| |
| |||||||
Log-Analyse und Auswertung: Dauert sehr lange bis sich mein Internetbrowser öffnetWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
05.02.2011, 06:24
| #16 |
 |  Dauert sehr lange bis sich mein Internetbrowser öffnetCode:
ATTFilter All processes killed
========== OTL ==========
Service stllssvr stopped successfully!
Service stllssvr deleted successfully!
File File not found not found.
Service AddFiltr stopped successfully!
Service AddFiltr deleted successfully!
File File not found not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\D3dtwain deleted successfully.
C:\Users\Markus\AppData\Roaming\D3dvis\txttab.exe moved successfully.
C:\ProgramData\{DE8EABB5-1C85-4410-A68D-79BD8A4518F4} folder moved successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Markus
->Temp folder emptied: 204991797 bytes
->Temporary Internet Files folder emptied: 55719528 bytes
->Java cache emptied: 146932 bytes
->FireFox cache emptied: 52507771 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 14896 bytes
User: Public
->Temp folder emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 10632152 bytes
RecycleBin emptied: 1126 bytes
Total Files Cleaned = 309.00 mb
OTL by OldTimer - Version 3.2.20.6 log created on 02052011_061122
Files\Folders moved on Reboot...
File\Folder C:\Windows\temp\TMP000000273151828696D42878 not found!
Registry entries deleted on Reboot...
|
|
06.02.2011, 19:56
| #17 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Dauert sehr lange bis sich mein Internetbrowser öffnet Dann bitte jetzt CF ausführen:
__________________ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
__________________ |
|
08.02.2011, 06:28
| #18 |
| | Dauert sehr lange bis sich mein Internetbrowser öffnet Hi Arne, hie das combofix-logfile. Kurze Anmerkung, mein AntiVir-Guard
__________________(das Schirmchen) lässt sich immer noch nicht aktivieren bzw. öffnen. Bin momentan also nur sicherheitshalber auf meiner gmx- und der trojaner- board-seite. Code:
ATTFilter ComboFix 11-02-06.02 - Markus 07/02/2011 19:16:16.3.1 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.1013.227 [GMT 1:00]
Running from: c:\users\Markus\Downloads\ComboFix.exe
AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((( Files Created from 2011-01-07 to 2011-02-07 )))))))))))))))))))))))))))))))
.
2011-02-07 18:31 . 2011-02-07 18:31 -------- d-----w- c:\users\Public\AppData\Local\temp
2011-02-07 18:31 . 2011-02-07 18:31 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-02-07 18:10 . 2011-02-07 18:11 -------- d-----w- C:\32788R22FWJFW
2011-02-05 04:56 . 2011-02-05 04:56 -------- d-----w- C:\_OTL
2011-02-04 06:22 . 2011-01-13 09:41 5890896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{093EF4AE-5790-4D29-853A-9F1A7E6D9173}\mpengine.dll
2011-02-02 16:15 . 2010-12-20 17:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-02-02 16:15 . 2010-12-20 17:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-02-02 16:15 . 2011-02-02 20:40 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-01-31 20:03 . 2011-01-31 20:03 -------- d-----w- c:\users\Markus\AppData\Roaming\Uniblue
2011-01-31 20:02 . 2011-01-31 20:02 -------- d-----w- c:\program files\Uniblue
2011-01-31 20:02 . 2011-01-31 20:02 -------- d-----w- c:\users\Markus\AppData\Local\PackageAware
2011-01-30 16:58 . 2011-01-30 17:08 -------- d-----w- c:\programdata\REPORTS
2011-01-30 16:58 . 2011-01-30 17:02 -------- d-----w- c:\programdata\LOGFILES
2011-01-30 16:58 . 2011-01-30 16:58 -------- d-----w- c:\programdata\INFECTED
2011-01-28 05:57 . 2011-02-05 05:11 -------- d-----w- c:\users\Markus\AppData\Roaming\D3dvis
2011-01-12 19:33 . 2010-12-28 15:55 413696 ----a-w- c:\windows\system32\odbc32.dll
2011-01-12 19:33 . 2010-12-28 15:53 253952 ----a-w- c:\program files\Common Files\System\ado\msadox.dll
2011-01-12 19:33 . 2010-12-28 15:53 241664 ----a-w- c:\program files\Common Files\System\ado\msadomd.dll
2011-01-12 19:33 . 2010-12-28 15:53 708608 ----a-w- c:\program files\Common Files\System\ado\msado15.dll
2011-01-12 19:33 . 2010-12-28 15:53 57344 ----a-w- c:\program files\Common Files\System\msadc\msadcs.dll
2011-01-12 19:33 . 2010-12-28 15:53 180224 ----a-w- c:\program files\Common Files\System\msadc\msadco.dll
2011-01-12 19:33 . 2010-12-14 14:49 1169408 ----a-w- c:\windows\system32\sdclt.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-22 21:39 . 2009-03-19 07:26 135096 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-11-23 09:51 . 2009-03-19 07:26 61960 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-11-22 08:31 . 2010-11-22 08:31 94848 ----a-w- C:\uwldapow.sys
2010-11-12 17:53 . 2010-11-23 13:33 472808 ----a-w- c:\windows\system32\deployJava1.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"RegistryBooster"="c:\program files\Uniblue\RegistryBooster\launcher.exe" [2011-01-21 67456]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-15 815104]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-11-06 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-11-06 106496]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-11-06 81920]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2006-11-10 46704]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 116040]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-05-27 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-30 289064]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-09 281768]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-03-31 202256]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-01 1164584]
" Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-11-09 135336]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate1c9deaa14fed3cc;Google Update Service (gupdate1c9deaa14fed3cc);c:\program files\Google\Update\GoogleUpdate.exe [2009-05-27 133104]
R3 iatmunin;iatmunin;c:\users\Pim\AppData\Local\Temp\iatmunin.sys [x]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
2011-02-07 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-04-30 10:30]
2011-02-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-27 09:02]
2011-02-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-27 09:02]
2011-02-07 c:\windows\Tasks\RegistryBooster.job
- c:\program files\Uniblue\RegistryBooster\rbmonitor.exe [2011-01-21 14:19]
2011-02-07 c:\windows\Tasks\User_Feed_Synchronization-{0798338A-4626-44DD-9D57-0FE79EFEF1D8}.job
- c:\windows\system32\msfeedssync.exe [2010-12-15 04:25]
2010-11-12 c:\windows\Tasks\User_Feed_Synchronization-{52C964EE-F448-412B-8FE7-0550962111FD}.job
- c:\windows\system32\msfeedssync.exe [2010-12-15 04:25]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.de/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=71&bd=PRESARIO&pf=laptop
mSearchMigratedDefaultURL = hxxp://www.Google.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\6ywjg3vy.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Yahoo! Toolbar: {635abd67-4fe9-1b23-4f01-e679fa7484c1} - %profile%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-WAWifiMessage - %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
HKLM-Run-hpWirelessAssistant - %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
AddRemove-CCleaner - c:\users\Markus\Desktop\CCleaner\uninst.exe
AddRemove-Uniblue RegistryBooster - c:\programdata\{DE8EABB5-1C85-4410-A68D-79BD8A4518F4}\rbia.exe
AddRemove-{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA} - c:\programdata\{DE8EABB5-1C85-4410-A68D-79BD8A4518F4}\rbia.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-02-07 19:32
Windows 6.0.6002 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
c:\users\Markus\AppData\Local\Temp\catchme.dll 53248 bytes executable
scan completed successfully
hidden files: 1
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2011-02-07 19:40:48
ComboFix-quarantined-files.txt 2011-02-07 18:40
Pre-Run: 33,958,313,984 bytes free
Post-Run: 33,824,866,304 bytes free
- - End Of File - - 7E79A352BB2851A829F754205BA18CF0
|
|
08.02.2011, 09:32
| #19 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Dauert sehr lange bis sich mein Internetbrowser öffnet Combofix - Scripten 1. Starte das Notepad (Start / Ausführen / notepad[Enter]) 2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein. Code:
ATTFilter File::
c:\users\Pim\AppData\Local\Temp\iatmunin.sys
Driver::
iatmunin
4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall. (Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !) 5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.  6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien: Combofix.txt Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
08.02.2011, 20:13
| #20 |
| | Dauert sehr lange bis sich mein Internetbrowser öffnetCode:
ATTFilter ComboFix 11-02-07.05 - Markus 08/02/2011 16:54:09.4.1 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.1013.353 [GMT 1:00]
Running from: c:\users\Markus\Desktop\ComboFix.exe
Command switches used :: c:\users\Markus\Desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FILE ::
"c:\users\Pim\AppData\Local\Temp\iatmunin.sys"
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_IATMUNIN
-------\Service_iatmunin
((((((((((((((((((((((((( Files Created from 2011-01-08 to 2011-02-08 )))))))))))))))))))))))))))))))
.
2011-02-08 16:09 . 2011-02-08 16:09 -------- d-----w- c:\users\Public\AppData\Local\temp
2011-02-08 16:09 . 2011-02-08 16:09 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-02-05 04:56 . 2011-02-05 04:56 -------- d-----w- C:\_OTL
2011-02-04 06:22 . 2011-01-13 09:41 5890896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{093EF4AE-5790-4D29-853A-9F1A7E6D9173}\mpengine.dll
2011-02-02 16:15 . 2010-12-20 17:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-02-02 16:15 . 2010-12-20 17:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-02-02 16:15 . 2011-02-02 20:40 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-01-31 20:03 . 2011-01-31 20:03 -------- d-----w- c:\users\Markus\AppData\Roaming\Uniblue
2011-01-31 20:02 . 2011-01-31 20:02 -------- d-----w- c:\program files\Uniblue
2011-01-31 20:02 . 2011-01-31 20:02 -------- d-----w- c:\users\Markus\AppData\Local\PackageAware
2011-01-30 16:58 . 2011-01-30 17:08 -------- d-----w- c:\programdata\REPORTS
2011-01-30 16:58 . 2011-01-30 17:02 -------- d-----w- c:\programdata\LOGFILES
2011-01-30 16:58 . 2011-01-30 16:58 -------- d-----w- c:\programdata\INFECTED
2011-01-28 05:57 . 2011-02-05 05:11 -------- d-----w- c:\users\Markus\AppData\Roaming\D3dvis
2011-01-12 19:33 . 2010-12-28 15:55 413696 ----a-w- c:\windows\system32\odbc32.dll
2011-01-12 19:33 . 2010-12-28 15:53 253952 ----a-w- c:\program files\Common Files\System\ado\msadox.dll
2011-01-12 19:33 . 2010-12-28 15:53 241664 ----a-w- c:\program files\Common Files\System\ado\msadomd.dll
2011-01-12 19:33 . 2010-12-28 15:53 708608 ----a-w- c:\program files\Common Files\System\ado\msado15.dll
2011-01-12 19:33 . 2010-12-28 15:53 57344 ----a-w- c:\program files\Common Files\System\msadc\msadcs.dll
2011-01-12 19:33 . 2010-12-28 15:53 180224 ----a-w- c:\program files\Common Files\System\msadc\msadco.dll
2011-01-12 19:33 . 2010-12-14 14:49 1169408 ----a-w- c:\windows\system32\sdclt.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-22 21:39 . 2009-03-19 07:26 135096 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-11-23 09:51 . 2009-03-19 07:26 61960 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-11-22 08:31 . 2010-11-22 08:31 94848 ----a-w- C:\uwldapow.sys
2010-11-12 17:53 . 2010-11-23 13:33 472808 ----a-w- c:\windows\system32\deployJava1.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"RegistryBooster"="c:\program files\Uniblue\RegistryBooster\launcher.exe" [2011-01-21 67456]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-15 815104]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-11-06 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-11-06 106496]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-11-06 81920]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2006-11-10 46704]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 116040]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-05-27 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-30 289064]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-09 281768]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-03-31 202256]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-01 1164584]
" Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-11-09 135336]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate1c9deaa14fed3cc;Google Update Service (gupdate1c9deaa14fed3cc);c:\program files\Google\Update\GoogleUpdate.exe [2009-05-27 133104]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
2011-02-08 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-04-30 10:30]
2011-02-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-27 09:02]
2011-02-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-27 09:02]
2011-02-08 c:\windows\Tasks\RegistryBooster.job
- c:\program files\Uniblue\RegistryBooster\rbmonitor.exe [2011-01-21 14:19]
2011-02-08 c:\windows\Tasks\User_Feed_Synchronization-{0798338A-4626-44DD-9D57-0FE79EFEF1D8}.job
- c:\windows\system32\msfeedssync.exe [2010-12-15 04:25]
2010-11-12 c:\windows\Tasks\User_Feed_Synchronization-{52C964EE-F448-412B-8FE7-0550962111FD}.job
- c:\windows\system32\msfeedssync.exe [2010-12-15 04:25]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.de/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=71&bd=PRESARIO&pf=laptop
mSearchMigratedDefaultURL = hxxp://www.Google.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\6ywjg3vy.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Yahoo! Toolbar: {635abd67-4fe9-1b23-4f01-e679fa7484c1} - %profile%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-02-08 19:46
Windows 6.0.6002 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\LEXBCES.EXE
c:\windows\System32\LEXPPS.EXE
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\system32\conime.exe
c:\windows\ehome\ehmsas.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2011-02-08 19:54:40 - machine was rebooted
ComboFix-quarantined-files.txt 2011-02-08 18:54
ComboFix2.txt 2011-02-07 18:40
Pre-Run: 32,949,858,304 bytes free
Post-Run: 33,356,500,992 bytes free
- - End Of File - - FFE246CDE9B03FD88AD439F43F55922F
|
|
08.02.2011, 20:26
| #21 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Dauert sehr lange bis sich mein Internetbrowser öffnet Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen. Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst. Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
__________________ --> Dauert sehr lange bis sich mein Internetbrowser öffnet |
|
09.02.2011, 17:17
| #22 |
| | Dauert sehr lange bis sich mein Internetbrowser öffnet Hi Arne, hattest Recht, GMER ist zweimal abgeschmiert. Nun zu diesem ominösen OSAM, wenn ich es von dem vorgegebenen link runterladen möchte, dann in Verbindung mit dem Windows Media Player... Kann dass denn sein oder bin ich mal wieder einfach nur zu doof???  Gruss masi76 |
|
10.02.2011, 10:24
| #23 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Dauert sehr lange bis sich mein Internetbrowser öffnet Nimm diesen Ersatzlink für OSAM => File-Upload.net - osam.zip
__________________ Logfiles bitte immer in CODE-Tags posten |
|
10.02.2011, 19:36
| #24 |
| | Dauert sehr lange bis sich mein Internetbrowser öffnet Hi Arne, der Download soweit so gut... Und dann...??? Zip hin Zip her... Bin kurz davor mein Laptob aus dem Fenster zu werfen, das einzige was mir noch Hoffnung gibt, habe mit Euch schon schwierigere Dinge bewältigt... |
|
10.02.2011, 20:14
| #25 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Dauert sehr lange bis sich mein Internetbrowser öffnet Ich versteh nicht, welches Problem du hast. 
__________________ Logfiles bitte immer in CODE-Tags posten |
|
11.02.2011, 06:59
| #26 |
| | Dauert sehr lange bis sich mein Internetbrowser öffnetCode:
ATTFilter Report of OSAM: Autorun Manager v5.0.11926.0 hxxp://www.online-solutions.ru/en/ Saved at 06:57:49 on 11.02.2011 OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit Default Browser: Mozilla Corporation Firefox 3.5.16 Scanner Settings [x] Rootkits detection (hidden registry) [x] Rootkits detection (hidden files) [x] Retrieve files information [x] Check Microsoft signatures Filters [ ] Trusted entries [ ] Empty entries [x] Hidden registry entries (rootkit activity) [x] Exclusively opened files [x] Not found files [x] Files without detailed information [x] Existing files [ ] Non-startable services [ ] Non-startable drivers [x] Active entries [x] Disabled entries [Common] -----( %SystemRoot%\Tasks )----- "Google Software Updater.job" - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe "GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe "GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe "RegistryBooster.job" - "Uniblue Systems Limited" - C:\Program Files\Uniblue\RegistryBooster\rbmonitor.exe [Control Panel Objects] -----( %SystemRoot%\system32 )----- "DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\Windows\system32\DivXControlPanelApplet.cpl -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )----- "QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl [Drivers] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "avgio" (avgio) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avgio.sys "avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys "avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys "catchme" (catchme) - ? - C:\ComboFix\catchme.sys (File not found) "IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys (File not found) "IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys (File not found) "IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys (File not found) "PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\Windows\System32\Drivers\PxHelp20.sys "ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys "upperdev" (upperdev) - ? - C:\Windows\System32\DRIVERS\usbser_lowerflt.sys (File not found) [Explorer] -----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )----- {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll -----( HKLM\Software\Classes\Protocols\Filter )----- {807553E5-5146-11D5-A672-00B0D022E945} "text/xml" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL -----( HKLM\Software\Classes\Protocols\Handler )----- {32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL {3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL {0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )----- {AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? - (File not found | COM-object registry key not found) -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )----- {911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? - (File not found | COM-object registry key not found) {1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? - (File not found | COM-object registry key not found) {34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? - (File not found | COM-object registry key not found) {0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? - (File not found | COM-object registry key not found) {2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? - (File not found | COM-object registry key not found) {6872d785-fe43-44cb-9b2a-2df4c5eb13b2} "HotShellExt" - ? - C:\Program Files\eFax Messenger 4.3\J2GShell.dll (File not found) {FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? - (File not found | COM-object registry key not found) {B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll {42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\OFFICE11\msohev.dll {00020d75-0000-0000-c000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\OFFICE11\MLSHEXT.DLL {0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\OFFICE11\OLKFSTUB.DLL {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - c:\program files\real\realplayer\rpshell.dll {C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? - (File not found | COM-object registry key not found) {E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? - (File not found | COM-object registry key not found) {45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll {7F67036B-66F1-411A-AD85-759FB9C5B0DB} "ShellViewRTF" - "XSS" - C:\Windows\System32\ShellvRTF.dll {BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Web Folders" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL {da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? - (File not found | COM-object registry key not found) [Internet Explorer] -----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )----- <binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found) -----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )----- {8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_23" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} "Java Plug-in 1.6.0_23" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_23" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_23.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} "{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}" - ? - (File not found | COM-object registry key not found) / hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )----- "PDFill PDF Editor" - "PlotSoft LLC" - C:\Program Files\PlotSoft\PDFill\DownloadPDF.exe {FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )----- {98889811-442D-49dd-99D7-DC866BE87DBC} "Babylon Toolbar" - "Babylon Ltd." - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.14\BabylonToolbarTlbr.dll {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} "facemoods Toolbar" - "facemoods.com" - C:\Program Files\facemoods.com\facemoods\1.4.17.4\facemoodsTlbr.dll <binary data> "SweetIM Toolbar for Internet Explorer" - "SweetIM Technologies Ltd." - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )----- {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll {2EECD738-5844-4a99-B4B6-146BF802613B} "CescrtHlpr Object" - "Babylon BHO" - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.14\bh\BabylonToolbar.dll {64182481-4F71-486b-A045-B233BD0DA8FC} "CescrtHlpr Object" - "facemoods.com BHO" - C:\Program Files\facemoods.com\facemoods\1.4.17.4\bh\facemoods.dll {AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - c:\program files\google\googletoolbar2.dll {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll {DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll {3049C3E9-B461-4BC5-8870-4C09146192CA} "RealPlayer Download and Record Plugin for Internet Explorer" - "RealPlayer" - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll {EEE6C35C-6118-11DC-9C72-001320C79847} "SweetIM Toolbar Helper" - "SweetIM Technologies Ltd." - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll [Logon] -----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )----- "desktop.ini" - ? - C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini -----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )----- "desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini -----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )----- "RegistryBooster" - "Uniblue Systems Limited" - "C:\Program Files\Uniblue\RegistryBooster\launcher.exe" delay 20000 -----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )----- "StartupPrograms" - ? - rdpclip (File not found) -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )----- "Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" "AppleSyncNotifier" - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe "avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min "BabylonToolbar" - "Babylon Ltd." - "C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.14\BabylonToolbarsrv.exe" /md I "DivXUpdate" - ? - "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW "facemoods" - "facemoods.com" - "C:\Program Files\facemoods.com\facemoods\1.4.17.4\facemoodssrv.exe" /md I "HP Health Check Scheduler" - "Hewlett-Packard" - C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe "iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe" " Malwarebytes Anti-Malware (reboot)" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript "QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime "SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe" "SweetIM" - "SweetIM Technologies Ltd." - C:\Program Files\SweetIM\Messenger\SweetIM.exe "TkBellExe" - "RealNetworks, Inc." - "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot [Print Monitors] -----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )----- "CUSTPDF Writer Monitor" - ? - C:\Windows\system32\custmon2k.dll (File found, but it contains no detailed information) "Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\Windows\system32\mdimon.dll "PCL hpz3l4v2" - "Hewlett-Packard Company" - C:\Windows\system32\hpz3l4v2.dll "Redmon" - ? - C:\Windows\system32\redmonnt.dll (File found, but it contains no detailed information) [Services] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe "Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe "Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe "Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe "Google Software Updater" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe "Google Update Service (gupdate1c9deaa14fed3cc)" (gupdate1c9deaa14fed3cc) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe "HP Health Check Service" (HP Health Check Service) - "Hewlett-Packard" - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe "hpqwmiex" (hpqwmiex) - "Hewlett-Packard Development Company, L.P." - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe "InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files\Roxio\Roxio MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe "iPod Service" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe "Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe "Net Driver HPZ12" (Net Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZinw12.dll "Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE "Pml Driver HPZ12" (Pml Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZipm12.dll "RoxMediaDB9" (RoxMediaDB9) - "Sonic Solutions" - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe "ServiceLayer" (ServiceLayer) - "Nokia." - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe ===[ Logfile end ]=========================================[ Logfile end ]=== If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru |
|
11.02.2011, 07:03
| #27 |
| | Dauert sehr lange bis sich mein Internetbrowser öffnetCode:
ATTFilter MBRCheck, version 1.2.3
(c) 2010, AD
Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer: Hewlett-Packard
BIOS Manufacturer: Hewlett-Packard
System Manufacturer: Hewlett-Packard
System Product Name: Presario C500 (RT154EA#ABU)
Logical Drives Mask: 0x0000001c
Kernel Drivers (total 148):
0x82200000 \SystemRoot\system32\ntkrnlpa.exe
0x825BA000 \SystemRoot\system32\hal.dll
0x80401000 \SystemRoot\system32\kdcom.dll
0x80408000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x80478000 \SystemRoot\system32\PSHED.dll
0x80489000 \SystemRoot\system32\BOOTVID.dll
0x80491000 \SystemRoot\system32\CLFS.SYS
0x804D2000 \SystemRoot\system32\CI.dll
0x80608000 \SystemRoot\system32\drivers\Wdf01000.sys
0x80684000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x80691000 \SystemRoot\system32\drivers\acpi.sys
0x806D7000 \SystemRoot\system32\drivers\WMILIB.SYS
0x806E0000 \SystemRoot\system32\drivers\msisadrv.sys
0x806E8000 \SystemRoot\system32\drivers\pci.sys
0x8070F000 \SystemRoot\System32\drivers\partmgr.sys
0x8071E000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x80721000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x8072B000 \SystemRoot\system32\drivers\volmgr.sys
0x8073A000 \SystemRoot\System32\drivers\volmgrx.sys
0x80784000 \SystemRoot\system32\drivers\intelide.sys
0x8078B000 \SystemRoot\system32\drivers\PCIIDEX.SYS
0x80799000 \SystemRoot\System32\drivers\mountmgr.sys
0x807A9000 \SystemRoot\system32\drivers\atapi.sys
0x807B1000 \SystemRoot\system32\drivers\ataport.SYS
0x807CF000 \SystemRoot\system32\drivers\msahci.sys
0x805B2000 \SystemRoot\system32\drivers\fltmgr.sys
0x807D9000 \SystemRoot\system32\drivers\fileinfo.sys
0x807E9000 \SystemRoot\System32\Drivers\PxHelp20.sys
0x82C01000 \SystemRoot\System32\Drivers\ksecdd.sys
0x82C72000 \SystemRoot\system32\drivers\ndis.sys
0x82D7D000 \SystemRoot\system32\drivers\msrpc.sys
0x82DA8000 \SystemRoot\system32\drivers\NETIO.SYS
0x82E0A000 \SystemRoot\System32\drivers\tcpip.sys
0x82EF4000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x86404000 \SystemRoot\System32\Drivers\Ntfs.sys
0x86514000 \SystemRoot\system32\drivers\volsnap.sys
0x8654D000 \SystemRoot\System32\Drivers\spldr.sys
0x86555000 \SystemRoot\System32\Drivers\mup.sys
0x86564000 \SystemRoot\System32\drivers\ecache.sys
0x8658B000 \SystemRoot\system32\drivers\disk.sys
0x8659C000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x865BD000 \SystemRoot\system32\drivers\crcdisk.sys
0x865E8000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x865F3000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x82F0F000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x865FC000 \SystemRoot\system32\DRIVERS\cpqbttn.sys
0x82F1E000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x82F2E000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x82F35000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x89E0E000 \SystemRoot\system32\DRIVERS\igdkmd32.sys
0x8A4BC000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8A55C000 \SystemRoot\System32\drivers\watchdog.sys
0x8A568000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x82F3E000 \SystemRoot\system32\DRIVERS\bcmwl6.sys
0x8A5F5000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x8A606000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8A644000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8A653000 \SystemRoot\system32\DRIVERS\Rtnicxp.sys
0x8A664000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x8A668000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x8A67B000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x8A686000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x8A6B1000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x8A6B3000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x8A6BE000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8A6D6000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
0x8A6D9000 \SystemRoot\system32\DRIVERS\serscan.sys
0x8A6E1000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8A710000 \SystemRoot\system32\DRIVERS\storport.sys
0x8A751000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8A75C000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x8A773000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x8A77E000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x8A7A1000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x8A7B0000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x8A7C4000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x8A7D9000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8A7E9000 \SystemRoot\system32\DRIVERS\swenum.sys
0x82FC4000 \SystemRoot\system32\DRIVERS\ks.sys
0x8A7EB000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x89E00000 \SystemRoot\system32\DRIVERS\umbus.sys
0x8A7F5000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x8AA09000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x8AA3E000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x8AA4F000 \SystemRoot\system32\drivers\CHDART.sys
0x8AA78000 \SystemRoot\system32\drivers\portcls.sys
0x8AAA5000 \SystemRoot\system32\drivers\drmk.sys
0x8AACA000 \SystemRoot\system32\DRIVERS\HSXHWAZL.sys
0x8AE0B000 \SystemRoot\system32\DRIVERS\HSX_DPV.sys
0x8AF0E000 \SystemRoot\system32\DRIVERS\HSX_CNXT.sys
0x8AFC2000 \SystemRoot\system32\drivers\modem.sys
0x8AFCF000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x8AFD8000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x8AFE0000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x8AFE9000 \SystemRoot\System32\Drivers\Null.SYS
0x8AFF0000 \SystemRoot\System32\Drivers\Beep.SYS
0x8AB07000 \SystemRoot\System32\drivers\vga.sys
0x8AB13000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8AFF7000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8AE00000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8AB34000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8AB3F000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8AB4D000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x8AB56000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8AB6C000 \SystemRoot\system32\DRIVERS\smb.sys
0x8AB80000 \SystemRoot\system32\drivers\afd.sys
0x8ABC8000 \SystemRoot\System32\DRIVERS\netbt.sys
0x82DE3000 \SystemRoot\system32\DRIVERS\pacer.sys
0x82FEE000 \SystemRoot\system32\DRIVERS\netbios.sys
0x805E4000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x8ABFA000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0x8B206000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8B242000 \SystemRoot\system32\drivers\nsiproxy.sys
0x8B24C000 \SystemRoot\System32\Drivers\dfsc.sys
0x8B263000 \SystemRoot\system32\DRIVERS\avipbb.sys
0x8B289000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys
0x8B28B000 \SystemRoot\System32\Drivers\crashdmp.sys
0x8B298000 \SystemRoot\System32\Drivers\dump_dumpata.sys
0x8B2A3000 \SystemRoot\System32\Drivers\dump_msahci.sys
0x92C70000 \SystemRoot\System32\win32k.sys
0x8B2AD000 \SystemRoot\System32\drivers\Dxapi.sys
0x8B2B7000 \SystemRoot\system32\DRIVERS\monitor.sys
0x92E90000 \SystemRoot\System32\TSDDD.dll
0x92EB0000 \SystemRoot\System32\cdd.dll
0x8B2C6000 \SystemRoot\system32\drivers\luafv.sys
0x8B2E1000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0x8B2FE000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x8B30E000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x8B338000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x8B342000 \SystemRoot\system32\DRIVERS\rspndr.sys
0xA6406000 \SystemRoot\system32\drivers\spsys.sys
0xA64B6000 \SystemRoot\system32\drivers\HTTP.sys
0xA6523000 \SystemRoot\System32\DRIVERS\srvnet.sys
0xA6540000 \SystemRoot\system32\DRIVERS\bowser.sys
0xA6559000 \SystemRoot\System32\drivers\mpsdrv.sys
0xA656E000 \SystemRoot\system32\drivers\mrxdav.sys
0xA658F000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xA65AE000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0xA65E7000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x8B355000 \SystemRoot\System32\DRIVERS\srv2.sys
0x8B37D000 \SystemRoot\System32\DRIVERS\srv.sys
0xA6400000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0xAB40E000 \SystemRoot\system32\drivers\peauth.sys
0xAB4EC000 \SystemRoot\System32\Drivers\secdrv.SYS
0xAB4F6000 \SystemRoot\System32\drivers\tcpipreg.sys
0xAB502000 \SystemRoot\system32\DRIVERS\xaudio.sys
0xAB50A000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x77250000 \Windows\System32\ntdll.dll
Processes (total 62):
0 System Idle Process
4 System
380 C:\Windows\System32\smss.exe
432 csrss.exe
484 C:\Windows\System32\wininit.exe
492 csrss.exe
540 C:\Windows\System32\winlogon.exe
560 C:\Windows\System32\services.exe
576 C:\Windows\System32\lsass.exe
584 C:\Windows\System32\lsm.exe
748 C:\Windows\System32\svchost.exe
816 C:\Windows\System32\svchost.exe
852 C:\Windows\System32\svchost.exe
940 C:\Windows\System32\svchost.exe
1012 C:\Windows\System32\svchost.exe
1024 C:\Windows\System32\svchost.exe
1104 C:\Windows\System32\audiodg.exe
1124 C:\Windows\System32\svchost.exe
1144 C:\Windows\System32\SLsvc.exe
1172 C:\Windows\System32\svchost.exe
1332 C:\Windows\System32\svchost.exe
1560 C:\Windows\System32\LEXBCES.EXE
1604 C:\Windows\System32\spoolsv.exe
1612 C:\Windows\System32\LEXPPS.EXE
1688 C:\Windows\System32\svchost.exe
1968 C:\Windows\System32\dwm.exe
2008 C:\Windows\explorer.exe
2020 C:\Windows\System32\taskeng.exe
404 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
420 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
480 C:\Windows\System32\igfxtray.exe
552 C:\Windows\System32\hkcmd.exe
372 C:\Windows\System32\igfxpers.exe
920 C:\Program Files\iTunes\iTunesHelper.exe
1060 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
1136 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
744 C:\Windows\System32\svchost.exe
1296 C:\Program Files\DivX\DivX Update\DivXUpdate.exe
624 C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
1696 C:\Program Files\Common Files\Java\Java Update\jusched.exe
980 C:\Program Files\SweetIM\Messenger\SweetIM.exe
1436 C:\Program Files\Windows Sidebar\sidebar.exe
448 C:\Windows\ehome\ehtray.exe
2116 C:\Windows\System32\svchost.exe
2156 C:\Windows\System32\svchost.exe
2188 C:\Windows\System32\svchost.exe
2240 C:\Windows\System32\svchost.exe
2300 C:\Windows\System32\svchost.exe
2360 C:\Windows\System32\SearchIndexer.exe
2436 C:\Windows\System32\drivers\XAudio.exe
2456 C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
2928 C:\Windows\System32\taskeng.exe
2960 C:\Windows\System32\taskeng.exe
2968 C:\Program Files\Uniblue\RegistryBooster\rbmonitor.exe
3380 C:\Windows\ehome\ehmsas.exe
3768 C:\Program Files\iPod\bin\iPodService.exe
3968 C:\Windows\System32\svchost.exe
1944 C:\Program Files\Mozilla Firefox\firefox.exe
3248 C:\Windows\System32\SearchProtocolHost.exe
3364 C:\Windows\System32\SearchFilterHost.exe
2568 C:\Windows\System32\conime.exe
2072 C:\Users\Markus\Desktop\MBRCheck.exe
\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000011`5a4a4a00 (NTFS)
PhysicalDrive0 Model Number: ST98823AS, Rev: 7.24
Size Device Name MBR Status
--------------------------------------------
74 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: D94F393960D1CD66C2071F2D7260A5196DF105AC
Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:
Done!
|
|
11.02.2011, 07:08
| #28 |
| | Dauert sehr lange bis sich mein Internetbrowser öffnet Jetzt hat alles geklappt. Habe seit ich eben meinen laptob hochgefahren habe, nicht mehr meine Google-Start-Standartseite sondern dieses elendige Babylon mit all den unsinnigen icon... Habe beim Osam-Scan auch gesehen, dass er dieses als "gefährdend" eingestuft hat... Gruss masi76 |
|
11.02.2011, 09:26
| #29 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Dauert sehr lange bis sich mein Internetbrowser öffnetZitat:
Wenn nicht: Schau mal hier => Vista Notfall/Recovery-CD 32-Bit - Dr. Windows Lad das iso runter, brenn es zB mit ImgBurn per Imagebrennfunktion auf eine CD und starte damit den Rechner (von dieser CD booten). Falls Du eine normale Vista-Installations-DVD hast, brauchst Du das o.g. Image nicht sondern kannst einfach von der Vista-DVD booten. Klick auf Computerreparaturoptionen, weiter, Eingabeaufforderung - die Konsole öffnet sich. Da bitte bootrec.exe /fixboot eintippen (mit enter bestätigen), dann bootrec.exe /fixmbr eintippen (mit enter bestätigen) - Rechner neustarten, CD vorher rausnehmen.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
16.02.2011, 07:12
| #30 |
| | Dauert sehr lange bis sich mein Internetbrowser öffnet Hi Arne, gibt´s noch andere Möglichkeiten, wie wir weiter verfahren können? Gruss masi76 |
|
| Themen zu Dauert sehr lange bis sich mein Internetbrowser öffnet |
| browser, dauert, firefox, gefunde, inter, interne, internetbrowser, lange, langsamer, laufe, laufen, malwarebytes, minute, minuten, mozilla, mozilla firefox, prüfen, tagen, versteckt, öffnet |
Linear-Darstellung
