.02.05 16:27:16 | 000,353,280 | ---- | C] () -- C:\WINDOWS\System32\pmtf2.dll [2005.07.13 14:09:00 | 000,216,064 | ---- | C] () -- C:\WINDOWS\System32\pmjp.dll [2005.07.07 11:26:56 | 000,005,627 | R--- | C] () -- C:\WINDOWS\System32\Ludap17.ini [2005.03.08 08:17:08 | 000,000,039 | R--- | C] () -- C:\WINDOWS\System32\ctzapxx.ini [2004.12.14 14:19:34 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\pmexr.dll [2004.08.04 00:57:22 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll [2004.07.17 11:36:38 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys [2004.06.04 23:22:14 | 000,782,336 | ---- | C] () -- C:\WINDOWS\System32\IlmImf.dll [2003.11.26 12:47:24 | 000,011,776 | ---- | C] () -- C:\WINDOWS\System32\pmbm.dll < End of report > Extras.txt OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 26.09.2010 20:59:13 - Run 1
OTL by OldTimer - Version 3.2.14.1 Folder = C:\Dokumente und Einstellungen\Family\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1.023,00 Mb Total Physical Memory | 263,00 Mb Available Physical Memory | 26,00% Memory free
924,00 Mb Paging File | 221,00 Mb Available in Paging File | 24,00% Paging File free
Paging file location(s): [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 18,00 Gb Total Space | 2,01 Gb Free Space | 11,14% Space Free | Partition Type: NTFS
Drive D: | 273,24 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive E: | 131,05 Gb Total Space | 93,95 Gb Free Space | 71,69% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: PC-ONE
Current User Name: Family
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = Opera.HTML] -- C:\Programme\Opera\Opera.exe (Opera Software)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Programme\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] -- "C:\Programme\Opera\Opera.exe" (Opera Software)
https [open] -- "C:\Programme\Opera\Opera.exe" (Opera Software)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [bcdmcatalog] -- "C:\Programme\Broken_C_D_Manager3.94\Disk Manager.exe" /Catalog "%1" (Broken X Software)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Programme\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{025C3792-E9C6-432A-92C1-661F99D021CA}" = Ulead Photo Explorer 8.6
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{089DD780-DB3F-4CDB-A0C2-111360247298}" = PC Connectivity Solution
"{11AFE21E-B193-430D-B57A-DFF7815BB962}" = Ulead PhotoImpact 12
"{1373559F-6DC6-44EA-9079-6ABDCCE8CDAD}" = OviMPlatform
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{18E65799-76BD-46EF-9E53-972FE5A40736}" = Opera 10.62
"{1B1DDAD2-C704-49F8-8FC2-18DAAD9A87C5}" = Sound Blaster Audigy
"{1B9B5B3B-28E7-4E59-A80D-D670AA984514}" = Nokia Connectivity Cable Driver
"{257D6C9F-BD8E-4739-9D03-FED55793C774}_is1" = floAt's Mobile Agent
"{26A24AE4-039D-4CA4-87B4-2F83216014FF}" = Java(TM) 6 Update 14
"{2D10FC46-1D96-44C4-8855-85F21B9B011E}" = Ovi Desktop Sync Engine
"{2E0C1913-886B-4C5C-8DAF-D1E649CE5FCC}" = Creative MediaSource
"{310E741A-84DC-11D5-AAB1-00D0B740908B}" = IBM Rapid Access Keyboard
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3CEA4CA8-CDD4-451C-B673-E8F17BE01B15}" = Ulead COOL 360 1.0
"{3DC5CD53-8BEE-4FD7-900E-3A5F02964251}" = WinTV Nexus
"{3EA9D975-BFDC-4E8E-B88B-0446FBC8CA66}" = ATI HydraVision
"{4A314589-8F9F-47F3-B0E5-DB1C6A8F7D2C}" = Motorola Software Update
"{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin
"{5490882C-6961-11D5-BAE5-00E0188E010B}" = FUJIFILM USB Driver
"{5BE42A03-E7B8-42A9-B1BB-FC48B03D58B8}" = Presto! PageManager 6.03
"{5D601655-6D54-4384-B52C-17EC5385FBBD}" = iTunes
"{6249C22D-E6A8-407B-BA8B-40298848ED94}" = OmniPage SE
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{7148F0A8-6813-11D6-A77B-00B0D0142000}" = Java 2 Runtime Environment, SE v1.4.2
"{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = Avanquest update
"{7AC15160-A49B-4A89-B181-D4619C025FFF}" = Samsung Samples Installer
"{7B01FD07-1790-4EE9-B5E0-149527D70C7D}" = Nokia Ovi Suite
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{8355F970-601D-442D-A79B-1D7DB4F24CAD}" = Apple Mobile Device Support
"{88F92798-59AB-474F-B40D-1EC5F782F7EE}" = Ulead VideoStudio 9.0
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8F23E496-B0E0-4DB4-B1E1-5EABF844D747}" = Silicon Laboratories CP210x VCP Drivers for Windows 2000/XP/2003 Server/Vista
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-00A4-0407-0000-0000000FF1CE}" = Microsoft Office 2003 Web Components
"{90260407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Web Components
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9F28D8E9-9E73-49E5-88B2-988D807E7F2D}" = Manual CanoScan LiDE 80
"{A0D65C73-F2C5-432F-8788-90F8A2E99B98}" = Nokia Ovi Suite Software Updater
"{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}" = MSXML 6.0 Parser
"{AC76BA86-1029-0000-7760-000000000003}" = Adobe Acrobat 8 Professional - Czech, Greek, Hungarian, Polish, Slovak
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B210F97A-B06D-4483-B24F-C927D4818A32}" = Samsung PC Studio 3
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BA1BE991-D723-41BE-AD16-42EAFDA794EA}" = Ulead COOL 3D 3.5
"{BAD8CA9C-77C0-4663-B00B-A8D3B13C341B}" = Motorola Phone Tools
"{BBBC2B89-E193-4348-A83C-C8DD8210A4AC}" = Canon PhotoRecord
"{BCE46757-7674-4416-BEDB-68205A60409E}" = Canon CanoScan Toolbox 4.1
"{C4A4722E-79F9-417C-BD72-8D359A090C97}" = Samsung PC Studio 3
"{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D050D7362D214723AD585B541FFB6C11}" = DivX Content Uploader
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D52A217A-835C-465E-B068-8B01CB12D2C5}" = ATI Catalyst Control Center
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9-Reihe
"{E659E0EE-10E6-49B7-8696-60F38D0EB174}" = Sunbelt Kerio Personal Firewall
"{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}" = Samsung PC Studio 3 USB Driver Installer
"{EFA2BBEB-CF93-493B-904B-1B970B8DFAB6}" = Logitech QuickCam
"{F00B1410-E832-4B0C-85E2-6E0F010C2A87}" = InterVideo FilterSDK for Techno Trend
"{F0312AC6-988B-11DA-9C49-000476F770CC}" = CIB pdf brewer 2.5.26
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F850707C-B6A0-4B56-8709-F89CF8F9AC6D}" = Eraser
"{FDC53DC6-137A-4541-BFA2-A9BAE4A7FE99}" = ULi Chipset Driver
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"6194C28A8F62DD817EA1B918E6E46E806A21B452" = Windows-Treiberpaket - MobileTop (sshpmdm) Modem (02/23/2007 2.5.0.0)
"65B6FE5418CE28F4D72543FB2D964C3CEC83F161" = Windows-Treiberpaket - MobileTop (sshpusb) USB (02/23/2007 2.5.0.0)
"Adobe Acrobat 8 Professional - Czech, Greek, Hungarian, Polish, Slovak" = Adobe Acrobat 8 Professional - Czech, Greek, Hungarian, Polish, Slovak
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"All ATI Software" = ATI - Dienstprogramm zur Deinstallation der Software
"AnyDVD" = AnyDVD
"a-squared Free_is1" = a-squared Free 4.0
"ATI Display Driver" = ATI Display Driver
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Broken Cross Disk Manager_is1" = Broken Cross Disk Manager - Professional Version 3.94 (MBCS)
"CANONBJ_Deinstall_CNMCP79.DLL" = Canon iP5200
"Citrix Web Client" = Citrix Web Client
"DVD Decrypter" = DVD Decrypter (Remove Only)
"Easy-PhotoPrint" = Canon Utilities Easy-PhotoPrint
"Easy-PrintToolBox" = Canon Utilities Easy-PrintToolBox
"Easy-WebPrint" = Easy-WebPrint
"Free YouTube to iPod Converter_is1" = Free YouTube to iPod Converter version 3.1
"Gold Wave Editor_is1" = Gold Wave Editor v9.1
"GoldWave v5.18" = GoldWave v5.18
"HijackThis" = HijackThis 2.0.2
"IcoFX_is1" = IcoFX 1.6.4
"Icon Extractor" = Icon Extractor
"InstallShield_{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin
"IrfanView" = IrfanView (remove only)
"IsoBuster_is1" = IsoBuster 2.7
"Language pack for Ad-Aware SE" = Language pack for Ad-Aware SE
"MahJong Suite Graphics Pack Volume 1_is1" = MahJong Suite Graphics Pack Volume 1 - v1.8
"MahJong Suite Graphics Pack Volume 2_is1" = MahJong Suite Graphics Pack Volume 2 - v2.9
"MahJong Suite_is1" = MahJong Suite 2009 v6.1
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MediaNavigation.CDLabelPrint" = CD-LabelPrint
"NeroMultiInstaller!UninstallKey" = Nero Suite
"Nokia Ovi Suite" = Nokia Ovi Suite
"Photomatix Pro_is1" = Photomatix Pro Version 2.2.4
"POIbase_is1" = POIbase 1.002
"Portable Backup_is1" = Portable Backup 1.0.0.2
"QcDrv" = Logitech® Camera-Treiber
"QuicktimeAlt_is1" = QuickTime Alternative 1.74
"RealPlayer 6.0" = RealPlayer
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"SLABCOMM&10C4&EA60" = Silicon Laboratories CP210x USB to UART Bridge (Driver Removal)
"Spybot - Search & Destroy_is1" = Spybot - Search & Destroy 1.5.2.20
"TeamViewer 5" = TeamViewer 5
"TrueCrypt" = TrueCrypt
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 0.9.9
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"Winamp" = Winamp (remove only)
"Windows Media Encoder 9" = Windows Media Encoder 9-Reihe
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 10
"WinRAR archiver" = WinRAR Archivierer
"WMFDist11" = Windows Media Format 11 runtime
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"xp-AntiSpy" = xp-AntiSpy 3.96-2
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Eraser" = Eraser
"StarOffice 7" = StarOffice 7
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 22.09.2010 16:30:27 | Computer Name = PC-ONE | Source = ESENT | ID = 490
Description = svchost (1368) Versuch, Datei "C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb"
für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
Error - 22.09.2010 16:30:30 | Computer Name = PC-ONE | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
ist fehlgeschlagen mit dem Fehler: Die Serververbindung konnte nicht hergestellt
werden. .
Error - 22.09.2010 16:33:30 | Computer Name = PC-ONE | Source = PerfNet | ID = 2004
Description = Der Serverdienst konnte nicht geöffnet werden. Die Server-Leistungsinformationen
werden
nicht zurückgegeben. Der zurückgegebene Fehlercode befindet sich in DWORD 0.
Error - 22.09.2010 16:34:15 | Computer Name = PC-ONE | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
ist fehlgeschlagen mit dem Fehler: Dieser Vorgang wurde wegen Zeitüberschreitung
zurückgegeben. .
Error - 22.09.2010 17:44:17 | Computer Name = PC-ONE | Source = PerfNet | ID = 2004
Description = Der Serverdienst konnte nicht geöffnet werden. Die Server-Leistungsinformationen
werden
nicht zurückgegeben. Der zurückgegebene Fehlercode befindet sich in DWORD 0.
Error - 22.09.2010 17:44:56 | Computer Name = PC-ONE | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
ist fehlgeschlagen mit dem Fehler: Die Serververbindung konnte nicht hergestellt
werden. .
Error - 23.09.2010 15:53:44 | Computer Name = PC-ONE | Source = PerfNet | ID = 2004
Description = Der Serverdienst konnte nicht geöffnet werden. Die Server-Leistungsinformationen
werden
nicht zurückgegeben. Der zurückgegebene Fehlercode befindet sich in DWORD 0.
Error - 23.09.2010 15:54:20 | Computer Name = PC-ONE | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
ist fehlgeschlagen mit dem Fehler: Die Serververbindung konnte nicht hergestellt
werden. .
Error - 24.09.2010 07:04:09 | Computer Name = PC-ONE | Source = PerfNet | ID = 2004
Description = Der Serverdienst konnte nicht geöffnet werden. Die Server-Leistungsinformationen
werden
nicht zurückgegeben. Der zurückgegebene Fehlercode befindet sich in DWORD 0.
Error - 24.09.2010 07:04:42 | Computer Name = PC-ONE | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
ist fehlgeschlagen mit dem Fehler: Die Serververbindung konnte nicht hergestellt
werden. .
[ System Events ]
Error - 26.09.2010 05:52:56 | Computer Name = PC-ONE | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
AFD AmdK8 avgio avipbb ElbyCDIO Fips IPSec khips MRxSmb NetBIOS NetBT RasAcd Rdbss ssmdrv StarOpen
Tcpip
truecrypt
Error - 26.09.2010 05:54:49 | Computer Name = PC-ONE | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
Error - 26.09.2010 06:36:58 | Computer Name = PC-ONE | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
Error - 26.09.2010 06:38:16 | Computer Name = PC-ONE | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "EventSystem"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {1BE1F766-5536-11D1-B726-00C04FB926AF}
Error - 26.09.2010 06:39:41 | Computer Name = PC-ONE | Source = ACPI | ID = 327685
Description = AMLI: ACPI-BIOS versucht, in eine ungültige E/A-Portadresse (0x81)
zu schreiben, die sich in "0x81 - 0x83", einem geschützten Adressbereich befindet.
Dies kann zu Systeminstabilität führen. Wenden Sie sich an den Systemhersteller,
um
technische Unterstützung zu erhalten.
Error - 26.09.2010 06:40:41 | Computer Name = PC-ONE | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
von Dienst stisvc.
Error - 26.09.2010 06:40:52 | Computer Name = PC-ONE | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
von Dienst stisvc.
Error - 26.09.2010 06:40:52 | Computer Name = PC-ONE | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
PCIIde
Error - 26.09.2010 06:41:22 | Computer Name = PC-ONE | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
von Dienst stisvc.
Error - 26.09.2010 06:45:52 | Computer Name = PC-ONE | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet: %%1460
< End of report >
[/code] |
|
27.09.2010, 09:15
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | TR/Crypt.XPACK.Gen3 backdoor/trojan Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!) Code:
ATTFilter :OTL
MOD - C:\WINDOWS\mshtuota.dll ()
DRV - (GMSIPCI) -- D:\INSTALL\GMSIPCI.SYS File not found
O4 - HKLM..\Run: [MbWzdFPAP-EXL580] C:\WINDOWS\system32\FPAP-EXL580\PdtGuide.exe ()
O4 - HKCU..\Run: [] File not found
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O32 - AutoRun File - [2007.07.30 14:05:08 | 000,000,057 | R--- | M] () - D:\autorun.bat -- [ CDFS ]
O32 - AutoRun File - [2003.02.23 00:00:00 | 000,000,045 | R--- | M] () - D:\autorun.inf -- [ CDFS ]
O32 - AutoRun File - [2004.04.30 23:00:00 | 000,000,967 | R--- | M] () - D:\autorun.pif -- [ CDFS ]
O33 - MountPoints2\{13564db2-07ae-11df-8a6b-00d05c224f6e}\Shell - "" = AutoRun
O33 - MountPoints2\{13564db2-07ae-11df-8a6b-00d05c224f6e}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{13564db2-07ae-11df-8a6b-00d05c224f6e}\Shell\AutoRun\command - "" = N:\WD SmartWare.exe -- File not found
O33 - MountPoints2\{2c6b4270-d5b4-11de-89f0-00d05c224f6e}\Shell\AutoRun\command - "" = J:\start.bat -- File not found
O33 - MountPoints2\{48e61bc8-027f-11dd-84df-00d05c224f6e}\Shell - "" = AutoRun
O33 - MountPoints2\{48e61bc8-027f-11dd-84df-00d05c224f6e}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{48e61bc8-027f-11dd-84df-00d05c224f6e}\Shell\AutoRun\command - "" = J:\PdtStart.exe -- File not found
O33 - MountPoints2\{6953400c-2042-11de-87fd-00d05c224f6e}\Shell - "" = AutoRun
O33 - MountPoints2\{6953400c-2042-11de-87fd-00d05c224f6e}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{6953400c-2042-11de-87fd-00d05c224f6e}\Shell\AutoRun\command - "" = J:\LaunchU3.exe -- File not found
O33 - MountPoints2\{6953400d-2042-11de-87fd-00d05c224f6e}\Shell\AutoRun\command - "" = K:\LaunchU3.exe -- File not found
O33 - MountPoints2\{7902d9be-37ab-11dc-8281-00d05c224f6e}\Shell\AutoRun\command - "" = J:\wd_windows_tools\setup.exe -- File not found
O33 - MountPoints2\{a4c85e91-9734-11db-811d-00d05c224f6e}\Shell\AutoRun\command - "" = J:\wd_windows_tools\setup.exe -- File not found
O33 - MountPoints2\{a9f2fc13-1654-11de-87e5-00d05c224f6e}\Shell\AutoRun\command - "" = Start.exe
O33 - MountPoints2\{ad770e30-fabc-11de-8a46-00d05c224f6e}\Shell\AutoRun\command - "" = K:\start.bat -- File not found
O33 - MountPoints2\{ad770e31-fabc-11de-8a46-00d05c224f6e}\Shell\AutoRun\command - "" = J:\start.bat -- File not found
O33 - MountPoints2\{c8420a6b-8d03-11df-8c30-00d05c224f6e}\Shell - "" = AutoRun
O33 - MountPoints2\{c8420a6b-8d03-11df-8c30-00d05c224f6e}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{c8420a6b-8d03-11df-8c30-00d05c224f6e}\Shell\AutoRun\command - "" = L:\PdtStart.exe -- File not found
O36 - AppCertDlls: helpsass - (C:\WINDOWS\mshtuota.dll) - C:\WINDOWS\mshtuota.dll ()
[2010.09.26 20:12:23 | 000,054,016 | ---- | M] () -- C:\WINDOWS\System32\drivers\richmtr.sys
[2010.09.26 11:51:06 | 000,000,330 | ---- | M] () -- C:\WINDOWS\System32\drivers\fwdrv.err
[2009.08.19 18:12:33 | 000,000,000 | ---- | C] () -- C:\WINDOWS\pcvcdvw.INI
[2009.08.19 17:40:11 | 000,000,062 | ---- | C] () -- C:\WINDOWS\pcvcdbr.INI
:Commands
[purity]
[resethosts]
[emptytemp]
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.
__________________ --> TR/Crypt.XPACK.Gen3 backdoor/trojan |
|
27.09.2010, 18:49
| #7 |
| | TR/Crypt.XPACK.Gen3 backdoor/trojan Ich habe vergessen den RocketDock (Leiste oben am Bildschirm für Programme) zu beenden und habe dann auf FIX geklickt. Ich hatte die Leiste nicht gesehen - da ich über Remote (via Teamviewer) zugreife. Wie lange kann es denn dauern bis der FIX fertig ist? Am Rechner hat sich seit 30 min. nichts getan. Soll ich danach alle programme beenden und nochmal den Text den du gepostet hast reinkopieren? |
|
27.09.2010, 19:36
| #8 |
| | TR/Crypt.XPACK.Gen3 backdoor/trojan Ich habe alles beendet, außer TeamViewer. Bei Avira Antivir konnte ich nur den Guard ausschalten, aber nicht das Programm beenden. Hier ist der Log: Code:
ATTFilter All processes killed
========== OTL ==========
Error: No service named GMSIPCI was found to stop!
Service\Driver key GMSIPCI not found.
File D:\INSTALL\GMSIPCI.SYS File not found not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\MbWzdFPAP-EXL580 deleted successfully.
C:\WINDOWS\system32\FPAP-EXL580\PdtGuide.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\SpybotSD TeaTimer deleted successfully.
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe moved successfully.
File move failed. D:\autorun.bat scheduled to be moved on reboot.
File move failed. D:\autorun.inf scheduled to be moved on reboot.
File move failed. D:\autorun.pif scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{13564db2-07ae-11df-8a6b-00d05c224f6e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{13564db2-07ae-11df-8a6b-00d05c224f6e}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{13564db2-07ae-11df-8a6b-00d05c224f6e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{13564db2-07ae-11df-8a6b-00d05c224f6e}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{13564db2-07ae-11df-8a6b-00d05c224f6e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{13564db2-07ae-11df-8a6b-00d05c224f6e}\ not found.
File N:\WD SmartWare.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2c6b4270-d5b4-11de-89f0-00d05c224f6e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2c6b4270-d5b4-11de-89f0-00d05c224f6e}\ not found.
File J:\start.bat not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{48e61bc8-027f-11dd-84df-00d05c224f6e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48e61bc8-027f-11dd-84df-00d05c224f6e}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{48e61bc8-027f-11dd-84df-00d05c224f6e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48e61bc8-027f-11dd-84df-00d05c224f6e}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{48e61bc8-027f-11dd-84df-00d05c224f6e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48e61bc8-027f-11dd-84df-00d05c224f6e}\ not found.
File J:\PdtStart.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6953400c-2042-11de-87fd-00d05c224f6e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6953400c-2042-11de-87fd-00d05c224f6e}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6953400c-2042-11de-87fd-00d05c224f6e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6953400c-2042-11de-87fd-00d05c224f6e}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6953400c-2042-11de-87fd-00d05c224f6e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6953400c-2042-11de-87fd-00d05c224f6e}\ not found.
File J:\LaunchU3.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6953400d-2042-11de-87fd-00d05c224f6e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6953400d-2042-11de-87fd-00d05c224f6e}\ not found.
File K:\LaunchU3.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7902d9be-37ab-11dc-8281-00d05c224f6e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7902d9be-37ab-11dc-8281-00d05c224f6e}\ not found.
File J:\wd_windows_tools\setup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a4c85e91-9734-11db-811d-00d05c224f6e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a4c85e91-9734-11db-811d-00d05c224f6e}\ not found.
File J:\wd_windows_tools\setup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a9f2fc13-1654-11de-87e5-00d05c224f6e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a9f2fc13-1654-11de-87e5-00d05c224f6e}\ not found.
File Start.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ad770e30-fabc-11de-8a46-00d05c224f6e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ad770e30-fabc-11de-8a46-00d05c224f6e}\ not found.
File K:\start.bat not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ad770e31-fabc-11de-8a46-00d05c224f6e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ad770e31-fabc-11de-8a46-00d05c224f6e}\ not found.
File J:\start.bat not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c8420a6b-8d03-11df-8c30-00d05c224f6e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c8420a6b-8d03-11df-8c30-00d05c224f6e}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c8420a6b-8d03-11df-8c30-00d05c224f6e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c8420a6b-8d03-11df-8c30-00d05c224f6e}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c8420a6b-8d03-11df-8c30-00d05c224f6e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c8420a6b-8d03-11df-8c30-00d05c224f6e}\ not found.
File L:\PdtStart.exe not found.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\\helpsass:C:\WINDOWS\mshtuota.dll deleted successfully.
C:\WINDOWS\mshtuota.dll moved successfully.
File C:\WINDOWS\System32\drivers\richmtr.sys not found.
C:\WINDOWS\system32\drivers\fwdrv.err moved successfully.
C:\WINDOWS\pcvcdvw.INI moved successfully.
C:\WINDOWS\pcvcdbr.INI moved successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
[EMPTYTEMP]
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: Family
->Temp folder emptied: 49543993 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 62526153 bytes
->Opera cache emptied: 146921 bytes
->Flash cache emptied: 1561812 bytes
User: LocalService
->Temp folder emptied: 65984 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 405 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 364373 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 148860 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 109,00 mb
OTL by OldTimer - Version 3.2.14.1 log created on 09272010_202550
Files\Folders moved on Reboot...
File move failed. D:\autorun.bat scheduled to be moved on reboot.
File move failed. D:\autorun.inf scheduled to be moved on reboot.
File move failed. D:\autorun.pif scheduled to be moved on reboot.
C:\Dokumente und Einstellungen\Family\Lokale Einstellungen\Temp\TeamViewer\Version5\TV.dll moved successfully.
File move failed. C:\WINDOWS\SD676E5A3.tmp scheduled to be moved on reboot.
Registry entries deleted on Reboot...
Geändert von aware (27.09.2010 um 19:44 Uhr) |
|
27.09.2010, 22:41
| #9 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | TR/Crypt.XPACK.Gen3 backdoor/trojan Bitte folgendes machen, ich brauch den Quarantäneordner von OTL: 1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf da nicht rummurksen! 2.) Ordner C:\_OTL in eine Datei zippen 3.) Die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html 4.) Wenns erfolgreich war Bescheid sagen 5.) Erst dann wieder den Virenscanner einschalten
__________________ Logfiles bitte immer in CODE-Tags posten |
|
27.09.2010, 23:34
| #10 |
| | TR/Crypt.XPACK.Gen3 backdoor/trojan Mein Kumpel schläft schon, kann also nicht auf seinen PC zugreifen. Er hatte ihn nach dem Oltimer scan heruntergefahren und nicht wieder angefasst. Morgen früh werde ich wieder draufzugreifen, aber Avira Antivir ist ja beim Systemstart an. Ich sage ihm er soll es sofort ausschalten wenn er hochgefahren ist. Schon jetzt mal vielen Dank . |
|
28.09.2010, 14:29
| #11 |
| | TR/Crypt.XPACK.Gen3 backdoor/trojan Ich habe den Avira Guard ausgeschaltet (es kam auch keine Meldung) und den _OTL Ordner gezippt und hochgeladen. |
|
28.09.2010, 15:12
| #12 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | TR/Crypt.XPACK.Gen3 backdoor/trojan Dann bitte jetzt CF ausführen: ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
28.09.2010, 15:42
| #13 |
| | TR/Crypt.XPACK.Gen3 backdoor/trojan Ich bin jetzt dabei combofix auszuführen, und obwohl Avira Antivir Guard deaktiviert wurde, sagt comboxfix, dass es der real time scanner noch aktiv wäre. Über den Task manager kann ich Avira Antivir nicht beenden. Soll ich combofix dennoch weiter ausführen (ich kann eh nur OK klicken in der Dialogbox von Combofix  )? Geändert von aware (28.09.2010 um 15:50 Uhr) |
|
28.09.2010, 16:12
| #14 |
| | TR/Crypt.XPACK.Gen3 backdoor/trojan Ich habe via Remotezugriff Teamviewer ausgeführt (wurde dann rausgeschmissen aus der Session und habe den Rest per Telefon gemacht). Combofix hat die Wiederherstellungskonsole installiert und hatte ein Rootkit gefunden. Der Rechner mußte neugestartet werden (von Combofix), wurde neugestartet. Nach dem Neustart war keine Taskleiste zu sehen und Avira Antivir Guard kam mit einer Nachricht: Rootkit ... Gen 3... gefunden. Das Rootkit wurde "gelöscht" von Avira Antivir. |
|
28.09.2010, 16:23
| #15 |
| | TR/Crypt.XPACK.Gen3 backdoor/trojan Combofix Log: Combofix Logfile: Code:
ATTFilter ComboFix 10-09-27.05 - Family 28.09.2010 17:01:01.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.49.1031.18.1023.599 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\Family\Desktop\cofi.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Outdated) {00000000-0000-0000-0000-000000000000}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804FD0EC-FFA4-00DB-0D24-347CA8A3377C}
FW: Sunbelt Kerio Personal Firewall *disabled* {E659E0EE-10E6-49B7-8696-60F38D0EB174}
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\settings.reg
c:\windows\system32\Data
c:\windows\system32\spool\prtprocs\w32x86\CNMPP79.DLL
Infizierte Kopie von c:\windows\system32\drivers\netbt.sys wurde gefunden und desinfiziert
Kopie von - Kitty had a snack :p wurde wiederhergestellt
.
((((((((((((((((((((((( Dateien erstellt von 2010-08-28 bis 2010-09-28 ))))))))))))))))))))))))))))))
.
2010-09-28 14:27 . 2010-09-28 14:27 -------- d-----w- c:\windows\system32\LogFiles
2010-09-28 14:19 . 2010-09-28 14:19 -------- d-----w- c:\programme\CCleaner
2010-09-28 13:19 . 2010-09-28 13:20 1604575 ----a-w- C:\_OTL.zip
2010-09-27 17:14 . 2010-09-27 17:14 -------- d-----w- C:\_OTL
2010-09-26 17:03 . 2010-09-26 17:03 -------- d-----w- c:\dokumente und einstellungen\Family\Anwendungsdaten\Malwarebytes
2010-09-26 09:56 . 2010-09-26 09:56 -------- d-----w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Malwarebytes
2010-09-26 09:27 . 2010-09-26 09:27 -------- d-----w- c:\programme\Trend Micro
2010-09-26 08:40 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-26 08:40 . 2010-09-26 08:40 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2010-09-26 08:40 . 2010-09-26 17:03 -------- d-----w- c:\programme\Malwarebyte' Anti-Malware
2010-09-26 08:40 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-26 08:31 . 2010-09-26 08:31 -------- d-----w- c:\dokumente und einstellungen\Family\Anwendungsdaten\TeamViewer
2010-09-25 21:22 . 2010-09-25 21:22 -------- d-----w- c:\programme\TeamViewer
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-28 14:23 . 2006-08-18 11:45 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2010-09-28 14:22 . 2006-08-18 12:10 -------- d-----w- c:\programme\Winamp
2010-09-27 18:34 . 2008-07-10 19:59 0 --sh--w- c:\windows\SD676E5A3.tmp
2010-09-27 18:25 . 2006-08-18 11:45 -------- d-----w- c:\programme\Spybot - Search & Destroy
2010-09-25 21:49 . 2007-07-10 21:35 -------- d-----w- c:\dokumente und einstellungen\Family\Anwendungsdaten\Skype
2010-09-25 16:49 . 2008-08-17 18:11 -------- d-----w- c:\dokumente und einstellungen\Family\Anwendungsdaten\skypePM
2010-09-24 12:59 . 2010-04-29 21:02 -------- d-----w- c:\dokumente und einstellungen\Family\Anwendungsdaten\Canon
2010-09-22 16:32 . 2010-01-08 17:29 -------- d-----w- c:\programme\RocketDock
2010-09-09 20:58 . 2010-05-24 15:43 -------- d-----w- c:\programme\Opera
2010-07-04 15:31 . 2010-07-04 15:31 223440 ----a-w- c:\windows\system32\drivers\truecrypt.sys
2003-01-13 09:59 . 2006-12-30 19:25 278528 ------w- c:\programme\internet explorer\plugins\PanoViewer.dll
1999-04-30 15:00 . 2006-12-30 19:25 98304 ------w- c:\programme\internet explorer\plugins\UPjpeg.dll
.
------- Sigcheck -------
[-] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\drivers\atapi.sys
[-] 2004-08-03 . 02000ABF34AF4C218C35D257024807D6 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\asyncmac.sys
[-] 2004-08-03 . 02000ABF34AF4C218C35D257024807D6 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\drivers\asyncmac.sys
[-] 2001-08-18 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\dllcache\beep.sys
[-] 2001-08-18 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\drivers\beep.sys
[-] 2004-08-03 . B128FC0A5CD83F669D5DE4B58F77C7D6 . 25216 . . [5.1.2600.2180] . . c:\windows\system32\drivers\kbdclass.sys
[-] 2004-08-03 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ndis.sys
[-] 2004-08-03 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ndis.sys
[-] 2004-08-03 . B78BE402C3F63DD55521F73876951CDD . 574592 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ntfs.sys
[-] 2004-08-03 . B78BE402C3F63DD55521F73876951CDD . 574592 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ntfs.sys
[-] 2001-08-18 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\dllcache\null.sys
[-] 2001-08-18 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\drivers\null.sys
[-] 2005-05-25 . 63FDFEA54EB53DE2D863EE454937CE1E . 359936 . . [5.1.2600.2685] . . c:\windows\system32\dllcache\tcpip.sys
[-] 2005-05-25 . 63FDFEA54EB53DE2D863EE454937CE1E . 359936 . . [5.1.2600.2685] . . c:\windows\system32\drivers\tcpip.sys
[-] 2004-08-03 . D8653DCD80CF2EBB333FC4FCC43A7DEF . 77312 . . [5.1.2600.2180] . . c:\windows\system32\browser.dll
[-] 2004-08-03 . D8653DCD80CF2EBB333FC4FCC43A7DEF . 77312 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\browser.dll
[-] 2004-08-03 . 183805EB05BCA5A1E4AAAED4D2BE3690 . 13312 . . [5.1.2600.2180] . . c:\windows\system32\lsass.exe
[-] 2004-08-03 . 183805EB05BCA5A1E4AAAED4D2BE3690 . 13312 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\lsass.exe
[-] 2005-08-22 . 1E5218FBE323C375B488318950E10FB4 . 197632 . . [5.1.2600.2743] . . c:\windows\system32\netman.dll
[-] 2005-08-22 . 1E5218FBE323C375B488318950E10FB4 . 197632 . . [5.1.2600.2743] . . c:\windows\system32\dllcache\netman.dll
[-] 2005-08-22 . 19D9B6B139F09A72AE71758BDF28308E . 197632 . . [5.1.2600.2743] . . c:\windows\$hf_mig$\KB905414\SP2QFE\netman.dll
[-] 2004-08-03 . 3A5E54A9AB96EF2D273B58136FB58EFE . 382464 . . [6.6.2600.2180] . . c:\windows\system32\qmgr.dll
[-] 2004-08-03 . 3A5E54A9AB96EF2D273B58136FB58EFE . 382464 . . [6.6.2600.2180] . . c:\windows\system32\dllcache\qmgr.dll
[-] 2005-07-26 . 891E3E4537C6DFCAE475073FC49CE9CB . 397824 . . [5.1.2600.2726] . . c:\windows\system32\rpcss.dll
[-] 2005-07-26 . 891E3E4537C6DFCAE475073FC49CE9CB . 397824 . . [5.1.2600.2726] . . c:\windows\system32\dllcache\rpcss.dll
[-] 2005-07-26 . DBA9F9C00A7A2B45EB8E451C2B6D10E9 . 398336 . . [5.1.2600.2726] . . c:\windows\$hf_mig$\KB902400\SP2QFE\rpcss.dll
[-] 2005-04-28 . 434A27912D53BF3FB6C1CE37BAFA5CF6 . 396288 . . [5.1.2600.2665] . . c:\windows\$hf_mig$\KB894391\SP2QFE\rpcss.dll
[-] 2005-01-14 . 64F7E6B27B790365A910ECE21134A680 . 395776 . . [5.1.2600.2595] . . c:\windows\$hf_mig$\KB873333\SP2QFE\rpcss.dll
[-] 2004-08-03 . EDB6B81761BD60F32F740BBC40AFB676 . 108544 . . [5.1.2600.2180] . . c:\windows\system32\services.exe
[-] 2004-08-03 . EDB6B81761BD60F32F740BBC40AFB676 . 108544 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\services.exe
[-] 2005-06-11 . AD3D9D191AEA7B5445FE1D82FFBB4788 . 57856 . . [5.1.2600.2696] . . c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
[-] 2005-06-10 . DA81EC57ACD4CDC3D4C51CF3D409AF9F . 57856 . . [5.1.2600.2696] . . c:\windows\system32\spoolsv.exe
[-] 2005-06-10 . DA81EC57ACD4CDC3D4C51CF3D409AF9F . 57856 . . [5.1.2600.2696] . . c:\windows\system32\dllcache\spoolsv.exe
[-] 2004-08-03 . 2B6A0BAF33A9918F09442D873848FF72 . 507392 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe
[-] 2004-08-03 . 2B6A0BAF33A9918F09442D873848FF72 . 507392 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\winlogon.exe
[-] 2004-08-03 . 032CA12162E89E545356525554EA12A7 . 111616 . . [5.4.3790.2180] . . c:\windows\system32\wuauclt.exe
[-] 2004-08-03 . 032CA12162E89E545356525554EA12A7 . 111616 . . [5.4.3790.2180] . . c:\windows\system32\dllcache\wuauclt.exe
[-] 2005-04-07 . 9F2604FD9111EDF4C0A042BDE44DEA2E . 617472 . . [5.82] . . c:\windows\system32\comctl32.dll
[-] 2005-04-07 . 9F2604FD9111EDF4C0A042BDE44DEA2E . 617472 . . [5.82] . . c:\windows\system32\dllcache\comctl32.dll
[-] 2004-08-03 . 1A5F9DB98DF7955B4C7CBDBF2C638238 . 60416 . . [5.1.2600.2180] . . c:\windows\system32\cryptsvc.dll
[-] 2004-08-03 . 1A5F9DB98DF7955B4C7CBDBF2C638238 . 60416 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\cryptsvc.dll
[-] 2005-07-26 04:39 . BEBC63622BDC30053A3145EBD90AF450 . 243200 . . [2001.12.4414.308] . . c:\windows\system32\es.dll
[-] 2005-07-26 04:39 . BEBC63622BDC30053A3145EBD90AF450 . 243200 . . [2001.12.4414.308] . . c:\windows\system32\dllcache\es.dll
[-] 2005-07-26 04:29 . 0D0F85237E32538F58278D673032676A . 243200 . . [2001.12.4414.308] . . c:\windows\$hf_mig$\KB902400\SP2QFE\es.dll
[-] 2004-08-03 . 94101D13A1818A9D08337EEC12ED277A . 110080 . . [5.1.2600.2180] . . c:\windows\system32\imm32.dll
[-] 2004-08-03 . 94101D13A1818A9D08337EEC12ED277A . 110080 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\imm32.dll
[-] 2004-08-03 . E6CD85D0D37416CF138F01F4BB0FC872 . 1057280 . . [5.1.2600.2180] . . c:\windows\system32\kernel32.dll
[-] 2004-08-03 . E6CD85D0D37416CF138F01F4BB0FC872 . 1057280 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\kernel32.dll
[-] 2005-09-01 . F2AFE60F01040B23207D8EB7DC26EC96 . 19968 . . [5.1.2600.2751] . . c:\windows\$hf_mig$\KB900725\SP2QFE\linkinfo.dll
[-] 2005-09-01 . 0E2B88912BF78549D5177A84A3375D52 . 19968 . . [5.1.2600.2751] . . c:\windows\system32\linkinfo.dll
[-] 2005-09-01 . 0E2B88912BF78549D5177A84A3375D52 . 19968 . . [5.1.2600.2751] . . c:\windows\system32\dllcache\linkinfo.dll
[-] 2004-08-03 . B4AD65C79F85C61D32C015B11E03CAAD . 22016 . . [5.1.2600.2180] . . c:\windows\system32\lpk.dll
[-] 2004-08-03 . B4AD65C79F85C61D32C015B11E03CAAD . 22016 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\lpk.dll
[-] 2005-11-23 . 03F9910F7958A36088B9D8CD262903AE . 3013632 . . [6.00.2900.2802] . . c:\windows\system32\mshtml.dll
[-] 2005-11-23 . 03F9910F7958A36088B9D8CD262903AE . 3013632 . . [6.00.2900.2802] . . c:\windows\system32\dllcache\mshtml.dll
[-] 2005-11-23 . 8ABDBAE6032562F17DCF962847ABB811 . 3016192 . . [6.00.2900.2802] . . c:\windows\$hf_mig$\KB905915\SP2QFE\mshtml.dll
[-] 2004-08-03 . B30BAA48E5063E71C76280E34E7E4802 . 343040 . . [7.0.2600.2180] . . c:\windows\system32\msvcrt.dll
[-] 2004-08-03 . B30BAA48E5063E71C76280E34E7E4802 . 343040 . . [7.0.2600.2180] . . c:\windows\system32\dllcache\msvcrt.dll
[-] 2004-08-03 . B36E08F680BAE4DFC5C24D00A2DFC9E7 . 247296 . . [5.1.2600.2180] . . c:\windows\system32\mswsock.dll
[-] 2004-08-03 . B36E08F680BAE4DFC5C24D00A2DFC9E7 . 247296 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\mswsock.dll
[-] 2004-08-03 . D27395EDCD3416AFD125A9370DCB585C . 407040 . . [5.1.2600.2180] . . c:\windows\system32\netlogon.dll
[-] 2004-08-03 . D27395EDCD3416AFD125A9370DCB585C . 407040 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\netlogon.dll
[-] 2005-03-02 . EB5538A452E0E99169E2B6CDB62FF9D2 . 2181888 . . [5.1.2600.2622] . . c:\windows\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
[-] 2005-03-02 . 7189A2391ADC1F65C9AE87B0ABE0F945 . 2181632 . . [5.1.2600.2622] . . c:\windows\Driver Cache\i386\ntoskrnl.exe
[-] 2005-03-02 . 7189A2391ADC1F65C9AE87B0ABE0F945 . 2181632 . . [5.1.2600.2622] . . c:\windows\system32\ntoskrnl.exe
[-] 2004-08-03 . 5604574D490B798BD9A946B021A766AD . 17408 . . [6.00.2900.2180] . . c:\windows\system32\powrprof.dll
[-] 2004-08-03 . 5604574D490B798BD9A946B021A766AD . 17408 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\powrprof.dll
[-] 2004-08-03 . 64DC26B3CF7BCCAD431CE360A4C625D5 . 186880 . . [5.1.2600.2180] . . c:\windows\system32\scecli.dll
[-] 2004-08-03 . 64DC26B3CF7BCCAD431CE360A4C625D5 . 186880 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\scecli.dll
[-] 2004-08-03 . F62934BC94299083EBFC8810242D8640 . 5120 . . [5.1.2600.2180] . . c:\windows\system32\sfc.dll
[-] 2004-08-03 . F62934BC94299083EBFC8810242D8640 . 5120 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\sfc.dll
[-] 2004-08-03 . 65A819B121EB6FDAB4400EA42BDFFE64 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\svchost.exe
[-] 2004-08-03 . 65A819B121EB6FDAB4400EA42BDFFE64 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\svchost.exe
[-] 2005-07-08 . F07061E18613F336A3120229097F7635 . 249344 . . [5.1.2600.2716] . . c:\windows\$hf_mig$\KB893756\SP2QFE\tapisrv.dll
[-] 2005-07-08 . 427D7EB3B453347082C8F4B370065D60 . 249344 . . [5.1.2600.2716] . . c:\windows\system32\tapisrv.dll
[-] 2005-07-08 . 427D7EB3B453347082C8F4B370065D60 . 249344 . . [5.1.2600.2716] . . c:\windows\system32\dllcache\tapisrv.dll
[-] 2005-03-02 . 4C90159A69A5FD3EB39C71411F28FCFF . 578560 . . [5.1.2600.2622] . . c:\windows\$hf_mig$\KB890859\SP2QFE\user32.dll
[-] 2005-03-02 . 3751D7CF0E0A113D84414992146BCE6A . 578560 . . [5.1.2600.2622] . . c:\windows\system32\user32.dll
[-] 2005-03-02 . 3751D7CF0E0A113D84414992146BCE6A . 578560 . . [5.1.2600.2622] . . c:\windows\system32\dllcache\user32.dll
[-] 2004-08-03 . D1E53DC57143F2584B1DD53B036C0633 . 25088 . . [5.1.2600.2180] . . c:\windows\system32\userinit.exe
[-] 2004-08-03 . D1E53DC57143F2584B1DD53B036C0633 . 25088 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\userinit.exe
[-] 2005-10-21 . 19625F6F8357C2306BA4B3583C705836 . 664064 . . [6.00.2900.2781] . . c:\windows\system32\wininet.dll
[-] 2005-10-21 . 19625F6F8357C2306BA4B3583C705836 . 664064 . . [6.00.2900.2781] . . c:\windows\system32\dllcache\wininet.dll
[-] 2005-10-21 . F3118DF4ABD118B11326D1C7A0093867 . 667136 . . [6.00.2900.2781] . . c:\windows\$hf_mig$\KB905915\SP2QFE\wininet.dll
[-] 2004-08-03 . D569240A22421D5F670BB6FB6DD522B5 . 82944 . . [5.1.2600.2180] . . c:\windows\system32\ws2_32.dll
[-] 2004-08-03 . D569240A22421D5F670BB6FB6DD522B5 . 82944 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ws2_32.dll
[-] 2004-08-03 . B3ADA72D1E3E10A8F6430669DFC38ED0 . 19968 . . [5.1.2600.2180] . . c:\windows\system32\ws2help.dll
[-] 2004-08-03 . B3ADA72D1E3E10A8F6430669DFC38ED0 . 19968 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ws2help.dll
[-] 2005-04-07 . 64322E8399B205B7281FF883737A9B03 . 1035264 . . [6.00.2900.2649] . . c:\windows\explorer.exe
[-] 2005-04-07 . 64322E8399B205B7281FF883737A9B03 . 1035264 . . [6.00.2900.2649] . . c:\windows\system32\dllcache\explorer.exe
[-] 2005-07-26 . CC50261CA5DC93A47D6CF548C4223F44 . 1285120 . . [5.1.2600.2726] . . c:\windows\system32\ole32.dll
[-] 2005-07-26 . CC50261CA5DC93A47D6CF548C4223F44 . 1285120 . . [5.1.2600.2726] . . c:\windows\system32\dllcache\ole32.dll
[-] 2005-07-25 . 24EDF93FD04CA1A98D32F092DD4F9953 . 1286144 . . [5.1.2600.2726] . . c:\windows\$hf_mig$\KB902400\SP2QFE\ole32.dll
[-] 2005-04-28 . D3653209882B5645223B1EA958EEE3A6 . 1286656 . . [5.1.2600.2665] . . c:\windows\$hf_mig$\KB894391\SP2QFE\ole32.dll
[-] 2005-01-14 . 11565070406B8892149C360A4FB23731 . 1285120 . . [5.1.2600.2595] . . c:\windows\$hf_mig$\KB873333\SP2QFE\ole32.dll
[-] 2004-08-03 . 015F302C4CF961F20C3F98F3A7CA7917 . 171008 . . [5.1.2600.2180] . . c:\windows\system32\srsvc.dll
[-] 2004-08-03 . 015F302C4CF961F20C3F98F3A7CA7917 . 171008 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\srsvc.dll
[-] 2004-08-03 . 7D3E0BEB62799112F5C9FF717D72BF29 . 13824 . . [5.1.2600.2180] . . c:\windows\system32\wscntfy.exe
[-] 2004-08-03 . 7D3E0BEB62799112F5C9FF717D72BF29 . 13824 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\wscntfy.exe
[-] 2004-08-03 . 8302DE1C64618D72346DD0034DBC5D9B . 129536 . . [5.1.2600.2180] . . c:\windows\system32\xmlprov.dll
[-] 2004-08-03 . 8302DE1C64618D72346DD0034DBC5D9B . 129536 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\xmlprov.dll
[-] 2004-08-03 . B932C077D5A65B71B4512544AC404CB4 . 55808 . . [5.1.2600.2180] . . c:\windows\system32\eventlog.dll
[-] 2004-08-03 . B932C077D5A65B71B4512544AC404CB4 . 55808 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\eventlog.dll
[-] 2004-08-03 . 80F7B7198B869C07C98627AF812D68B6 . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll
[-] 2004-08-03 . 80F7B7198B869C07C98627AF812D68B6 . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\sfcfiles.dll
[-] 2004-08-03 . 7CE20569925DF6789C31799F0C538F29 . 15360 . . [5.1.2600.2180] . . c:\windows\system32\ctfmon.exe
[-] 2004-08-03 . 7CE20569925DF6789C31799F0C538F29 . 15360 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ctfmon.exe
[-] 2004-08-03 . BAC5F7F0C2B8C1B9832594851E0F9914 . 135168 . . [6.00.2900.2180] . . c:\windows\system32\shsvcs.dll
[-] 2004-08-03 . BAC5F7F0C2B8C1B9832594851E0F9914 . 135168 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\shsvcs.dll
[-] 2004-08-03 . AE81CF7D7CFA79CD03E8FB99788A7E09 . 59904 . . [5.1.2600.2180] . . c:\windows\system32\regsvc.dll
[-] 2004-08-03 . AE81CF7D7CFA79CD03E8FB99788A7E09 . 59904 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\regsvc.dll
[-] 2004-08-03 . D5E73842F38E24457C63FEF8CEFFBE19 . 192000 . . [5.1.2600.2180] . . c:\windows\system32\schedsvc.dll
[-] 2004-08-03 . D5E73842F38E24457C63FEF8CEFFBE19 . 192000 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\schedsvc.dll
[-] 2004-08-03 . 6FA03B462B2FFFE2627171B7FE73EE29 . 71680 . . [5.1.2600.2180] . . c:\windows\system32\ssdpsrv.dll
[-] 2004-08-03 . 6FA03B462B2FFFE2627171B7FE73EE29 . 71680 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ssdpsrv.dll
[-] 2004-08-03 . 1850BC10DE5DCCCEDE063FC2D0F2CEDA . 297472 . . [5.1.2600.2180] . . c:\windows\system32\termsrv.dll
[-] 2004-08-03 . 1850BC10DE5DCCCEDE063FC2D0F2CEDA . 297472 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\termsrv.dll
[-] 2004-08-03 . BECD5328E7869807D6557BE4FE60C72F . 175616 . . [5.1.2600.2180] . . c:\windows\system32\appmgmts.dll
[-] 2004-08-03 . BECD5328E7869807D6557BE4FE60C72F . 175616 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\appmgmts.dll
[-] 2001-08-18 . 9E1CA3160DAFB159CA14F83B1E317F75 . 12160 . . [5.1.2600.0] . . c:\windows\system32\drivers\acpiec.sys
[-] 2005-05-27 23:14 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . c:\windows\Driver Cache\i386\aec.sys
[-] 2005-05-27 23:14 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . c:\windows\system32\dllcache\aec.sys
[-] 2005-05-27 23:14 . 1EE7B434BA961EF845DE136224C30FEC . 142464 . . [5.1.2601.2180] . . c:\windows\system32\drivers\aec.sys
[-] 2004-08-03 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\ip6fw.sys
[-] 2004-08-03 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ip6fw.sys
[-] 2001-08-18 12:00 . 31DD27AB47F62D383505F35CA972748B . 924432 . . [4.1.6140] . . c:\windows\system32\mfc40u.dll
[-] 2001-08-18 12:00 . 31DD27AB47F62D383505F35CA972748B . 924432 . . [4.1.6140] . . c:\windows\system32\dllcache\mfc40u.dll
[-] 2004-08-03 . E5215AB942C5AC5F7EB0E54871D7A27C . 33792 . . [5.1.2600.2180] . . c:\windows\system32\msgsvc.dll
[-] 2004-08-03 . E5215AB942C5AC5F7EB0E54871D7A27C . 33792 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\msgsvc.dll
[-] 2006-10-18 19:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\mspmsnsv.dll
[-] 2006-10-18 19:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\dllcache\mspmsnsv.dll
[-] 2004-10-11 09:20 . C9BF4BC4D24A3A25E4A4894499FD9A6A . 25088 . . [10.0.3790.3650] . . c:\windows\$NtUninstallWMFDist11$\mspmsnsv.dll
[-] 2004-10-11 09:20 . C9BF4BC4D24A3A25E4A4894499FD9A6A . 25088 . . [10.0.3790.3650] . . c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}\MsPMSNSv.dll
[-] 2004-08-03 22:57 . D68CC4EBF7B03FD770D5962295AD814E . 52736 . . [9.0.1.56] . . c:\windows\RegisteredPackages\{30C7234B-6482-4A55-A11D-ECD9030313F2}$BACKUP$\System\MsPMSNSv.dll
[-] 2005-03-02 . BDFF8FFA77EE7DF9758EF8C1E0DA8EFF . 2059136 . . [5.1.2600.2622] . . c:\windows\Driver Cache\i386\ntkrnlpa.exe
[-] 2005-03-02 . BDFF8FFA77EE7DF9758EF8C1E0DA8EFF . 2059136 . . [5.1.2600.2622] . . c:\windows\system32\ntkrnlpa.exe
[-] 2005-03-02 . AE8364004BBFD70461D2EF34888D3360 . 2059264 . . [5.1.2600.2622] . . c:\windows\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
[-] 2004-08-03 22:57 . 428AA946A8D9F32DBB4260C8E6E13377 . 438272 . . [5.1.2400.2180] . . c:\windows\system32\ntmssvc.dll
[-] 2004-08-03 22:57 . 428AA946A8D9F32DBB4260C8E6E13377 . 438272 . . [5.1.2400.2180] . . c:\windows\system32\dllcache\ntmssvc.dll
[-] 2004-08-03 . 09D4A2D7C5A8ABEC227D118765FAADDF . 185856 . . [5.1.2600.2180] . . c:\windows\system32\upnphost.dll
[-] 2004-08-03 . 09D4A2D7C5A8ABEC227D118765FAADDF . 185856 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\upnphost.dll
[-] 2004-08-03 . 7DB3393F98E4211F5CE8F003DE0615CF . 367616 . . [5.3.2600.2180] . . c:\windows\system32\dsound.dll
[-] 2004-08-03 . 7DB3393F98E4211F5CE8F003DE0615CF . 367616 . . [5.3.2600.2180] . . c:\windows\system32\dllcache\dsound.dll
[-] 2004-08-03 . 20AE7889467887B869F30308EEED9A2A . 1689088 . . [5.03.2600.2180] . . c:\windows\system32\d3d9.dll
[-] 2004-08-03 . 20AE7889467887B869F30308EEED9A2A . 1689088 . . [5.03.2600.2180] . . c:\windows\system32\dllcache\d3d9.dll
[-] 2004-08-03 . CAC545A56482DE01640E6B791DE19944 . 266240 . . [5.03.2600.2180] . . c:\windows\system32\ddraw.dll
[-] 2004-08-03 . CAC545A56482DE01640E6B791DE19944 . 266240 . . [5.03.2600.2180] . . c:\windows\system32\dllcache\ddraw.dll
[-] 2004-08-03 22:57 . 1404D3DD4ED4F5E2A938B43794049A81 . 83456 . . [5.1.2600.2180] . . c:\windows\system32\olepro32.dll
[-] 2004-08-03 22:57 . 1404D3DD4ED4F5E2A938B43794049A81 . 83456 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\olepro32.dll
[-] 2004-08-03 . 007BFD01772B5202C5CE4F208A2F3F46 . 41984 . . [5.1.2600.2180] . . c:\windows\system32\perfctrs.dll
[-] 2004-08-03 . 007BFD01772B5202C5CE4F208A2F3F46 . 41984 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\perfctrs.dll
[-] 2004-08-03 . 4EF2FDC0A085C8339ED4D9C59CE8FC60 . 18944 . . [5.1.2600.2180] . . c:\windows\system32\version.dll
[-] 2004-08-03 . 4EF2FDC0A085C8339ED4D9C59CE8FC60 . 18944 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\version.dll
[-] 2004-08-03 . B39A6AF04A431E317C85BF061719E705 . 93184 . . [6.00.2900.2180] . . c:\windows\system32\dllcache\iexplore.exe
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IconOverlay1EXL580]
@="{B4834762-CF57-45AB-819D-CABE601B3C3C}"
[HKEY_CLASSES_ROOT\CLSID\{B4834762-CF57-45AB-819D-CABE601B3C3C}]
2007-04-23 09:17 596480 ----a-w- c:\windows\system32\FPAP-EXL580\FileptcIconOverlay.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"="c:\programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer" [X]
"ATICCC"="c:\programme\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 45056]
"P17Helper"="P17.dll" [2005-05-03 64512]
"CTSysVol"="c:\programme\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-02-15 57344]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"AEZBProc"="c:\ibmtools\aptezbtn\aptezbp.exe" [2001-07-24 372736]
"Omnipage"="c:\programme\ScanSoft\OmniPageSE\opware32.exe" [2002-06-03 49152]
"RTHDCPL"="RTHDCPL.EXE" [2005-06-08 14565376]
"REGSHAVE"="c:\programme\REGSHAVE\REGSHAVE.EXE" [2002-02-04 53248]
"Easy-PrintToolBox"="c:\programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2004-01-14 409600]
"LogitechCommunicationsManager"="c:\programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe" [2007-05-17 505368]
"LogitechQuickCamRibbon"="c:\programme\Logitech\QuickCam10\QuickCam10.exe" [2007-05-17 780312]
"SunJavaUpdateSched"="c:\programme\Java\jre6\bin\jusched.exe" [2009-08-04 148888]
"QuickTime Task"="c:\programme\QuickTime Alternative\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe" [2009-06-05 292136]
"avgnt"="c:\programme\Antivir Avira\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
c:\dokumente und einstellungen\Family\Startmen\Programme\Autostart\
RocketDock.exe.lnk - c:\programme\RocketDock\RocketDock.exe [2010-1-8 495616]
c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\
Catalyst System Tray.lnk - c:\programme\ATI Technologies\ATI.ACE\CLI.exe [2005-8-12 45056]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Bonjour Service"=2 (0x2)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Creative Detector"=c:\programme\Creative\MediaSource\Detector\CTDetect.exe /R
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Alcmtr"=ALCMTR.EXE
"RemoteControl"=c:\programme\PowerDVD\PDVDServ.exe
"TkBellExe"="c:\programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
"UpdReg"=c:\windows\UpdReg.EXE
"Acrobat Assistant 8.0"="c:\programme\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
R0 m5288;m5288;c:\windows\system32\drivers\m5288.sys [18.08.2006 11:59 210304]
R1 fwdrv;Firewall Driver;c:\windows\system32\drivers\fwdrv.sys [18.07.2006 12:02 284184]
R1 khips;Kerio HIPS Driver;c:\windows\system32\drivers\khips.sys [18.07.2006 12:02 91672]
R2 a2free;a-squared Free Service;c:\programme\a-squared Free\a2service.exe [29.12.2008 22:51 419448]
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Antivir Avira\Avira\AntiVir Desktop\sched.exe [03.01.2010 00:00 108289]
R3 SAA7146n;TT DVB-PCI driver (SAA7146n);c:\windows\system32\drivers\saa7146n.sys [13.09.2004 10:13 65840]
R3 TTLOOPHE;Virtual DVB-S/-C/-T Network Adapter Driver;c:\windows\system32\drivers\ttloophe.sys [08.11.2004 18:44 39284]
R3 ULI5261XP;ULi M526X Ethernet NT Driver;c:\windows\system32\drivers\ULILAN51.SYS [18.08.2006 12:02 28672]
S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys [27.05.2007 23:29 40832]
S3 silabenm;Silicon Labs CP210x USB to UART Bridge Serial Port Enumerator Driver;c:\windows\system32\drivers\silabenm.sys [27.06.2010 23:09 17920]
S3 silabser;Silicon Labs CP210x USB to UART Bridge Driver;c:\windows\system32\drivers\silabser.sys [27.06.2010 23:09 63488]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [30.06.2010 14:42 11520]
.
Inhalt des "geplante Tasks" Ordners
2010-09-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programme\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.faz.net/
IE: Append to existing PDF - c:\programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Easy-WebPrint - Drucken - c:\programme\Canon Drucker\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Easy-WebPrint - Schnelldruck - c:\programme\Canon Drucker\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint - Vorschau - c:\programme\Canon Drucker\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint - Zu Druckliste hinzufügen - c:\programme\Canon Drucker\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
AddRemove-Portable Backup_is1 - j:\backup4all\Portable Backup\unins000.exe
AddRemove-SLABCOMM&10C4&EA60 - c:\windows\system32\Silabs\DriverUninstaller.exe VCP CP210x Cardinal\SLABCOMM&10C4&EA60
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-09-28 17:07
Windows 5.1.2600 Service Pack 2 NTFS
Scanne versteckte Prozesse...
Scanne versteckte Autostarteinträge...
Scanne versteckte Dateien...
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
**************************************************************************
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
- - - - - - - > 'winlogon.exe'(828)
c:\windows\system32\Ati2evxx.dll
.
Zeit der Fertigstellung: 2010-09-28 17:10:45
ComboFix-quarantined-files.txt 2010-09-28 15:10
Vor Suchlauf: 2.487.291.904 Bytes frei
Nach Suchlauf: 2.501.853.184 Bytes frei
WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
- - End Of File - - 2870C9A5415B40B6007269D71791CFB2
|
|
| Themen zu TR/Crypt.XPACK.Gen3 backdoor/trojan |
| ad-aware, adobe, antivir, antivir guard, avira, bho, bonjour, canon, desktop, einstellungen, excel, explorer, hijack, hijackthis, hijackthis logfile, hkus\s-1-5-18, internet, internet explorer, logfile, monitor, normaler modus, object, plug-in, remote zugriff, rundll, software, taskmanager, tr/crypt.xpack.ge, tr/crypt.xpack.gen, tr/crypt.xpack.gen3, uleadburninghelper, windows, windows xp |
Linear-Darstellung
