| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: TR/Crypt.XPACK.Gen und TR/BegSMS.AWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
14.03.2011, 13:55
| #1 | ||||||||
 |  TR/Crypt.XPACK.Gen und TR/BegSMS.A Hallo alle zusammen, Dies ist mein erstes Thema und ich hoffe, daß ich nichts falsch gemacht habe! Ich habe gestern von Avira die Meldung über diese Trojaner erhalten. Ich habe hier im Forum einiges gelesen und versucht es nachzuvollziehen. Leider habe ich nicht alles verstanden. Ich bin leider PC-mäßig ziemlich unbedarft, nur Anwender halt. Hier die Meldungen von Avira: Zitat:
Zitat:
Zitat:
Zitat:
Zitat:
Zitat:
Zitat:
Zitat:
OTL EXTRAS Logfile: Code:
ATTFilter OTL Extras logfile created on: 13.03.2011 20:27:27 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Programme
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
511,00 Mb Total Physical Memory | 116,00 Mb Available Physical Memory | 23,00% Memory free
1,00 Gb Paging File | 1,00 Gb Available in Paging File | 67,00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 31,52 Gb Total Space | 9,50 Gb Free Space | 30,13% Space Free | Partition Type: NTFS
Drive D: | 43,01 Gb Total Space | 6,45 Gb Free Space | 14,99% Space Free | Partition Type: NTFS
Drive F: | 298,02 Gb Total Space | 168,98 Gb Free Space | 56,70% Space Free | Partition Type: FAT32
Computer Name: MERCIERXP | User Name: Mercier | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.js [@ = JSFile] -- C:\Programme\Macromedia\Dreamweaver UltraDev 4\UltraDev.exe (Macromedia, Inc.)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
jsfile [open] -- "C:\Programme\Macromedia\Dreamweaver UltraDev 4\UltraDev.exe" "%1" (Macromedia, Inc.)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [FinePix] -- "C:\Programme\FinePixViewer\FinePixViewer.exe" "%1" (FUJIFILM Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"1723:TCP" = 1723:TCP:*:Enabled:@xpsp2res.dll,-22015
"1701:UDP" = 1701:UDP:*:Enabled:@xpsp2res.dll,-22016
"500:UDP" = 500:UDP:*:Enabled:@xpsp2res.dll,-22017
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1723:TCP" = 1723:TCP:*:Enabled:@xpsp2res.dll,-22015
"1701:UDP" = 1701:UDP:*:Enabled:@xpsp2res.dll,-22016
"500:UDP" = 500:UDP:*:Enabled:@xpsp2res.dll,-22017
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\SiSoftware\SiSoftware Sandra Lite 2009.SP2\WNt500x86\RpcSandraSrv.exe" = C:\Programme\SiSoftware\SiSoftware Sandra Lite 2009.SP2\WNt500x86\RpcSandraSrv.exe:*:Enabled:SiSoftware Sandra Agent Service
"C:\WINDOWS\twain_32\L12U16U2\SrvMod.exe" = C:\WINDOWS\twain_32\L12U16U2\SrvMod.exe:*:Enabled:SrvMod -- (NetWork Scanner)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{04830D0F-F980-4EC0-89F1-594F2FD2A1B5}" = ElsterFormular 2008/2009
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{06975C39-08ED-4D88-9F66-E12C8C146593}" = DATA BECKER Graphic Works 5
"{09DA4F91-2A09-4232-AB8C-6BC740096DE3}" = Sonic Update Manager
"{0EEF7BD5-5A7B-4101-B105-51266A51EDB9}" = No23Live
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime
"{22B0E143-2B0B-435B-9F56-136A3D16065F}" = No23 Recorder
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{24D20EF7-2066-42A8-91DB-952636384E42}" = AquaSoft PhotoKalender
"{24ED4D80-8294-11D5-96CD-0040266301AD}" = FinePixViewer Ver.5.4
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 13
"{34F93E31-E1A0-421C-8E86-BCF7C4193A91}" = LogMeIn
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{43602F34-1AA3-44FB-AEB2-D08C2C73743F}" = Paint.NET v3.36
"{5490882C-6961-11D5-BAE5-00E0188E010B}" = FUJIFILM USB Driver
"{5E835305-63BB-4E55-BBB7-EEBBE67774DB}" = MyDVD
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{8855FF30-19CE-4CB1-A654-87B38369CCE1}" = Sonic RecordNow DX
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (German) 12
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISER_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISER_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISER_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISER_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISER_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISER_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISER_{2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISER_{3EC77D26-799B-4CD8-914F-C1565E796173}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISER_{430971B1-C31E-45DA-81E0-72C095BAB72C}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISER_{58FC5E37-DD28-4D4A-A549-125744C6763C}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISER_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISER_{888B9AC7-8F5C-456B-A27A-157A6C310E52}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISER_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISER_{DCBECE36-8F23-4B33-925E-A1C6183C0DBD}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{91120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{BEE75E01-DD3F-4D5F-B96C-609E6538D419}" = 2007 Microsoft Office Suite Service Pack 1 (SP1)
"{97BBECCF-B1FD-4010-8D4B-EFC9E3CCEECF}" = Driver Whiz
"{98736A65-3C79-49EC-B7E9-A3C77774B0E6}" = Google SketchUp 6
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A5BA14E0-7384-11D4-BAE7-00409631A2C8}" = Macromedia Extension Manager
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{ABDA9912-5D00-11D4-BAE7-9367CA097955}" = Macromedia Dreamweaver UltraDev 4
"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{B3D8B2F8-3C2C-45BC-933E-8B60E78F6684}" = Google SketchUp 6
"{B44529FF-501E-47CD-A06D-223C161BE058}" = FinePixViewer Resource
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{C887C75D-2636-41F6-BB7B-FD4B0314C1E1}" = Paragon Partition Manager 9.0 Professional
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D155D300-C235-44FC-981C-F7B34683439C}" = Paragon Drive Backup 8.51 Professional Trial
"{D680C913-5955-469D-9D88-C1940F7506D6}" = RAW FILE CONVERTER LE
"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = AusLogics Disk Defrag
"{E4A71A41-BCC8-480a-9E69-0DA29CBA7ECA}" = kikin plugin 2.9
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Avance AC'97 Audio
"7-Zip" = 7-Zip 4.65
"ActivIcons version 3.37_is1" = ActivIcons version 3.37
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Photoshop 5.5" = Adobe Photoshop 5.5
"AGFEO TK-Suite Remote" = AGFEO TK-Suite Remote
"Ahnenblatt_is1" = Ahnenblatt 2.59
"AquaSoft PhotoKalender" = AquaSoft PhotoKalender
"astrovitalis" = astrovitalis
"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.7 (Unicode)
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"AVM ISDN CAPI Port" = AVM ISDN CAPI Port
"Das Neue Dr.Brain Gehirn Jogging Deluxe" = Das Neue Dr.Brain Gehirn Jogging Deluxe
"ElsterFormular 11.3.0.4235" = ElsterFormular
"Enable S3 for USB Device" = Enable S3 for USB Device
"ENTERPRISER" = Microsoft Office Enterprise 2007
"EspaceWanadoo.exe" = Wanadoo
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"ExpressBurn" = Express Burn
"ExpressRip" = Express Rip
"IcoFX_is1" = IcoFX 1.6.4
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"IrfanView" = IrfanView (remove only)
"Macromedia Dreamweaver 2" = Macromedia Dreamweaver 2
"Macromedia Shockwave Player" = Macromedia Shockwave Player
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MWASPI" = MicroStaff WINASPI
"NVIDIA Drivers" = NVIDIA Drivers
"OutlookExpressDatensicherung" = OEBackup - Outlook Express Datensicherung (Vollversion)
"Passfoto Manager_is1" = Passfoto Manager Ver. 1.3
"PDFCreator Toolbar" = PDFCreator Toolbar
"Pixillion" = Pixillion Image Converter
"QueTek File Scavenger 3.2 (de)" = File Scavenger 3.2 (de)
"QuickGamma_is1" = QuickGamma 2.0.0.3
"QuickMonitorProfile_is1" = QuickMonitorProfile 2.1.0.0
"Recordpad" = RecordPad Sound Recorder
"SE A3 USB 1200 Pro v1.3" = SE A3 USB 1200 Pro v1.3
"Sweepi_is1" = Sweepi 5.4.00
"Switch" = Switch Sound File Converter
"ToolBox" = NCH Toolbox
"WavePad" = WavePad Sound Editor
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinGimp-2.0_is1" = GIMP 2.6.6
"WinRAR archiver" = WinRAR
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 13.03.2011 06:23:16 | Computer Name = MERCIERXP | Source = Google Update | ID = 20
Description =
Error - 13.03.2011 06:36:22 | Computer Name = MERCIERXP | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
ist fehlgeschlagen mit dem Fehler: Dieser Vorgang wurde wegen Zeitüberschreitung
zurückgegeben. .
Error - 13.03.2011 08:48:46 | Computer Name = MERCIERXP | Source = Microsoft (R) Visual C# 2005 Compiler | ID = 1000
Description = Faulting application csc.exe, version 8.0.50727.3053, stamp 4889f6cb,
faulting module mscorwks.dll, version 2.0.50727.3615, stamp 4be902c7, debug? 0,
fault address 0x0044db16.
Error - 13.03.2011 08:50:30 | Computer Name = MERCIERXP | Source = Microsoft (R) Visual C# 2005 Compiler | ID = 1000
Description = Faulting application csc.exe, version 8.0.50727.3053, stamp 4889f6cb,
faulting module mscorwks.dll, version 2.0.50727.3615, stamp 4be902c7, debug? 0,
fault address 0x0044db16.
Error - 13.03.2011 08:50:33 | Computer Name = MERCIERXP | Source = Windows Search Service | ID = 3013
Description = Eintrag <C:\CONFIG.MSI\70E80F.RBS> in der Hash-Zuordnung kann nicht
aktualisiert werden. Kontext: Anwendung, SystemIndex Katalog Details: Ein an das
System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error - 13.03.2011 08:50:33 | Computer Name = MERCIERXP | Source = Windows Search Service | ID = 3013
Description = Eintrag <C:\CONFIG.MSI\70E80F.RBS> in der Hash-Zuordnung kann nicht
aktualisiert werden. Kontext: Anwendung, SystemIndex Katalog Details: Ein an das
System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error - 13.03.2011 08:50:44 | Computer Name = MERCIERXP | Source = Microsoft (R) Visual C# 2005 Compiler | ID = 1000
Description = Faulting application csc.exe, version 8.0.50727.3053, stamp 4889f6cb,
faulting module mscorwks.dll, version 2.0.50727.3615, stamp 4be902c7, debug? 0,
fault address 0x0044db16.
Error - 13.03.2011 15:16:57 | Computer Name = MERCIERXP | Source = Avira AntiVir | ID = 4118
Description = AUSNAHMEFEHLER beim Aufruf der Funktion <Scan> für die Datei C:\WINDOWS\system32\msjint40.dll.
[ACCESS_VIOLATION Exception!! EIP = 0x151c91a] Bitte Avira informieren und die
obige Datei übersenden!
Error - 13.03.2011 15:17:06 | Computer Name = MERCIERXP | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
ist fehlgeschlagen mit dem Fehler: Dieser Vorgang wurde wegen Zeitüberschreitung
zurückgegeben. .
Error - 13.03.2011 15:28:35 | Computer Name = MERCIERXP | Source = Avira AntiVir | ID = 4118
Description = AUSNAHMEFEHLER beim Aufruf der Funktion <Scan> für die Datei C:\WINDOWS\system32\dllcache\msjint40.dll.
[ACCESS_VIOLATION Exception!! EIP = 0x151c91a] Bitte Avira informieren und die
obige Datei übersenden!
[ OSession Events ]
Error - 24.12.2009 13:07:49 | Computer Name = MERCIERXP | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6331.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 14521
seconds with 2940 seconds of active time. This session ended with a crash.
Error - 24.03.2010 04:34:21 | Computer Name = MERCIERXP | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6316.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 70
seconds with 60 seconds of active time. This session ended with a crash.
Error - 24.03.2010 04:34:39 | Computer Name = MERCIERXP | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6316.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 7
seconds with 0 seconds of active time. This session ended with a crash.
Error - 24.03.2010 04:34:57 | Computer Name = MERCIERXP | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6316.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 14
seconds with 0 seconds of active time. This session ended with a crash.
Error - 24.03.2010 04:35:13 | Computer Name = MERCIERXP | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6316.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 12
seconds with 0 seconds of active time. This session ended with a crash.
Error - 24.03.2010 04:35:25 | Computer Name = MERCIERXP | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6316.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 9
seconds with 0 seconds of active time. This session ended with a crash.
Error - 29.06.2010 11:29:15 | Computer Name = MERCIERXP | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6341.5001, Microsoft Office Version: 12.0.6215.1000. This session lasted 1907
seconds with 1740 seconds of active time. This session ended with a crash.
Error - 30.11.2010 13:52:27 | Computer Name = MERCIERXP | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6316.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 21575
seconds with 120 seconds of active time. This session ended with a crash.
Error - 20.12.2010 14:00:35 | Computer Name = MERCIERXP | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6341.5001, Microsoft Office Version: 12.0.6215.1000. This session lasted 29878
seconds with 4860 seconds of active time. This session ended with a crash.
Error - 07.01.2011 09:34:15 | Computer Name = MERCIERXP | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6331.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 15701
seconds with 2400 seconds of active time. This session ended with a crash.
[ System Events ]
Error - 08.03.2011 11:09:15 | Computer Name = MERCIERXP | Source = W32Time | ID = 39452689
Description = Zeitabieter "NtpClient": Beim DNS-Lookup für den manuell konfigurierten
Peer "time.windows.com,0x1" ist ein Fehler aufgetreten. Der DNS-Lookup wird in 15
Minuten wiederholt. Fehler: Der Host war bei einem Socketvorgang nicht erreichbar.
(0x80072751)
Error - 08.03.2011 11:09:15 | Computer Name = MERCIERXP | Source = W32Time | ID = 39452701
Description = Der Zeitanbieter "NtpClient" wurde für die Zeiterfassung von mehreren
Zeitquellen konfiguriert. Es ist jedoch Keine der Quellen verfügbar. Innerhalb der
nächsten 14 Minuten wird kein Versuch unternommen, eine Verbindung mit der Quelle
herzustellen. Der NtpClient verfügt über keine Quelle mit genauer Zeit.
Error - 09.03.2011 04:41:57 | Computer Name = MERCIERXP | Source = NETLOGON | ID = 3095
Description = Dieser Computer ist als Mitglied einer Arbeitsgruppe konfiguriert,
nicht als Mitglied einer Domäne. Der Anmeldedienst braucht bei dieser Konfiguration
nicht gestartet zu sein.
Error - 10.03.2011 05:02:20 | Computer Name = MERCIERXP | Source = NETLOGON | ID = 3095
Description = Dieser Computer ist als Mitglied einer Arbeitsgruppe konfiguriert,
nicht als Mitglied einer Domäne. Der Anmeldedienst braucht bei dieser Konfiguration
nicht gestartet zu sein.
Error - 11.03.2011 04:45:52 | Computer Name = MERCIERXP | Source = NETLOGON | ID = 3095
Description = Dieser Computer ist als Mitglied einer Arbeitsgruppe konfiguriert,
nicht als Mitglied einer Domäne. Der Anmeldedienst braucht bei dieser Konfiguration
nicht gestartet zu sein.
Error - 11.03.2011 08:35:09 | Computer Name = MERCIERXP | Source = NETLOGON | ID = 3095
Description = Dieser Computer ist als Mitglied einer Arbeitsgruppe konfiguriert,
nicht als Mitglied einer Domäne. Der Anmeldedienst braucht bei dieser Konfiguration
nicht gestartet zu sein.
Error - 12.03.2011 05:33:25 | Computer Name = MERCIERXP | Source = NETLOGON | ID = 3095
Description = Dieser Computer ist als Mitglied einer Arbeitsgruppe konfiguriert,
nicht als Mitglied einer Domäne. Der Anmeldedienst braucht bei dieser Konfiguration
nicht gestartet zu sein.
Error - 13.03.2011 06:20:26 | Computer Name = MERCIERXP | Source = NETLOGON | ID = 3095
Description = Dieser Computer ist als Mitglied einer Arbeitsgruppe konfiguriert,
nicht als Mitglied einer Domäne. Der Anmeldedienst braucht bei dieser Konfiguration
nicht gestartet zu sein.
Error - 13.03.2011 06:34:51 | Computer Name = MERCIERXP | Source = NETLOGON | ID = 3095
Description = Dieser Computer ist als Mitglied einer Arbeitsgruppe konfiguriert,
nicht als Mitglied einer Domäne. Der Anmeldedienst braucht bei dieser Konfiguration
nicht gestartet zu sein.
Error - 13.03.2011 15:16:15 | Computer Name = MERCIERXP | Source = NETLOGON | ID = 3095
Description = Dieser Computer ist als Mitglied einer Arbeitsgruppe konfiguriert,
nicht als Mitglied einer Domäne. Der Anmeldedienst braucht bei dieser Konfiguration
nicht gestartet zu sein.
< End of report >
Wie geht es jetzt weiter? Was muß ich als nächstes tun? Ich hoffe sehr, daß Ihr mir weiterhelfen könnt und danke Euch schon mal für Eure Mühe und Verständnis mit einem "Ahnungslosen"! Geändert von Galilahi (14.03.2011 um 14:23 Uhr) |
|
14.03.2011, 19:00
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | TR/Crypt.XPACK.Gen und TR/BegSMS.A Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle davon posten. Du findest diese im Reiter Logdateien in Malwarebytes.
__________________
__________________ |
|
14.03.2011, 19:13
| #3 |
| | TR/Crypt.XPACK.Gen und TR/BegSMS.A Nein, ich kann nur diese eine Datei finden
__________________ |
|
14.03.2011, 19:40
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | TR/Crypt.XPACK.Gen und TR/BegSMS.A Dann bitte jetzt CF ausführen: ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
14.03.2011, 20:01
| #5 |
| | TR/Crypt.XPACK.Gen und TR/BegSMS.A Ich lade das jetzt runter, aber bei mir dauert das ewig, weil ich kein DSL habe. Melde mich wenn alles durch ist. Bis dann Uschi |
|
14.03.2011, 21:22
| #6 |
| | TR/Crypt.XPACK.Gen und TR/BegSMS.A Hallo, da bin ich wieder. Vielen Dank schon mal für die ganzen Informationen. Ich habe jetzt alles durch, hatte aber zwischendrin die Fehlermeldung: "PEV.cfxxe - Fehler in der Anwendung Die Ausnahme "unknown software exeption (0x80000001) ist in der Anwendung an der Stelle 0x00487a25 aufgetreten". Damit kann ich leider nichts anfangen!? Hier nun die combofix-datei: Combofix Logfile: Code:
ATTFilter ComboFix 11-03-13.02 - Mercier 14.03.2011 20:41:26.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.49.1031.18.511.240 [GMT 1:00]
ausgeführt von:: c:\dokumente und einstellungen\Mercier\Desktop\cofi.exe
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokumente und einstellungen\Mercier\Anwendungsdaten\PriceGong
c:\dokumente und einstellungen\Mercier\Anwendungsdaten\PriceGong\Data\1.xml
c:\dokumente und einstellungen\Mercier\Anwendungsdaten\PriceGong\Data\a.xml
c:\dokumente und einstellungen\Mercier\Anwendungsdaten\PriceGong\Data\b.xml
c:\dokumente und einstellungen\Mercier\Anwendungsdaten\PriceGong\Data\c.xml
c:\dokumente und einstellungen\Mercier\Anwendungsdaten\PriceGong\Data\d.xml
c:\dokumente und einstellungen\Mercier\Anwendungsdaten\PriceGong\Data\e.xml
c:\dokumente und einstellungen\Mercier\Anwendungsdaten\PriceGong\Data\f.xml
c:\dokumente und einstellungen\Mercier\Anwendungsdaten\PriceGong\Data\g.xml
c:\dokumente und einstellungen\Mercier\Anwendungsdaten\PriceGong\Data\h.xml
c:\dokumente und einstellungen\Mercier\Anwendungsdaten\PriceGong\Data\i.xml
c:\dokumente und einstellungen\Mercier\Anwendungsdaten\PriceGong\Data\J.xml
c:\dokumente und einstellungen\Mercier\Anwendungsdaten\PriceGong\Data\k.xml
c:\dokumente und einstellungen\Mercier\Anwendungsdaten\PriceGong\Data\l.xml
c:\dokumente und einstellungen\Mercier\Anwendungsdaten\PriceGong\Data\m.xml
c:\dokumente und einstellungen\Mercier\Anwendungsdaten\PriceGong\Data\mru.xml
c:\dokumente und einstellungen\Mercier\Anwendungsdaten\PriceGong\Data\n.xml
c:\dokumente und einstellungen\Mercier\Anwendungsdaten\PriceGong\Data\o.xml
c:\dokumente und einstellungen\Mercier\Anwendungsdaten\PriceGong\Data\p.xml
c:\dokumente und einstellungen\Mercier\Anwendungsdaten\PriceGong\Data\q.xml
c:\dokumente und einstellungen\Mercier\Anwendungsdaten\PriceGong\Data\r.xml
c:\dokumente und einstellungen\Mercier\Anwendungsdaten\PriceGong\Data\s.xml
c:\dokumente und einstellungen\Mercier\Anwendungsdaten\PriceGong\Data\t.xml
c:\dokumente und einstellungen\Mercier\Anwendungsdaten\PriceGong\Data\u.xml
c:\dokumente und einstellungen\Mercier\Anwendungsdaten\PriceGong\Data\v.xml
c:\dokumente und einstellungen\Mercier\Anwendungsdaten\PriceGong\Data\w.xml
c:\dokumente und einstellungen\Mercier\Anwendungsdaten\PriceGong\Data\x.xml
c:\dokumente und einstellungen\Mercier\Anwendungsdaten\PriceGong\Data\y.xml
c:\dokumente und einstellungen\Mercier\Anwendungsdaten\PriceGong\Data\z.xml
c:\dokumente und einstellungen\Mercier\Favoriten\Thumbs.db
c:\programme\Setup.exe
c:\windows\autorun.inf
c:\windows\Fonts\RunMe.exe
.
Infizierte Kopie von c:\windows\system32\ole32.dll wurde gefunden und desinfiziert
Kopie von - c:\windows\$hf_mig$\KB979687\SP3QFE\ole32.dll wurde wiederhergestellt
.
.
((((((((((((((((((((((( Dateien erstellt von 2011-02-14 bis 2011-03-14 ))))))))))))))))))))))))))))))
.
.
2011-03-14 19:28 . 2011-03-14 19:36 -------- d-----w- c:\programme\CCleaner
2011-03-14 19:24 . 2011-03-14 19:24 3033192 ----a-w- c:\programme\ccsetup304.exe
2011-03-14 15:25 . 2011-03-14 15:25 -------- d-----w- c:\dokumente und einstellungen\Mercier\Lokale Einstellungen\Anwendungsdaten\Conduit
2011-03-14 15:25 . 2011-03-14 15:25 -------- d-----w- c:\programme\Conduit
2011-03-14 15:25 . 2011-03-14 16:11 -------- d-----w- c:\dokumente und einstellungen\Mercier\Lokale Einstellungen\Anwendungsdaten\softonic-de3
2011-03-14 15:25 . 2011-03-14 15:25 -------- d-----w- c:\programme\softonic-de3
2011-03-14 12:16 . 2011-03-14 12:16 1062574 ----a-w- c:\programme\7z911.exe
2011-03-13 20:12 . 2011-03-14 12:47 -------- d-----w- c:\programme\OTL
2011-03-13 19:20 . 2011-03-13 19:20 -------- d-----w- c:\dokumente und einstellungen\Mercier\Lokale Einstellungen\Anwendungsdaten\PCHealth
2011-03-13 15:01 . 2011-03-13 15:01 -------- d-----w- c:\programme\File Scavenger 3.2
2011-03-13 14:57 . 2011-03-13 14:57 1631768 ----a-w- c:\programme\32fsg32.exe
2011-03-13 13:22 . 2011-03-13 13:22 -------- d-----w- c:\dokumente und einstellungen\Mercier\Anwendungsdaten\Malwarebytes
2011-03-13 13:22 . 2010-12-20 17:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-03-13 13:22 . 2011-03-13 13:22 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2011-03-13 13:22 . 2011-03-13 19:07 -------- d-----w- c:\programme\Malwarebytes' Anti-Malware
2011-03-13 13:22 . 2010-12-20 17:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-03-13 13:21 . 2011-03-13 13:21 7734208 ----a-w- c:\programme\mbam-setup.exe
2011-03-13 12:37 . 2011-03-13 12:37 -------- d-----w- c:\programme\Driver Whiz
2011-03-10 11:21 . 2011-03-10 11:21 -------- d-----w- c:\dokumente und einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Google
2011-03-10 11:17 . 2011-03-10 11:17 -------- d-----w- c:\dokumente und einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\Google
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-09 13:53 . 2002-08-29 12:00 270848 ----a-w- c:\windows\system32\sbe.dll
2011-02-09 13:53 . 2002-08-29 12:00 186880 ----a-w- c:\windows\system32\encdec.dll
2011-02-02 07:58 . 2003-06-12 09:03 2067456 ----a-w- c:\windows\system32\mstscax.dll
2011-01-27 11:57 . 2003-06-12 09:03 677888 ----a-w- c:\windows\system32\mstsc.exe
2011-01-21 14:44 . 2002-08-29 12:00 440832 ----a-w- c:\windows\system32\shimgvw.dll
2011-01-17 16:30 . 2011-01-17 16:30 2676560 ----a-w- c:\programme\Productivity_2.2.exe
2011-01-15 18:52 . 2011-01-15 18:52 59398824 ----a-w- c:\programme\avira_antivir_personal_de.exe
2011-01-07 14:09 . 2002-08-29 12:00 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-12-31 15:04 . 2010-12-31 15:04 293160 ----a-w- c:\programme\SoftonicDownloader_fuer_sweepi.exe
2010-12-31 14:03 . 2002-08-29 12:00 1855104 ----a-w- c:\windows\system32\win32k.sys
2010-12-22 12:34 . 2002-08-29 12:00 301568 ----a-w- c:\windows\system32\kerberos.dll
2010-12-20 23:52 . 2005-02-18 15:35 916480 ----a-w- c:\windows\system32\wininet.dll
2010-12-20 23:52 . 2002-08-29 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-12-20 23:52 . 2002-08-29 12:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2010-12-20 17:25 . 2002-08-29 12:00 737792 ----a-w- c:\windows\system32\lsasrv.dll
2010-12-20 12:55 . 2005-05-04 11:04 385024 ----a-w- c:\windows\system32\html.iec
2009-12-23 12:02 . 2009-12-23 12:02 10184256 ----a-w- c:\programme\ashampoo_winoptimizer_2010_se_6.50_6588.exe
2009-05-17 07:59 . 2009-04-25 09:57 519257 ----a-w- c:\programme\QuickGammaV2DE.exe
2009-04-14 09:26 . 2009-04-14 09:26 18295296 ----a-w- c:\programme\gimp-2.6.6-i686.EXE
2009-03-19 19:09 . 2009-03-19 19:09 1628800 ----a-w- c:\programme\Paint.NET.3.36.exe
2009-03-19 19:00 . 2009-03-19 19:00 2959376 ----a-w- c:\programme\dotnetfx35setup.exe
2009-02-18 15:00 . 2009-02-18 15:00 13300079 ----a-w- c:\programme\AquaSoftPhotoKalender1211ChipOnline_PhotoKalenderSetup_1211_CHIP_Online.exe
2009-01-19 19:37 . 2009-01-19 19:37 54217768 ----a-w- c:\programme\ElsterFormular2008-Setup.exe
2008-12-14 10:59 . 2008-12-14 10:59 16194992 ----a-w- c:\programme\PDFCreator-0_9_6_setup.exe
2008-12-11 13:57 . 2009-02-20 08:54 17936472 ----a-w- c:\programme\san1572.exe
2008-10-04 08:10 . 2008-08-31 14:26 1156272 -c--a-w- c:\programme\WDC3Setup.exe
2008-08-13 13:52 . 2008-10-12 13:25 1445792 ----a-w- c:\programme\disk-defrag-setup.exe
2008-05-14 11:31 . 2008-10-12 13:25 2306304 ----a-w- c:\programme\zicon.exe
2008-04-30 16:32 . 2008-10-12 13:25 6505472 ----a-w- c:\programme\irfanview_plugins_410_setup.exe
2008-04-30 12:34 . 2008-10-12 13:25 1397248 ----a-w- c:\programme\iview410g_setup.exe
2008-04-29 06:54 . 2008-10-12 13:25 1440047 ----a-w- c:\programme\wrar371d.exe
2008-03-24 10:07 . 2008-10-12 13:25 866246 ----a-w- c:\programme\p2s_setup.exe
2008-03-21 17:29 . 2008-10-12 13:25 77322 ----a-w- c:\programme\dic_allemand_medical.exe
2008-03-21 17:28 . 2008-10-12 13:25 259306 ----a-w- c:\programme\dictionnaire_medizin.exe
2008-03-05 17:30 . 2008-10-12 13:25 3516928 ----a-w- c:\programme\TweakPower.exe
2008-02-14 12:08 . 2008-10-12 13:10 38885976 ----a-w- c:\programme\GoogleSketchUpWDE64.exe
2008-01-06 15:53 . 2008-10-12 13:25 3722850 ----a-w- c:\programme\absetup.exe
2007-11-21 12:32 . 2008-10-12 13:25 691880 ----a-w- c:\programme\mrs_EXCELTOOLS_free.exe
2007-11-21 12:29 . 2008-10-12 13:25 352840 ----a-w- c:\programme\mrs_FEIERTAGE.exe
2007-11-21 10:42 . 2008-10-12 13:25 871952 ----a-w- c:\programme\undelete_plus_setup Datenrettung.exe
2007-10-18 16:38 . 2008-10-12 13:25 243055 ----a-w- c:\programme\mrs_OUTLOOK.exe
2007-10-09 17:24 . 2008-10-12 13:25 1020116 ----a-w- c:\programme\Passfoto-Setup.exe
2007-09-05 09:53 . 2008-10-12 13:25 823839 ----a-w- c:\programme\dic_allemand.exe
2007-09-05 09:51 . 2008-10-12 13:25 309309 ----a-w- c:\programme\dictionnaire_setup.exe
2007-01-22 17:11 . 2008-10-12 13:25 18016148 ----a-w- c:\programme\Inkscape-0.44.1-1.win32.exe
2006-08-28 08:45 . 2008-10-12 13:25 2333850 ----a-w- c:\programme\Activicons setup.exe
2000-04-01 16:27 . 2000-04-01 16:27 122880 -c--a-w- c:\programme\uidll.dll
1999-10-13 11:49 . 1999-10-13 11:49 131072 -c--a-w- c:\programme\booleen.dll
1995-07-11 07:50 24576 -csha-w- c:\windows\system32\AWCODC32.DLL
1995-07-11 07:50 6144 -csha-w- c:\windows\system32\AWDCXC32.DLL
1995-11-16 16:39 11776 -csha-w- c:\windows\system32\AWDENC32.DLL
1995-07-11 07:50 26624 -csha-w- c:\windows\system32\AWRESX32.DLL
1995-10-09 14:58 10240 -csha-w- c:\windows\system32\AWVIEW32.DLL
1998-04-04 18:23 24576 -csha-w- c:\windows\system32\LFAVI90N.DLL
1998-05-20 15:14 28672 -csha-w- c:\windows\system32\lfawd90n.dll
1998-05-15 15:00 33792 -csha-w- c:\windows\system32\lfbmp90n.dll
1998-05-18 15:50 27136 -csha-w- c:\windows\system32\lfcal90n.dll
1998-05-15 15:01 235008 -csha-w- c:\windows\system32\LFCMP90n.DLL
1998-06-24 16:59 237568 -csha-w- c:\windows\system32\LFDIC90N.DLL
1998-04-04 18:24 31232 -csha-w- c:\windows\system32\LFEPS90N.DLL
1998-05-15 14:59 64512 -csha-w- c:\windows\system32\lffax90n.dll
1997-11-21 16:03 338944 -csha-w- c:\windows\system32\lffpx7.dll
1998-05-20 15:14 88576 -csha-w- c:\windows\system32\lffpx90n.dll
1998-05-15 15:02 39936 -csha-w- c:\windows\system32\lfgif90n.dll
1998-05-15 15:02 46592 -csha-w- c:\windows\system32\LFICA90N.DLL
1998-04-04 18:24 27136 -csha-w- c:\windows\system32\LFIMG90N.DLL
1997-09-30 12:30 122880 -csha-w- c:\windows\system32\LFKODAK.DLL
1998-04-04 18:24 35840 -csha-w- c:\windows\system32\LFLMA90N.DLL
1998-04-04 18:24 31232 -csha-w- c:\windows\system32\LFLMB90N.DLL
1998-04-04 18:24 25600 -csha-w- c:\windows\system32\LFMAC90N.DLL
1998-04-04 18:25 26112 -csha-w- c:\windows\system32\LFMSP90N.DLL
1998-04-04 18:25 26624 -csha-w- c:\windows\system32\LFPCD90N.DLL
1998-05-15 15:03 31232 -csha-w- c:\windows\system32\lfpct90n.dll
1998-04-04 18:25 30720 -csha-w- c:\windows\system32\lfpcx90n.dll
1998-06-23 08:10 133632 -csha-w- c:\windows\system32\lfpng90n.dll
1998-05-18 16:27 29184 -csha-w- c:\windows\system32\lfpsd90n.dll
1998-04-04 18:25 26112 -csha-w- c:\windows\system32\LFRAS90N.DLL
1998-04-04 18:25 28160 -csha-w- c:\windows\system32\LFTGA90N.DLL
1998-05-15 15:05 118272 -csha-w- c:\windows\system32\lftif90n.dll
1998-04-04 18:26 25600 -csha-w- c:\windows\system32\lfwfx90n.dll
1998-05-15 15:05 28672 -csha-w- c:\windows\system32\lfwmf90n.dll
1998-04-04 18:26 27648 -csha-w- c:\windows\system32\lfwpg90n.dll
1998-05-15 14:27 238592 -csha-w- c:\windows\system32\ltann90n.dll
1998-05-15 14:26 220160 -csha-w- c:\windows\system32\LTDIS90n.dll
1998-05-18 16:03 145920 -csha-w- c:\windows\system32\LTDLG90N.DLL
1998-04-04 18:22 146432 -csha-w- c:\windows\system32\ltefx90n.dll
1998-06-23 10:41 99328 -csha-w- c:\windows\system32\ltfil90n.DLL
1998-05-20 15:13 104448 -csha-w- c:\windows\system32\ltimg90n.dll
1998-05-20 15:14 38400 -csha-w- c:\windows\system32\ltisi90n.dll
1998-06-19 13:44 290304 -csha-w- c:\windows\system32\ltkrn90n.dll
1998-06-29 15:28 43520 -csha-w- c:\windows\system32\LTNET90N.DLL
1998-04-03 17:01 3824 -csha-w- c:\windows\system32\ltthk90w.dll
1998-05-19 16:53 35328 -csha-w- c:\windows\system32\lttwn90n.dll
1998-04-03 17:01 45936 -csha-w- c:\windows\system32\ltvdd90w.drv
1998-05-20 15:15 148480 -csha-w- c:\windows\system32\LTVID90N.DLL
1999-02-22 10:00 159744 -csha-w- c:\windows\system32\MFCANS32.DLL
2008-04-14 06:52 343040 --sha-w- c:\windows\system32\msvcrt.dll
1998-04-29 18:00 58880 -csha-w- c:\windows\system32\npplg90N.dll
1995-05-21 22:00 640512 -csha-w- c:\windows\system32\OC30.DLL
1999-05-26 07:46 212480 -csha-w- c:\windows\system32\pcdlib32.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}"= "c:\programme\softonic-de3\tbsoft.dll" [2010-11-13 3913000]
.
[HKEY_CLASSES_ROOT\clsid\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2010-11-13 20:58 3913000 ----a-w- c:\programme\ConduitEngine\ConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]
2010-11-13 20:58 3913000 ----a-w- c:\programme\softonic-de3\tbsoft.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E601996F-E400-41CA-804B-CD6373A7EEE2}]
2010-11-23 19:51 919408 ----a-w- c:\programme\kikin\ie_kikin.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}"= "c:\programme\softonic-de3\tbsoft.dll" [2010-11-13 3913000]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\programme\ConduitEngine\ConduitEngine.dll" [2010-11-13 3913000]
.
[HKEY_CLASSES_ROOT\clsid\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}"= "c:\programme\softonic-de3\tbsoft.dll" [2010-11-13 3913000]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\programme\ConduitEngine\ConduitEngine.dll" [2010-11-13 3913000]
.
[HKEY_CLASSES_ROOT\clsid\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickGammaLoader"="c:\programme\QuickGamma\QuickGammaLoader.exe" [2005-03-27 68096]
"swg"="c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-03-10 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2002-09-11 46592]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2001-12-31 3756032]
"RemoteControl"="c:\programme\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2003-02-07 114741]
"StorageGuard"="c:\programme\Gemeinsame Dateien\Sonic\Update Manager\sgtray.exe" [2003-02-13 155648]
"NvMediaCenter"="c:\windows\System32\NvMcTray.dll" [2001-12-31 46080]
"WOOWATCH"="c:\progra~1\Wanadoo\Watch.exe" [2004-09-14 24576]
"WOOTASKBARICON"="c:\progra~1\Wanadoo\TaskbarIcon.exe" [2004-09-14 49152]
"REGSHAVE"="c:\programme\REGSHAVE\REGSHAVE.EXE" [2002-02-04 53248]
"GrooveMonitor"="c:\programme\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2009-01-05 413696]
"SunJavaUpdateSched"="c:\programme\Java\jre6\bin\jusched.exe" [2009-05-14 148888]
"LogMeIn GUI"="c:\programme\LogMeIn\x86\LogMeInSystray.exe" [2008-08-11 63048]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2010-12-13 281768]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
.
c:\dokumente und einstellungen\Mercier\Startmen\Programme\Autostart\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\programme\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-7 101440]
.
c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\
Adobe Gamma Loader.exe.lnk - c:\programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe [2003-6-18 113664]
ExifLauncher2.lnk - c:\programme\FinePixViewer\QuickDCF2.exe [2009-3-27 303104]
SrvMod.lnk - c:\windows\twain_32\L12U16U2\SrvMod.exe [2007-12-6 45056]
Windows Search.lnk - c:\programme\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\programme\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2010-12-08 12:11 87424 ----a-w- c:\windows\system32\LMIinit.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Messenger\\msmsgs.exe"=
"c:\\Programme\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Programme\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Programme\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\twain_32\\L12U16U2\\SrvMod.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
R0 hotcore3;hotcore3;c:\windows\system32\drivers\hotcore3.sys [09.10.2008 17:27 39472]
R1 SSHDRV86;SSHDRV86;c:\windows\system32\drivers\SSHDRV86.sys [26.05.2008 18:24 81408]
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [15.01.2011 19:56 135336]
R2 AVMPORT;AVMPORT;c:\windows\system32\drivers\avmport.sys [12.06.2003 11:12 59520]
R2 LMIGuardianSvc;LMIGuardianSvc;c:\programme\LogMeIn\x86\LMIGuardianSvc.exe [04.10.2010 16:18 374152]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\programme\LogMeIn\x86\rainfo.sys [11.08.2008 12:41 12856]
R3 AVMWAN;AVM NDIS WAN CAPI-Treiber;c:\windows\system32\drivers\avmwan.sys [12.06.2003 10:40 37568]
R3 fpcibase;AVM ISDN-Controller FRITZ!Card PCI v2.0;c:\windows\system32\drivers\fpcibase.sys [12.06.2003 10:40 444416]
S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [10.03.2011 12:16 136176]
S3 cpuz134;cpuz134;\??\c:\dokume~1\Mercier\LOKALE~1\Temp\cpuz134\cpuz134_x32.sys --> c:\dokume~1\Mercier\LOKALE~1\Temp\cpuz134\cpuz134_x32.sys [?]
.
Inhalt des "geplante Tasks" Ordners
.
2011-03-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programme\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
2011-03-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2011-03-10 11:16]
.
2011-03-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2011-03-10 11:16]
.
2011-03-14 c:\windows\Tasks\User_Feed_Synchronization-{F4548AA5-7DBB-483E-9A42-FDDF15752DD7}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2431245
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uSearchURL,(Default) = hxxp://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/su/*hxxp://www.yahoo.com
IE: Google Sidewiki... - c:\programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: { - c:\programme\Messenger\msmsgs.exe
IE: {{0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - {E601996F-E400-41CA-804B-CD6373A7EEE2} - c:\programme\kikin\ie_kikin.dll
TCP: {E465ED50-0270-44F9-B2C5-2562BAB1150D} = 62.27.27.62
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-AGFEO TK-Suite Remote - c:\programme\AGFEO\Tk-Suite-Remote\vaporize.exe
AddRemove-Audacity 1.3 Beta (Unicode)_is1 - c:\uschi\unins000.exe
AddRemove-ToolBox - c:\programme\NCH Swift Sound\ToolBox\uninst.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-03-14 20:53
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(392)
c:\windows\system32\LMIinit.dll
.
- - - - - - - > 'explorer.exe'(2468)
c:\programme\Windows Desktop Search\deskbar.dll
c:\programme\Windows Desktop Search\de-de\dbres.dll.mui
c:\programme\Windows Desktop Search\dbres.dll
c:\programme\Windows Desktop Search\wordwheel.dll
c:\programme\Windows Desktop Search\de-de\msnlExtRes.dll.mui
c:\programme\Windows Desktop Search\msnlExtRes.dll
c:\windows\system32\webcheck.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\programme\Avira\AntiVir Desktop\avguard.exe
c:\programme\LogMeIn\x86\RaMaint.exe
c:\programme\Avira\AntiVir Desktop\avshadow.exe
c:\programme\LogMeIn\x86\LogMeIn.exe
c:\windows\System32\nvsvc32.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\system32\SearchProtocolHost.exe
c:\windows\SOUNDMAN.EXE
c:\windows\system32\SearchFilterHost.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-03-14 21:01:52 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2011-03-14 20:01
.
Vor Suchlauf: 9.192.583.168 Bytes frei
Nach Suchlauf: 9.620.697.088 Bytes frei
.
- - End Of File - - 58653286E24F764A24A77C67B1FFB883
Ist mein System jetzt wieder "porentief rein"? Was muß ich nach so einer Aktion noch beachten? Muß ich jetzt alle Passwörter ändern? Wie kann man so etwas vermeiden? Grüße Uschi |
|
15.03.2011, 00:18
| #7 | |
| | TR/Crypt.XPACK.Gen und TR/BegSMS.A Oh nein, jetzt habe ich gerade schon wieder eine Meldung bekommen: Zitat:
Grüße Uschi |
|
15.03.2011, 11:17
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | TR/Crypt.XPACK.Gen und TR/BegSMS.A Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html
__________________ Logfiles bitte immer in CODE-Tags posten |
|
15.03.2011, 14:02
| #9 | ||
| | TR/Crypt.XPACK.Gen und TR/BegSMS.A Hallo, und vielen Dank. Ich habe das jetzt ausgeführt: Zitat:
Zitat:
Bis bald Uschi |
|
15.03.2011, 16:09
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | TR/Crypt.XPACK.Gen und TR/BegSMS.A Du solltest nur das Tool von Kaspersky ausführen!! Außer sind die Logs unvollständig!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
15.03.2011, 18:11
| #11 | |
| | TR/Crypt.XPACK.Gen und TR/BegSMS.A Entschuldige bitte, ich habe mir die Anweisung extra ausgedruckt und komplett abgearbeitet. Es tut mit leid. Hier die Meldung von TDSS: Zitat:
Gruß Uschi |
|
15.03.2011, 21:15
| #12 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | TR/Crypt.XPACK.Gen und TR/BegSMS.A Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen. Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst. Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
16.03.2011, 15:28
| #13 |
| | TR/Crypt.XPACK.Gen und TR/BegSMS.A Hallo, entschuldige bitte, aber das Programm GMER hat sehr lange gebraucht. Und ich habe große Angst, daß ich etwas falsch mache. Hier schon mal die Daten von GMER und OSAM: GMER Logfile: Code:
ATTFilter GMER 1.0.15.15530 - hxxp://www.gmer.net
Rootkit scan 2011-03-16 14:49:23
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 ST380011A rev.3.04
Running: nky3mq1b.exe; Driver: C:\DOKUME~1\Mercier\LOKALE~1\Temp\pxlyipog.sys
---- System - GMER 1.0.15 ----
SSDT F8B7D81E ZwCreateKey
SSDT F8B7D814 ZwCreateThread
SSDT F8B7D823 ZwDeleteKey
SSDT F8B7D82D ZwDeleteValueKey
SSDT F8B7D832 ZwLoadKey
SSDT F8B7D800 ZwOpenProcess
SSDT F8B7D805 ZwOpenThread
SSDT F8B7D83C ZwReplaceKey
SSDT F8B7D837 ZwRestoreKey
SSDT F8B7D828 ZwSetValueKey
---- Kernel code sections - GMER 1.0.15 ----
.text C:\WINDOWS\system32\drivers\SSHDRV86.sys section is writeable [0xF6949000, 0x26354, 0xE8000020]
.pklstb C:\WINDOWS\system32\drivers\SSHDRV86.sys entry point in ".pklstb" section [0xF697E000]
.relo2 C:\WINDOWS\system32\drivers\SSHDRV86.sys unknown last section [0xF6995000, 0x8E, 0x42000040]
---- User code sections - GMER 1.0.15 ----
.text C:\WINDOWS\system32\SearchIndexer.exe[1684] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)
---- Devices - GMER 1.0.15 ----
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer tfsnifs.sys (Direct Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer tfsnifs.sys (Direct Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer tfsnifs.sys (Direct Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer tfsnifs.sys (Direct Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer tfsnifs.sys (Direct Access Component/Sonic Solutions)
Device \FileSystem\Cdfs \Cdfs tfsnifs.sys (Direct Access Component/Sonic Solutions)
---- Registry - GMER 1.0.15 ----
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FindExtensions\Static\ShellSearch\0@ Nach &Dateien oder Ordnern...
Reg HKLM\SOFTWARE\Microsoft\Windows Search\CatalogNames\Windows\SystemIndex@pkm:catalog:LastCatalogCrawlId 23
Reg HKLM\SOFTWARE\Microsoft\Windows Search\CatalogNames\Windows\SystemIndex@pkm:catalog:LastCatalogCrawlModified 8
Reg HKLM\SOFTWARE\Microsoft\Windows Search\CatalogNames\Windows\SystemIndex@pkm:catalog:LastCatalogCrawlErrors 11
Reg HKLM\SOFTWARE\Microsoft\Windows Search\CatalogNames\Windows\SystemIndex@pkm:catalog:LastCatalogCrawlKBytes 6
Reg HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex@CheckPointNumber 12
Reg HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\Crawls\24
Reg HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\Crawls\24@CrawlType 5
Reg HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\Crawls\24@InProgress 1
Reg HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\Crawls\24@DoneAddingCrawlSeeds 1
Reg HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\Crawls\24@LogName C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.Crwl24.gthr
Reg HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\Crawls\24@CheckPoint 0x0A 0x02 0x00 0x00 ...
Reg HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\Crawls\24@IsCatalogLevel 0
Reg HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\Crawls\24@LogStartAddId 3
Reg HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\StartPages\2@CrawlNumberInProgress 24
---- EOF - GMER 1.0.15 ----
Bei Osam hatte ich das Problem, daß ich es nicht als Administrator starten konnte da ich das Kennwort nicht kenne!? OSAM Logfile: Code:
ATTFilter Report of OSAM: Autorun Manager v5.0.11926.0 hxxp://www.online-solutions.ru/en/ Saved at 15:20:08 on 16.03.2011 OS: Windows XP Professional Service Pack 3 (Build 2600) Default Browser: Microsoft Corporation Internet Explorer 8.00.6001.18702 Scanner Settings [x] Rootkits detection (hidden registry) [x] Rootkits detection (hidden files) [x] Retrieve files information [x] Check Microsoft signatures Filters [ ] Trusted entries [ ] Empty entries [x] Hidden registry entries (rootkit activity) [x] Exclusively opened files [x] Not found files [x] Files without detailed information [x] Existing files [ ] Non-startable services [ ] Non-startable drivers [x] Active entries [x] Disabled entries [Common] -----( %SystemRoot%\Tasks )----- "AppleSoftwareUpdate.job" - "Apple Inc." - C:\Programme\Apple Software Update\SoftwareUpdate.exe "GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe "GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe [Control Panel Objects] -----( %SystemRoot%\system32 )----- "everest_cpl.cpl" - ? - C:\WINDOWS\system32\everest_cpl.cpl (File found, but it contains no detailed information) "infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl "javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl "nvtuicpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvtuicpl.cpl -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )----- "Avira AntiVir Personal" - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl "mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLCFG32.CPL "QuickTime" - "Apple Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl [Drivers] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys "avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys "avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys "AVMPORT" (AVMPORT) - "AVM Berlin" - C:\WINDOWS\System32\drivers\avmport.sys "catchme" (catchme) - ? - C:\cofi\catchme.sys (File not found) "cdrbsdrv" (cdrbsdrv) - "B.H.A Corporation" - C:\WINDOWS\system32\drivers\cdrbsdrv.sys "Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys (File not found) "cpuz134" (cpuz134) - ? - C:\DOKUME~1\Mercier\LOKALE~1\Temp\cpuz134\cpuz134_x32.sys (File not found) "drvmcdb" (drvmcdb) - "Sonic Solutions" - C:\WINDOWS\System32\drivers\drvmcdb.sys "drvnddm" (drvnddm) - "Sonic Solutions" - C:\WINDOWS\System32\drivers\drvnddm.sys "hotcore3" (hotcore3) - "Paragon Software Group" - C:\WINDOWS\System32\drivers\hotcore3.sys "i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys (File not found) "lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys (File not found) "lmimirr" (lmimirr) - "LogMeIn, Inc." - C:\WINDOWS\System32\DRIVERS\lmimirr.sys "LogMeIn Kernel Information Provider" (LMIInfo) - "LogMeIn, Inc." - C:\Programme\LogMeIn\x86\RaInfo.sys "LogMeIn Remote File System Driver" (LMIRfsDriver) - "LogMeIn, Inc." - C:\WINDOWS\system32\drivers\LMIRfsDriver.sys "MASPINT" (MASPINT) - "MicroStaff Co.,Ltd." - C:\WINDOWS\system32\drivers\MASPINT.sys "Padus ASPI Shell" (pfc) - "Padus, Inc." - C:\WINDOWS\System32\drivers\pfc.sys "PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys (File not found) "PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys (File not found) "PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys (File not found) "PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys (File not found) "PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys (File not found) "PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\DRIVERS\PxHelp20.sys "SANDRA" (SANDRA) - ? - C:\Programme\SiSoftware\SiSoftware Sandra Lite 2009.SP2\WNt500x86\Sandra.sys (File not found) "sscdbhk5" (sscdbhk5) - "Sonic Solutions" - C:\WINDOWS\System32\drivers\sscdbhk5.sys "SSHDRV86" (SSHDRV86) - ? - C:\WINDOWS\system32\drivers\SSHDRV86.sys "ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys "ssrtln" (ssrtln) - "Sonic Solutions" - C:\WINDOWS\System32\drivers\ssrtln.sys "tfsnboio" (tfsnboio) - "Sonic Solutions" - C:\WINDOWS\System32\dla\tfsnboio.sys "tfsncofs" (tfsncofs) - "Sonic Solutions" - C:\WINDOWS\System32\dla\tfsncofs.sys "tfsndrct" (tfsndrct) - "Sonic Solutions" - C:\WINDOWS\System32\dla\tfsndrct.sys "tfsndres" (tfsndres) - "Sonic Solutions" - C:\WINDOWS\System32\dla\tfsndres.sys "tfsnifs" (tfsnifs) - "Sonic Solutions" - C:\WINDOWS\System32\dla\tfsnifs.sys "tfsnopio" (tfsnopio) - "Sonic Solutions" - C:\WINDOWS\System32\dla\tfsnopio.sys "tfsnpool" (tfsnpool) - "Sonic Solutions" - C:\WINDOWS\System32\dla\tfsnpool.sys "tfsnudf" (tfsnudf) - "Sonic Solutions" - C:\WINDOWS\System32\dla\tfsnudf.sys "tfsnudfa" (tfsnudfa) - "Sonic Solutions" - C:\WINDOWS\System32\dla\tfsnudfa.sys "TVICHW32" (TVICHW32) - "EnTech Taiwan" - C:\WINDOWS\system32\DRIVERS\TVICHW32.SYS "UIM Drive Backup Image Plugin" (Uim_IM) - "Paragon" - C:\WINDOWS\System32\Drivers\Uim_IM.sys "Universal Image Mounter Controller" (UimBus) - "Windows (R) 2000 DDK provider" - C:\WINDOWS\System32\DRIVERS\UimBus.sys "WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys (File not found) [Explorer] -----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )----- {BDEADF00-C265-11d0-BCED-00A0C90AB50F} "Web Folders" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\MSONSEXT.DLL -----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )----- {89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install {89820200-ECBD-11cf-8B85-00AA005B4340} "Windows Desktop-Update" - "Microsoft Corporation" - regsvr32.exe /s /n /i:U shell32.dll -----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )----- {0D2E74C4-3C34-11d2-A27E-00C04FC30871} "{0D2E74C4-3C34-11d2-A27E-00C04FC30871}" - "Microsoft Corporation" - C:\WINDOWS\system32\SHELL32.dll {24F14F01-7B1C-11d1-838f-0000F80461CF} "{24F14F01-7B1C-11d1-838f-0000F80461CF}" - "Microsoft Corporation" - C:\WINDOWS\system32\SHELL32.dll {24F14F02-7B1C-11d1-838f-0000F80461CF} "{24F14F02-7B1C-11d1-838f-0000F80461CF}" - "Microsoft Corporation" - C:\WINDOWS\system32\SHELL32.dll {66742402-F9B9-11D1-A202-0000F81FEDEE} "{66742402-F9B9-11D1-A202-0000F81FEDEE}" - "Microsoft Corporation" - C:\WINDOWS\system32\SHELL32.dll -----( HKLM\Software\Classes\Protocols\Filter )----- {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll {807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\MSOXMLMF.DLL {733AC4CB-F1A4-11d0-B951-00A0C90312E1} "WebView MIME Filter" - "Microsoft Corporation" - C:\WINDOWS\system32\SHELL32.dll -----( HKLM\Software\Classes\Protocols\Handler )----- {314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll {88FED34C-F0CA-4636-A375-3CB6248B04CD} "Local Groove Web Services Protocol" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )----- {B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - ? - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (File not found) {AEB6717E-7E19-11d0-97EE-00C04FD91972} "URL Exec Hook" - "Microsoft Corporation" - C:\WINDOWS\system32\shell32.dll {56F9679E-7826-4C84-81F3-532071A8BCC5} "Windows Desktop Search Namespace Manager" - "Microsoft Corporation" - C:\Programme\Windows Desktop Search\MSNLNamespaceMgr.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )----- {23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Programme\7-Zip\7-zip.dll {42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll (File not found) {1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer" - "NVIDIA Corporation" - C:\WINDOWS\System32\nvshell.dll {1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu" - "NVIDIA Corporation" - C:\WINDOWS\System32\nvshell.dll {5CA3D70E-1895-11CF-8E15-001234567890} "DriveLetterAccess" - "Sonic Solutions" - C:\WINDOWS\system32\dla\tfswshx.dll {99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - ? - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (File not found) {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - ? - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (File not found) {920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - ? - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (File not found) {16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - ? - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (File not found) {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - ? - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (File not found) {2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - ? - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (File not found) {72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - ? - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (File not found) {6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - ? - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (File not found) {B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - ? - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (File not found) {A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - ? - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (File not found) {387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - ? - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (File not found) {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? - (File not found | COM-object registry key not found) {32683183-48a0-441b-a342-7c2a440a9478} "Media Band" - ? - (File not found | COM-object registry key not found) {42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\msohevi.dll {993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll {5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL {00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL {C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll {1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu" - "NVIDIA Corporation" - C:\WINDOWS\System32\nvshell.dll {0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL {1AC06E4B-5A0A-4B62-B24A-F48389402CCE} "PowerLame" - ? - (File not found | COM-object registry key not found) {45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\shlext.dll {E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll {764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? - (File not found | COM-object registry key not found) {e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll {0DF44EAA-FF21-4412-828E-260A8728E7F1} "Taskleiste und Startmenü" - "Microsoft Corporation" - C:\WINDOWS\system32\shell32.dll {BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Web Folders" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\MSONSEXT.DLL {13E7F612-F261-4391-BEA2-39DF4F3FA311} "Windows Desktop Search" - "Microsoft Corporation" - C:\Programme\Windows Desktop Search\msnlExt.dll {da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? - (File not found | COM-object registry key not found) {B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Programme\WinRAR\rarext.dll (File found, but it contains no detailed information) -----( HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad )----- {7849596a-48ea-486e-8937-a2a3009f31a9} "PostBootReminder object" - "Microsoft Corporation" - C:\WINDOWS\system32\shell32.dll {fbeb8a05-beee-4442-804e-409d6c4515e9} "ShellFolder for CD Burning" - "Microsoft Corporation" - C:\WINDOWS\system32\SHELL32.dll [Internet Explorer] -----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )----- {C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1} "File Search Explorer Band" - "Microsoft Corporation" - C:\WINDOWS\system32\SHELL32.dll {32683183-48a0-441b-a342-7c2a440a9478} "{32683183-48a0-441b-a342-7c2a440a9478}" - ? - (File not found | COM-object registry key not found) -----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )----- <binary data> "&Links" - "Microsoft Corporation" - C:\WINDOWS\system32\SHELL32.dll <binary data> "&Yahoo! Toolbar" - ? - (File not found | COM-object registry key not found) <binary data> "Conduit Engine" - "Conduit Ltd." - C:\Programme\ConduitEngine\ConduitEngine.dll <binary data> "Google Toolbar" - "Google Inc." - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll ITBar7Height "ITBar7Height" - ? - (File not found | COM-object registry key not found) <binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found) <binary data> "PDFCreator Toolbar" - ? - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll <binary data> "softonic-de3 Toolbar" - "Conduit Ltd." - C:\Programme\softonic-de3\tbsoft.dll <binary data> "{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}" - ? - (File not found | COM-object registry key not found) <binary data> "{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}" - ? - (File not found | COM-object registry key not found) <binary data> "{47833539-D0C5-4125-9FA8-0819E2EAAC93}" - ? - (File not found | COM-object registry key not found) <binary data> "{C4069E3A-68F1-403E-B40E-20066696354B}" - ? - (File not found | COM-object registry key not found) -----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )----- {08C06D61-F1F3-4799-86F8-BE1A89362C85} "Search Class" - ? - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} "softonic-de3 Toolbar" - "Conduit Ltd." - C:\Programme\softonic-de3\tbsoft.dll -----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )----- DirectAnimation Java Classes "DirectAnimation Java Classes" - ? - (File not found | COM-object registry key not found) / file://C:\WINDOWS\Java\classes\dajava.cab {E8F628B5-259A-4734-97EE-BA914D7BE941} "Driver Agent ActiveX Control" - "Touchstone Software Corp" - C:\WINDOWS\Downloaded Program Files\driveragent.ocx / hxxp://driveragent.com/files/driveragent.cab {8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_13" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_13.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} "Java Plug-in 1.6.0_13" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_13.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_13" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_13.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab {02BCC737-B171-4746-94C9-0D8A0B2C0089} "Microsoft Office Template and Media Control" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\IEAWSDC.DLL / hxxp://office.microsoft.com/templates/ieawsdc.cab Microsoft XML Parser for Java "Microsoft XML Parser for Java" - ? - (File not found | COM-object registry key not found) / file://C:\WINDOWS\Java\classes\xmldso.cab {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} "Office Update Installation Engine" - "Microsoft Corporation" - C:\WINDOWS\opuc.dll / hxxp://office.microsoft.com/officeupdate/content/opuc.cab {166B1BCA-3F9C-11CF-8075-444553540000} "Shockwave ActiveX Control" - "Macromedia, Inc." - C:\WINDOWS\system32\Macromed\Director\SwDir.dll / hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab {D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Macromed\Flash\Flash9e.ocx / hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab {DD3641E5-A9CF-11D1-9AA1-444553540000} "Surround Video V3.0 Control Object" - "Black Diamond Consulting, Inc." - C:\WINDOWS\Downloaded Program Files\SVIDEO30.ocx / hxxp://www.lanson.net/svideo3.cab {1F2F4C9E-6F09-47BC-970D-3C54734667FE} "{1F2F4C9E-6F09-47BC-970D-3C54734667FE}" - ? - (File not found | COM-object registry key not found) / https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab {3451DEDE-631F-421C-8127-FD793AFC6CC8} "{3451DEDE-631F-421C-8127-FD793AFC6CC8}" - ? - (File not found | COM-object registry key not found) / hxxp://www.symantec.com/techsupp/asa/ctrl/SymAData.cab {9F1C11AA-197B-4942-BA54-47A8489BB47F} "{9F1C11AA-197B-4942-BA54-47A8489BB47F}" - ? - (File not found | COM-object registry key not found) / hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38028.0038888889 {CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA} "{CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA}" - ? - (File not found | COM-object registry key not found) / {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} "{CE28D5D2-60CF-4C7D-9FE8-0F47A3308078}" - ? - (File not found | COM-object registry key not found) / https://www-secure.symantec.com/techsupp/asa/SymAData.cab {E2883E8F-472F-4FB0-9522-AC9BF37916A7} "{E2883E8F-472F-4FB0-9522-AC9BF37916A7}" - ? - (File not found | COM-object registry key not found) / hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )----- {48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC} "ClsidExtension" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_13.dll {E601996F-E400-41CA-804B-CD6373A7EEE2} "ClsidExtension" - "kikin" - C:\Programme\kikin\ie_kikin.dll {FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )----- {30F9B915-B755-4826-820B-08FBA6BD249D} "Conduit Engine" - "Conduit Ltd." - C:\Programme\ConduitEngine\ConduitEngine.dll <binary data> "Google Toolbar" - "Google Inc." - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} "PDFCreator Toolbar" - ? - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} "softonic-de3 Toolbar" - "Conduit Ltd." - C:\Programme\softonic-de3\tbsoft.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )----- {30F9B915-B755-4826-820B-08FBA6BD249D} "Conduit Engine" - "Conduit Ltd." - C:\Programme\ConduitEngine\ConduitEngine.dll {5CA3D70E-1895-11CF-8E15-001234567890} "DriveLetterAccess" - "Sonic Solutions" - C:\WINDOWS\system32\dla\tfswshx.dll {AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Programme\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll {72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - ? - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (File not found) {DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll {E601996F-E400-41CA-804B-CD6373A7EEE2} "kikin Plugin" - "kikin" - C:\Programme\kikin\ie_kikin.dll {C451C08A-EC37-45DF-AAAD-18B51AB5E837} "PDFCreator Toolbar Helper" - ? - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} "softonic-de3 Toolbar" - "Conduit Ltd." - C:\Programme\softonic-de3\tbsoft.dll {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "SSVHelper Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\ssv.dll {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}" - ? - (File not found | COM-object registry key not found) [Known DLLs] -----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs )----- "shell32" - "Microsoft Corporation" - C:\WINDOWS\system32\shell32.dll [Logon] -----( %AllUsersProfile%\Startmenü\Programme\Autostart )----- "Adobe Gamma Loader.exe.lnk" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe (Shortcut exists | File exists) "desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini "ExifLauncher2.lnk" - "FUJIFILM Corporation" - C:\Programme\FinePixViewer\QuickDCF2.exe (Shortcut exists | File exists) "SrvMod.lnk" - "NetWork Scanner" - C:\WINDOWS\twain_32\L12U16U2\SrvMod.exe (Shortcut exists | File exists) -----( %UserProfile%\Startmenü\Programme\Autostart )----- "OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Shortcut exists | File exists) "desktop.ini" - ? - C:\Dokumente und Einstellungen\Mercier\Startmenü\Programme\Autostart\desktop.ini -----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )----- "QuickGammaLoader" - "Eberhard Werle" - C:\Programme\QuickGamma\QuickGammaLoader.exe "swg" - "Google Inc." - "C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )----- "avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min "dla" - "Sonic Solutions" - C:\WINDOWS\system32\dla\tfswctrl.exe "GrooveMonitor" - "Microsoft Corporation" - "C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe" "LogMeIn GUI" - "LogMeIn, Inc." - "C:\Programme\LogMeIn\x86\LogMeInSystray.exe" "QuickTime Task" - "Apple Inc." - "C:\Programme\QuickTime\qttask.exe" -atboottime "REGSHAVE" - "FUJI PHOTO FILM CO., LTD." - C:\Programme\REGSHAVE\REGSHAVE.EXE /AUTORUN "RemoteControl" - "Cyberlink Corp." - C:\Programme\CyberLink\PowerDVD\PDVDServ.exe "StorageGuard" - "Sonic Solutions" - "C:\Programme\Gemeinsame Dateien\Sonic\Update Manager\sgtray.exe" /r "SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Java\jre6\bin\jusched.exe" "WOOTASKBARICON" - ? - C:\PROGRA~1\Wanadoo\TaskbarIcon.exe (File found, but it contains no detailed information) "WOOWATCH" - "France Télécom R&D" - C:\PROGRA~1\Wanadoo\Watch.exe [Network Providers] -----( HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order )----- "LogMeIn Virtual Disk Network" - "LogMeIn, Inc." - C:\WINDOWS\system32\LMIRfsClientNP.dll [Print Monitors] -----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )----- "LogMeIn Printer Port Monitor" - "LogMeIn, Inc." - C:\WINDOWS\system32\LMIport.dll "PDFCreator" - ? - C:\WINDOWS\system32\pdfcmnnt.dll (File found, but it contains no detailed information) "Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\msonpmon.dll [Services] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- ".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe "ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe "Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe "Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe "Google Software Updater" (gusvc) - "Google" - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe "Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe "LMIGuardianSvc" (LMIGuardianSvc) - "LogMeIn, Inc." - C:\Programme\LogMeIn\x86\LMIGuardianSvc.exe "LogMeIn" (LogMeIn) - "LogMeIn, Inc." - C:\Programme\LogMeIn\x86\LogMeIn.exe "LogMeIn Maintenance Service" (LMIMaint) - "LogMeIn, Inc." - C:\Programme\LogMeIn\x86\RaMaint.exe "Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE "Microsoft Office Groove Audit Service" (Microsoft Office Groove Audit Service) - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\GrooveAuditService.exe "Office Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE "Symantec Core LC" (Symantec Core LC) - ? - "C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe" (File not found) "Symantec Lic NetConnect service" (CLTNetCnService) - ? - "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe" /h ccCommon (File not found) "Windows CardSpace" (idsvc) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe "Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [Winlogon] -----( HKCU\Control Panel\IOProcs )----- "MVB" - ? - mvfs32.dll (File not found) -----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )----- "LMIinit" - "LogMeIn, Inc." - C:\WINDOWS\system32\LMIinit.dll "WgaLogon" - "Microsoft Corporation" - C:\WINDOWS\system32\WgaLogon.dll ===[ Logfile end ]=========================================[ Logfile end ]=== If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru[/QUOTE] Ich werden dann jetzt MBRCheck machen. Vielen Dank schon mal - bis bald Uschi |
|
16.03.2011, 15:34
| #14 | |
| | TR/Crypt.XPACK.Gen und TR/BegSMS.A Das ging ja sehr schnell. Und hier jetzt die MBRCheck: Zitat:
Gruß Uschi |
|
16.03.2011, 16:13
| #15 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | TR/Crypt.XPACK.Gen und TR/BegSMS.A Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs. Denk dran beide Tools zu updaten vor dem Scan!!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu TR/Crypt.XPACK.Gen und TR/BegSMS.A |
| 7-zip, audacity, avira, becker, browser, converter, desktop, error, excel, fehler, flash player, google, graphic, helper, home, iexplore.exe, internet, internet explorer, location, logfile, microsoft office word, oldtimer, pum.hijack.startmenu, pup.radmin, registry, rundll, saver, scan, security, shell32.dll, sketchup, software, spyware.onlinegames, tr/crypt.xpack.ge, tr/crypt.xpack.gen, trojaner, usb, versteckte objekte, viren, windows, windows internet |
Linear-Darstellung
