| |
| |||||||
Log-Analyse und Auswertung: Postbank 20 Tans-Phishing-OverlayWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
18.04.2011, 18:54
| #1 | ||
 |  Postbank 20 Tans-Phishing-Overlay Hallo TB-Team! Nach über zwei Jahrzehnten ohne Probleme hat es mich jetzt auch mal erwischt. Nach dem Öffnen einer PDF vor ein paar Tagen ist der Explorer abgeschmiert, nach einem Systemneustart war das System plötzlich langsamer als sonst. Heute kam beim Einloggen auf der Postbank Onlinebankingseite plötzlich ein Overlay mit der 20 Tans-Aufforderung, sowohl im IE als auch im Firefox auf meiner Workstation. Auf meinem Laptop tritt das Problem nicht auf, also schließe ich einen gecrackten Router schonmal weitesgehend aus. Bevor ich die Anleitung mit load.exe befolgt habe, hatte ich schonmal mit Malwarebytes und SUPERAntiSpyware gescannt, hier zunächst deren Logs. Malwarebytes Zitat:
Zitat:
Dann habe ich eure Seite gefunden und load.exe ausgeführt und die Anleitung befolgt. Dabei ist tfc.exe beim ersten mal abgestürzt, hat die Arbeit beim zweiten mal starten aber erfolgreich beendet. Die Logs befinden sich aus Platzgründen im Anhang. Ich hoffe ihr könnt mir weiterhelfen. Danke für jegliche Mühe im Voraus! Gruß Heiko |
|
18.04.2011, 20:43
| #2 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Postbank 20 Tans-Phishing-OverlayZitat:
 Bitte routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!
__________________ |
|
18.04.2011, 21:09
| #3 | ||
| | Postbank 20 Tans-Phishing-Overlay Hallo und danke. ^^
__________________Ich habe noch zwei Vollscans, einer von heute Mittag, und einer von gerade ebenn ach erneutem Update. Erstaunlicherweise hat der erste Vollscan sehr viel weniger Objekte untersucht ?! Zitat:
Zitat:
|
|
18.04.2011, 21:35
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Postbank 20 Tans-Phishing-Overlay Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!) Code:
ATTFilter :OTL
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{2fc69bde-0b18-11dd-abdd-001bfcc30921}\Shell\´ò¿ª(&O)\command - "" = I:\RECYCLER\UcHelp.exe
O33 - MountPoints2\{459e52ab-46a4-11dc-82c3-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{459e52ab-46a4-11dc-82c3-806e6f6e6963}\Shell\AutoRun\command - "" = D:\arun.exe
O33 - MountPoints2\{bd98ad69-77cd-11df-8a25-001bfcc30921}\Shell\´ò¿ª(&O)\command - "" = J:\RECYCLER\UcHelp.exe
[2008.08.11 11:03:10 | 000,047,616 | ---- | C] () -- C:\Windows\System32\zmhhpaso.dll
[2008.08.11 11:03:08 | 000,081,920 | ---- | C] () -- C:\Windows\System32\zmhhpaudcp.exe
[2009.05.27 11:48:08 | 000,094,208 | ---- | C] () -- C:\Windows\System32\zmbv.dll
[2009.07.03 17:27:02 | 000,123,024 | ---- | C] () -- C:\Users\Heiko\AppData\Local\debuggee.mdmp
@Alternate Data Stream - 55920 bytes -> C:\ProgramData:$SS_DESCRIPTOR_LVVWVBGV0VFBTLX4D06YH7LVUTPXGJMBKE1R0WT1VH7E24F7PHCTVF4VMVFVVX4VM
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:FD19413D
@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:638E6F6B
:Commands
[purity]
[resethosts]
[emptytemp]
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet. Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
18.04.2011, 21:49
| #5 | |
| | Postbank 20 Tans-Phishing-Overlay OTL ist durch, mit folgendem Output nach dem Neustart: Zitat:
|
|
18.04.2011, 21:55
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Postbank 20 Tans-Phishing-Overlay Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, bitte unhide ausführen: Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop. Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )  Vista und 7 User müssen das Tool per Rechtsklick als Administrator ausführen!
__________________ --> Postbank 20 Tans-Phishing-Overlay |
|
18.04.2011, 22:03
| #7 | ||
| | Postbank 20 Tans-Phishing-Overlay Unhide war nicht nötig. Den TDSSKiller hatte ich heute schonmal laufen, hier das Log vom ersten Durchlauf: Zitat:
Zitat:
|
|
19.04.2011, 10:40
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Postbank 20 Tans-Phishing-Overlay Dann bitte jetzt CF ausführen: ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
19.04.2011, 18:35
| #9 |
| | Postbank 20 Tans-Phishing-Overlay Guten Abend! Ich habe das Gefühl, ComboFix läuft nicht durch. Ich habs gegen 15:00 Uhr gestartet, bis jetzt sind nur zwei Fertiggestellt-Meldungen aufgetaucht (Stufe 1 und 2) ... wie lange kann sowas dauern? Ist schon der zweite Versuch, das Programm laufen zu lassen, beim ersten Mal dachte ich, es hat sich weggehängt, weil nach über 2 Stunden überhaupt nichts kam, und der Prozessor und sämtliche Ressourcen waren komplett "still", genauso wie jetzt wieder. Was soll ich tun? |
|
19.04.2011, 19:28
| #10 | |
| | Postbank 20 Tans-Phishing-Overlay Das Problem saß wie so oft vor dem Bildschirm, hab an alles gedacht, außer das Deaktivieren der Firewall...  Hier das ComboFix-Log: Zitat:
|
|
19.04.2011, 20:19
| #11 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Postbank 20 Tans-Phishing-Overlay Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen. Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst. Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
19.04.2011, 22:27
| #12 |
| | Postbank 20 Tans-Phishing-Overlay Hier die Logs von GMER und OSAM: GMER Logfile: Code:
ATTFilter GMER 1.0.15.15570 - hxxp://www.gmer.net
Rootkit scan 2011-04-19 22:15:05
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 SAMSUNG_HD501LJ rev.CR100-10
Running: g2m3e4r.exe; Driver: C:\Users\Heiko\AppData\Local\Temp\uxldypow.sys
---- Kernel code sections - GMER 1.0.15 ----
.text C:\Windows\system32\drivers\acedrv01.sys section is writeable [0x9191B000, 0x2E0F4, 0xE8000020]
.pklstb C:\Windows\system32\drivers\acedrv01.sys entry point in ".pklstb" section [0x9195A000]
.relo2 C:\Windows\system32\drivers\acedrv01.sys unknown last section [0x91974000, 0x8E, 0x42000040]
.text C:\Windows\system32\drivers\acedrv02.sys section is writeable [0x91976000, 0x303A4, 0xE8000020]
.pklstb C:\Windows\system32\drivers\acedrv02.sys entry point in ".pklstb" section [0x919B8000]
.relo2 C:\Windows\system32\drivers\acedrv02.sys unknown last section [0x919D3000, 0x8E, 0x42000040]
.text C:\Windows\system32\drivers\acedrv03.sys section is writeable [0x80C0A000, 0x303A4, 0xE8000020]
.pklstb C:\Windows\system32\drivers\acedrv03.sys entry point in ".pklstb" section [0x80C4C000]
.relo2 C:\Windows\system32\drivers\acedrv03.sys unknown last section [0x80C67000, 0x8E, 0x42000040]
.text C:\Windows\system32\drivers\acedrv04.sys section is writeable [0x80C69000, 0x303A4, 0xE8000020]
.pklstb C:\Windows\system32\drivers\acedrv04.sys entry point in ".pklstb" section [0x80CAB000]
.relo2 C:\Windows\system32\drivers\acedrv04.sys unknown last section [0x80CC6000, 0x8E, 0x42000040]
.text C:\Windows\system32\drivers\acedrv05.sys section is writeable [0x80CC8000, 0x30A4A, 0xE8000020]
.pklstb C:\Windows\system32\drivers\acedrv05.sys entry point in ".pklstb" section [0x80D0A000]
.relo2 C:\Windows\system32\drivers\acedrv05.sys unknown last section [0x80D25000, 0x8E, 0x42000040]
.text C:\Windows\system32\drivers\acedrv06.sys section is writeable [0x80D27000, 0x319AA, 0xE8000020]
.pklstb C:\Windows\system32\drivers\acedrv06.sys entry point in ".pklstb" section [0x80D6A000]
.relo2 C:\Windows\system32\drivers\acedrv06.sys unknown last section [0x80D85000, 0x8E, 0x42000040]
.text C:\Windows\system32\drivers\acedrv07.sys section is writeable [0x80D87000, 0x328BA, 0xE8000020]
.pklstb C:\Windows\system32\drivers\acedrv07.sys entry point in ".pklstb" section [0x80DCB000]
.relo2 C:\Windows\system32\drivers\acedrv07.sys unknown last section [0x80DE7000, 0x8E, 0x42000040]
.text C:\Windows\system32\drivers\ACEDRV09.sys section is writeable [0x80E0E000, 0x3326E, 0xE8000020]
.pklstb C:\Windows\system32\drivers\ACEDRV09.sys entry point in ".pklstb" section [0x80E53000]
.relo2 C:\Windows\system32\drivers\ACEDRV09.sys unknown last section [0x80E6F000, 0x8E, 0x42000040]
---- User code sections - GMER 1.0.15 ----
.text C:\Windows\explorer.exe[2600] ntdll.dll!NtCreateThread 779E4344 5 Bytes CALL 01730000
.text C:\Windows\explorer.exe[2600] ntdll.dll!NtProtectVirtualMemory 779E4B84 5 Bytes CALL 01710000
.text C:\Windows\explorer.exe[2600] ntdll.dll!NtCreateUserProcess 779E5654 5 Bytes CALL 01790000
.text C:\Windows\explorer.exe[2600] kernel32.dll!ExitProcess 76C241D8 5 Bytes CALL 017B0000
.text C:\Program Files\Internet Explorer\ieuser.exe[4064] ntdll.dll!NtCreateThread 779E4344 5 Bytes CALL 003B0000
.text C:\Program Files\Internet Explorer\ieuser.exe[4064] ntdll.dll!NtProtectVirtualMemory 779E4B84 5 Bytes CALL 00390000
.text C:\Program Files\Internet Explorer\ieuser.exe[4064] ntdll.dll!NtCreateUserProcess 779E5654 5 Bytes CALL 00950000
.text C:\Program Files\Internet Explorer\ieuser.exe[4064] kernel32.dll!ExitProcess 76C241D8 5 Bytes CALL 00D00000
.text C:\Program Files\Internet Explorer\ieuser.exe[4064] ADVAPI32.dll!CryptGenKey 7661553E 5 Bytes CALL 01EF0000
.text C:\Program Files\Internet Explorer\ieuser.exe[4064] ADVAPI32.dll!CryptDeriveKey 7661FCAE 5 Bytes CALL 01F10000
.text C:\Program Files\Internet Explorer\ieuser.exe[4064] ADVAPI32.dll!CryptImportKey 76636649 5 Bytes CALL 01ED0000
.text C:\Program Files\Internet Explorer\ieuser.exe[4064] ws2_32.dll!send 7650659B 5 Bytes CALL 01E90000
.text C:\Program Files\Internet Explorer\ieuser.exe[4064] wininet.dll!HttpOpenRequestA 7653FBBC 5 Bytes CALL 01E30000
.text C:\Program Files\Internet Explorer\ieuser.exe[4064] wininet.dll!InternetConnectA 76540692 5 Bytes CALL 00D40000
.text C:\Program Files\Internet Explorer\ieuser.exe[4064] wininet.dll!HttpAddRequestHeadersA 76541A68 5 Bytes CALL 01CF0000
.text C:\Program Files\Internet Explorer\ieuser.exe[4064] wininet.dll!InternetCloseHandle 76542DB8 5 Bytes CALL 01E70000
.text C:\Program Files\Internet Explorer\ieuser.exe[4064] wininet.dll!InternetReadFile 765474B9 5 Bytes CALL 00D20000
.text C:\Program Files\Internet Explorer\ieuser.exe[4064] wininet.dll!HttpOpenRequestW 76547ECA 5 Bytes CALL 01E50000
.text C:\Program Files\Internet Explorer\ieuser.exe[4064] wininet.dll!InternetQueryDataAvailable 76548228 5 Bytes CALL 019F0000
.text C:\Program Files\Internet Explorer\ieuser.exe[4064] wininet.dll!HttpSendRequestA 7654D3A0 5 Bytes CALL 01CB0000
.text C:\Program Files\Internet Explorer\ieuser.exe[4064] wininet.dll!HttpSendRequestW 7655E1C9 5 Bytes CALL 01CD0000
.text C:\Program Files\Internet Explorer\ieuser.exe[4064] wininet.dll!InternetReadFileExW 765617CA 5 Bytes CALL 019D0000
.text C:\Program Files\Internet Explorer\ieuser.exe[4064] wininet.dll!InternetReadFileExA 76561802 5 Bytes CALL 019B0000
.text C:\Program Files\Internet Explorer\ieuser.exe[4064] wininet.dll!HttpAddRequestHeadersW 765AB901 5 Bytes CALL 01D10000
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\Windows\explorer.exe[2600] @ C:\Windows\explorer.exe [gdiplus.dll!GdiplusShutdown] [74AA7817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\explorer.exe[2600] @ C:\Windows\explorer.exe [gdiplus.dll!GdipCloneImage] [74AFA86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\explorer.exe[2600] @ C:\Windows\explorer.exe [gdiplus.dll!GdipDrawImageRectI] [74AABB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\explorer.exe[2600] @ C:\Windows\explorer.exe [gdiplus.dll!GdipSetInterpolationMode] [74A9F695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\explorer.exe[2600] @ C:\Windows\explorer.exe [gdiplus.dll!GdiplusStartup] [74AA75E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\explorer.exe[2600] @ C:\Windows\explorer.exe [gdiplus.dll!GdipCreateFromHDC] [74A9E7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\explorer.exe[2600] @ C:\Windows\explorer.exe [gdiplus.dll!GdipCreateBitmapFromStreamICM] [74AD8395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\explorer.exe[2600] @ C:\Windows\explorer.exe [gdiplus.dll!GdipCreateBitmapFromStream] [74AADA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\explorer.exe[2600] @ C:\Windows\explorer.exe [gdiplus.dll!GdipGetImageHeight] [74A9FFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\explorer.exe[2600] @ C:\Windows\explorer.exe [gdiplus.dll!GdipGetImageWidth] [74A9FF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\explorer.exe[2600] @ C:\Windows\explorer.exe [gdiplus.dll!GdipDisposeImage] [74A971CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\explorer.exe[2600] @ C:\Windows\explorer.exe [gdiplus.dll!GdipLoadImageFromFileICM] [74B2CAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\explorer.exe[2600] @ C:\Windows\explorer.exe [gdiplus.dll!GdipLoadImageFromFile] [74ACC8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\explorer.exe[2600] @ C:\Windows\explorer.exe [gdiplus.dll!GdipDeleteGraphics] [74A9D968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\explorer.exe[2600] @ C:\Windows\explorer.exe [gdiplus.dll!GdipFree] [74A96853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\explorer.exe[2600] @ C:\Windows\explorer.exe [gdiplus.dll!GdipAlloc] [74A9687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\explorer.exe[2600] @ C:\Windows\explorer.exe [gdiplus.dll!GdipSetCompositingMode] [74AA2AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 snapman.sys (Acronis Snapshot API/Acronis)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 timntr.sys (Acronis True Image Backup Archive Explorer/Acronis)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 snapman.sys (Acronis Snapshot API/Acronis)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 timntr.sys (Acronis True Image Backup Archive Explorer/Acronis)
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\atapi \Device\Ide\IdePort0 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\atapi \Device\Ide\IdePort1 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\atapi \Device\Ide\IdePort2 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\atapi \Device\Ide\IdePort3 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 snapman.sys (Acronis Snapshot API/Acronis)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 timntr.sys (Acronis True Image Backup Archive Explorer/Acronis)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 snapman.sys (Acronis Snapshot API/Acronis)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 timntr.sys (Acronis True Image Backup Archive Explorer/Acronis)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume5 snapman.sys (Acronis Snapshot API/Acronis)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume5 timntr.sys (Acronis True Image Backup Archive Explorer/Acronis)
Device \Driver\mv61xx \Device\Scsi\mv61xx1 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\mv61xx \Device\Scsi\mv61xx1Port4Path0Target0Lun0 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\mv61xx \Device\Scsi\mv61xx1Port4Path0Target19Lun0 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
---- EOF - GMER 1.0.15 ----
OSAM Logfile: Code:
ATTFilter Report of OSAM: Autorun Manager v5.0.11926.0 hxxp://www.online-solutions.ru/en/ Saved at 23:30:03 on 19.04.2011 OS: Windows Vista Business Edition Service Pack 2 (Build 6002), 32-bit Default Browser: Microsoft Corporation Internet Explorer 7.00.6000.16386 Scanner Settings [x] Rootkits detection (hidden registry) [x] Rootkits detection (hidden files) [x] Retrieve files information [x] Check Microsoft signatures Filters [ ] Trusted entries [ ] Empty entries [x] Hidden registry entries (rootkit activity) [x] Exclusively opened files [x] Not found files [x] Files without detailed information [x] Existing files [ ] Non-startable services [ ] Non-startable drivers [x] Active entries [x] Disabled entries [Control Panel Objects] -----( %SystemRoot%\system32 )----- "nvcpl.cpl" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.cpl "zmhhpaudio.cpl" - "ZOOM" - C:\Windows\system32\zmhhpaudio.cpl -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )----- "Adobe Gamma" - ? - C:\Program "Wacom Tablett" - ? - C:\Windows\system32\WacomTablet.cpl (File not found) [Drivers] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "acedrv01" (acedrv01) - "ACE GmbH" - C:\Windows\system32\drivers\acedrv01.sys "acedrv02" (acedrv02) - "ACE GmbH" - C:\Windows\system32\drivers\acedrv02.sys "acedrv03" (acedrv03) - "ACE GmbH" - C:\Windows\system32\drivers\acedrv03.sys "acedrv04" (acedrv04) - "Protect Software GmbH" - C:\Windows\system32\drivers\acedrv04.sys "acedrv05" (acedrv05) - "Protect Software GmbH" - C:\Windows\system32\drivers\acedrv05.sys "acedrv06" (acedrv06) - "Protect Software GmbH" - C:\Windows\system32\drivers\acedrv06.sys "acedrv07" (acedrv07) - "Protect Software GmbH" - C:\Windows\system32\drivers\acedrv07.sys "ACEDRV09" (ACEDRV09) - "Protect Software GmbH" - C:\Windows\system32\drivers\ACEDRV09.sys "Acronis Snapshots Manager" (snapman) - "Acronis" - C:\Windows\System32\DRIVERS\snapman.sys "Acronis True Image Backup Archive Explorer" (timounter) - "Acronis" - C:\Windows\System32\DRIVERS\timntr.sys "Acronis True Image FS Filter" (tifsfilter) - "Acronis" - C:\Windows\System32\DRIVERS\tifsfilt.sys "AsIO" (AsIO) - ? - C:\Windows\System32\drivers\AsIO.sys (File found, but it contains no detailed information) "catchme" (catchme) - ? - C:\cofi\catchme.sys (File not found) "cdrbsdrv" (cdrbsdrv) - "B.H.A Corporation" - C:\Windows\system32\drivers\cdrbsdrv.sys "ENTECH" (ENTECH) - "EnTech Taiwan" - C:\Windows\system32\DRIVERS\ENTECH.sys "giveio" (giveio) - ? - C:\Windows\System32\giveio.sys (File found, but it contains no detailed information) "hSONYPVh" (hSONYPVh) - ? - C:\Users\Heiko\AppData\Local\Temp\hSONYPVh.sys (File not found) "IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys (File not found) "IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys (File not found) "IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys (File not found) "LANCOM Secure Client NDIS6 Driver" (ncplelhp) - ? - C:\Windows\System32\DRIVERS\ncplelhp.sys (File not found) "Logitech POP Suppression Filter" (lvpopflt) - ? - C:\Windows\System32\DRIVERS\lvpopflt.sys (File not found) "Logitech USB Monitor Filter" (LVUSBSta) - ? - C:\Windows\System32\drivers\LVUSBSta.sys (File not found) "MpKsl1d162cca" (MpKsl1d162cca) - "Microsoft Corporation" - C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{D466CA8F-55D8-4E08-AAB7-DDF418803F41}\MpKsl1d162cca.sys "MpKsl47c56faf" (MpKsl47c56faf) - ? - C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{A308A4AE-2FC1-4156-A5D9-8B76C067CCE8}\MpKsl47c56faf.sys (File not found) "QuickCam Pro for Notebooks(UVC)" (LVUVC) - ? - C:\Windows\System32\DRIVERS\lvuvc.sys (File not found) "SASDIFSV" (SASDIFSV) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - E:\superantispyware\SASDIFSV.SYS "SASKUTIL" (SASKUTIL) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - E:\superantispyware\SASKUTIL.SYS "speedfan" (speedfan) - "Windows (R) 2000 DDK provider" - C:\Windows\System32\speedfan.sys "StarForce Protection Environment Driver (version 1.x)" (sfdrv01) - "Protection Technology (StarForce)" - C:\Windows\System32\drivers\sfdrv01.sys "StarForce Protection Helper Driver (version 2.x)" (sfhlp02) - "Protection Technology (StarForce)" - C:\Windows\System32\drivers\sfhlp02.sys "StarForce Protection Synchronization Driver (version 2.x)" (sfsync02) - "Protection Technology" - C:\Windows\System32\drivers\sfsync02.sys "SynasUSB" (SynasUSB) - "SIA Syncrosoft" - C:\Windows\System32\drivers\SynasUSB.sys "uxldypow" (uxldypow) - ? - C:\Users\Heiko\AppData\Local\Temp\uxldypow.sys (Hidden registry entry, rootkit activity | File not found) "ZOOM H Series High Performance Audio Driver Service" (ZMHHPAudioSrv) - "ZOOM" - C:\Windows\System32\drivers\zmhhpau.sys [Explorer] -----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )----- {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? - (File not found | COM-object registry key not found) {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? - (File not found | COM-object registry key not found) {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? - (File not found | COM-object registry key not found) {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? - (File not found | COM-object registry key not found) -----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )----- {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - ? - C:\Program {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - E:\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll -----( HKLM\Software\Classes\Protocols\Handler )----- {314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - ? - C:\Program {828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL {828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )----- {AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? - (File not found | COM-object registry key not found) -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )----- {911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? - (File not found | COM-object registry key not found) {CF67796C-F57F-45F8-92FB-AD698826C602} ".contact shell context menu" - ? - C:\Program {8082C5E6-4C27-48ec-A809-B8E1122E8F97} ".contact shell extension handler" - ? - C:\Program {16C2C29D-0E5F-45f3-A445-03E03F587B7D} ".group shell context menu" - ? - C:\Program {4F58F63F-244B-4c07-B29F-210BE59BE9B4} ".group shell extension handler" - ? - C:\Program {23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - ? - E:\7-Zip\7-zip.dll {C539A15A-3AF9-4c92-B771-50CB78F5C751} "Acronis True Image Shell Context Menu Extension" - "Acronis" - E:\TrueImage\tishell.dll {C539A15B-3AF9-4c92-B771-50CB78F5C751} "Acronis True Image Shell Extension" - "Acronis" - E:\TrueImage\tishell.dll {1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? - (File not found | COM-object registry key not found) {34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? - (File not found | COM-object registry key not found) {13D3C4B8-B179-4ebb-BF62-F704173E7448} "CLSID_ContactReadingPane" - ? - C:\Program {0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? - (File not found | COM-object registry key not found) {3B52CC4A-19E9-43F5-A626-F89267A5E43F} "ddsExtractor Class" - ? - C:\Program {A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - ? - C:\Program {AE1514A4-5D7D-4D1B-BC7F-320E6962B0DD} "DropTarget Class" - "HHD Software Ltd." - E:\HexEditorNeo\FileDocument.dll {09A47860-11B0-4DA5-AFA5-26D86198A780} "EPP" - "Microsoft Corporation" - C:\PROGRA~1\MI239C~1\shellext.dll {2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? - (File not found | COM-object registry key not found) {32714800-2E5F-11d0-8B85-00AA0044F941} "For &People..." - ? - C:\Program {00020d75-0000-0000-c000-000000000046} "lnkfile" - ? - (File not found | COM-object registry key not found) {FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D} "Meine freigegebenen Ordner" - ? - C:\Program {2206CDB2-19C1-11D1-89E0-00C04FD7A829} "Microsoft OLE DB Service Component Data Links" - ? - C:\Program {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} "NVIDIA CPL Context Menu Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvshext.dll {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - E:\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll {087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - E:\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll {63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - E:\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll {3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - E:\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll {00f20eb5-8fd6-4d9d-b75e-36801766c8f1} "PhotoAcqDropTarget" - ? - C:\Program {82AA9188-44E0-40B9-B956-43A10C315B4F} "RootShellFolder Class" - "SmartSoft Ltd." - E:\SmartFTP Client\sfFTPShellExtension.dll {C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? - (File not found | COM-object registry key not found) {E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? - (File not found | COM-object registry key not found) {2ED7FD81-CBA6-45E5-A49A-5E84889A94E2} "ShellDragDropHandler Class" - "SmartSoft Ltd." - E:\SmartFTP Client\sfShellTools.dll {7568C3F3-DF7E-436A-95C2-772819DF58B4} "ShellFolderExternal Class" - "SmartSoft Ltd." - E:\SmartFTP Client\sfFavoritesShellExtension.dll {119310E6-5FB7-4eeb-BEDB-9E229E76B9B4} "ShellFolderMultiUploadDestination Class" - "SmartSoft Ltd." - E:\SmartFTP Client\sfFTPShellExtension.dll {3B164627-7060-47BB-A1BE-DF5540B02821} "ShellFolderMultiUploadSource Class" - "SmartSoft Ltd." - E:\SmartFTP Client\sfFTPShellExtension.dll {6E0A0931-B89D-45B7-8BF0-F221A6D67257} "ShellFolderRoot Class" - "SmartSoft Ltd." - E:\SmartFTP Client\sfFavoritesShellExtension.dll {EB5EE1F3-041A-4c03-9D51-2BEC6715FB00} "ShellFolderSearchRoot Class" - "SmartSoft Ltd." - E:\SmartFTP Client\sfFTPShellExtension.dll {F87DED31-303F-4ED1-9BCE-D360FBC74E0A} "SmartFTP ContextMenu Shell Extension" - "SmartSoft Ltd." - E:\SmartFTP Client\sfShellTools.dll {EA5A76F7-8138-4B53-B0F5-ADCC730CAFBD} "SmartFTP Drop ShellIconOverlayHandler" - "SmartSoft Ltd." - E:\SmartFTP Client\sfShellTools.dll {FD504287-1372-40d2-ACA6-216A8FCC243D} "SmartFTP FavoritesShellFolder Class" - "SmartSoft Ltd." - E:\SmartFTP Client\sfFavoritesShellExtension.dll {0848278D-D88B-445b-BEDC-7DFBDB061F5F} "SmartFTP FavoritesShellFolderDesktop class" - "SmartSoft Ltd." - E:\SmartFTP Client\sfFavoritesShellExtension.dll {40FDFA48-5F4E-4627-A78E-6A49A3D4492F} "SmartFTP ShellDropHandler Class" - "SmartSoft Ltd." - E:\SmartFTP Client\sfShellTools.dll {15D633E2-AD00-465b-9EC7-F56B7CDF8E27} "Tablet PC Input Panel" - ? - C:\Program {DBD8E168-244D-448C-9922-25508950D1DC} "USIShellExt Class" - ? - C:\Program {d8559eb9-20c0-410e-beda-7ed416aecc2a} "Windows Defender" - ? - C:\Program {2781761E-28E0-4109-99FE-B9D127C57AFE} "Windows Defender IOfficeAntiVirus implementation" - ? - C:\Program {6b9228da-9c15-419e-856c-19e768a13bdc} "Windows gadget DropTarget" - ? - C:\Program {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A} "Windows Photo Gallery Viewer Image Verbs" - ? - C:\Program {E598560B-28D5-46aa-A14A-8A3BEA34B576} "Windows Photo Gallery Viewer Video Verbs" - ? - C:\Program {da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? - (File not found | COM-object registry key not found) {37efd44d-ef8d-41b1-940d-96973a50e9e0} "Windows Sidebar Properties" - ? - C:\Program [Internet Explorer] -----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )----- <binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found) -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )----- {53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - E:\SPYBOT~1\SDHelper.dll "ICQ7.4" - "ICQ, LLC." - E:\ICQ7.4\ICQ.exe -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )----- {18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - ? - C:\Program {53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - E:\SPYBOT~1\SDHelper.dll {9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID Sign-in Helper" - ? - C:\Program [Logon] -----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )----- "desktop.ini" - ? - C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini "Dropbox.lnk" - "Dropbox, Inc." - C:\Users\Heiko\AppData\Roaming\Dropbox\bin\Dropbox.exe (Shortcut exists | File exists) -----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )----- "desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini "SpeedFan.lnk" - "Almico Software (www.almico.com)" - E:\SpeedFan\speedfan.exe (Shortcut exists | File exists) -----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )----- "Advlib" - ? - C:\Users\Heiko\AppData\Roaming\Dvdpack\modfree.exe (File found, but it contains no detailed information) "SpybotSD TeaTimer" - "Safer-Networking Ltd." - E:\Spybot - Search & Destroy\TeaTimer.exe -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )----- "Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe" "MSC" - "Microsoft Corporation" - "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [Print Monitors] -----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )----- "avm:" - "AVM Berlin GmbH" - C:\Windows\system32\avmprmon.dll "Canon MFNP Port" - "CANON INC." - C:\Windows\system32\CNCENPM.dll "CPCA Language Monitor3b" - "CANON INC." - C:\Windows\system32\CNAS0MOK.DLL "PDFCreator" - ? - C:\Windows\system32\pdfcmnnt.dll (File found, but it contains no detailed information) [Services] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "@%ProgramFiles%\Windows Defender\MsMpRes.dll,-103" (WinDefend) - ? - C:\Program "@C:\Program Files\Microsoft Security Client\Antimalware\MpAsDesc.dll,-243" (NisSrv) - "Microsoft Corporation" - C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe "@C:\Program Files\NOS\bin\getPlus_Helper.dll,-101" (getPlusHelper) - ? - C:\Program "@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe "Adobe LM Service" (Adobe LM Service) - "Adobe Systems" - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe "B's Recorder GOLD Library General Service" (bgsvcgen) - "B.H.A Corporation" - C:\Windows\System32\bgsvcgen.exe "Canon Driver Information Assist Service" (Canon Driver Information Assist Service) - "CANON INC." - C:\Program Files\Canon\DIAS\CnxDIAS.exe "Google Updater Service" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe "M-Audio Series II MIDI Installer" (MA_CMIDI_InstallerService) - ? - C:\Program "Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe "Microsoft Antimalware Service" (MsMpSvc) - "Microsoft Corporation" - C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe "NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe "Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE "SBSD Security Center Service" (SBSDWSCService) - "Safer Networking Ltd." - E:\Spybot - Search & Destroy\SDWinSec.exe "SQL Server (SQLEXPRESS)" (MSSQL$SQLEXPRESS) - "Microsoft Corporation" - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe "SQL Server VSS Writer" (SQLWriter) - "Microsoft Corporation" - C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe "SQL Server-Browser" (SQLBrowser) - "Microsoft Corporation" - C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe "Ulead Burning Helper" (UleadBurningHelper) - ? - C:\Program "Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE ===[ Logfile end ]=========================================[ Logfile end ]=== |
|
19.04.2011, 22:38
| #13 |
| | Postbank 20 Tans-Phishing-Overlay ... und hier das Log von MBRCheck: MBRCheck, version 1.2.3 (c) 2010, AD Command-line: Windows Version: Windows Vista Business Edition Windows Information: Service Pack 2 (build 6002), 32-bit Base Board Manufacturer: ASUSTeK Computer INC. BIOS Manufacturer: American Megatrends Inc. System Manufacturer: System manufacturer System Product Name: P5K SE Logical Drives Mask: 0x000000fc Kernel Drivers (total 157): 0x82650000 \SystemRoot\system32\ntkrnlpa.exe 0x8261D000 \SystemRoot\system32\hal.dll 0x80403000 \SystemRoot\system32\kdcom.dll 0x8040A000 \SystemRoot\system32\mcupdate_GenuineIntel.dll 0x8047A000 \SystemRoot\system32\PSHED.dll 0x8048B000 \SystemRoot\system32\BOOTVID.dll 0x80493000 \SystemRoot\system32\CLFS.SYS 0x804D4000 \SystemRoot\system32\CI.dll 0x80606000 \SystemRoot\system32\drivers\Wdf01000.sys 0x80682000 \SystemRoot\system32\drivers\WDFLDR.SYS 0x8068F000 \SystemRoot\system32\drivers\acpi.sys 0x806D5000 \SystemRoot\system32\drivers\WMILIB.SYS 0x806DE000 \SystemRoot\system32\drivers\msisadrv.sys 0x806E6000 \SystemRoot\system32\drivers\pci.sys 0x8070D000 \SystemRoot\System32\drivers\partmgr.sys 0x8071C000 \SystemRoot\system32\drivers\volmgr.sys 0x8072B000 \SystemRoot\System32\drivers\volmgrx.sys 0x80775000 \SystemRoot\system32\drivers\pciide.sys 0x8077C000 \SystemRoot\system32\drivers\PCIIDEX.SYS 0x8078A000 \SystemRoot\System32\drivers\mountmgr.sys 0x8079A000 \SystemRoot\System32\drivers\sfsync02.sys 0x807A3000 \SystemRoot\system32\drivers\atapi.sys 0x807AB000 \SystemRoot\system32\drivers\ataport.SYS 0x807C9000 \SystemRoot\system32\DRIVERS\mv61xx.sys 0x805B4000 \SystemRoot\system32\DRIVERS\SCSIPORT.SYS 0x83004000 \SystemRoot\system32\drivers\fltmgr.sys 0x83036000 \SystemRoot\system32\drivers\fileinfo.sys 0x83046000 \SystemRoot\System32\Drivers\ksecdd.sys 0x830B7000 \SystemRoot\system32\drivers\ndis.sys 0x831C2000 \SystemRoot\system32\drivers\msrpc.sys 0x83208000 \SystemRoot\system32\drivers\NETIO.SYS 0x83243000 \SystemRoot\System32\drivers\tcpip.sys 0x83330000 \SystemRoot\System32\drivers\fwpkclnt.sys 0x8334B000 \SystemRoot\system32\DRIVERS\timntr.sys 0x8B40B000 \SystemRoot\System32\Drivers\Ntfs.sys 0x8B51B000 \SystemRoot\system32\drivers\volsnap.sys 0x8B554000 \SystemRoot\System32\Drivers\spldr.sys 0x8B55C000 \SystemRoot\system32\speedfan.sys 0x8B55E000 \SystemRoot\system32\DRIVERS\snapman.sys 0x8B579000 \SystemRoot\System32\drivers\sfhlp02.sys 0x8B581000 \SystemRoot\System32\drivers\sfdrv01.sys 0x8B594000 \SystemRoot\System32\Drivers\mup.sys 0x8B5A3000 \SystemRoot\system32\giveio.sys 0x8B5A4000 \SystemRoot\System32\drivers\ecache.sys 0x8B5CB000 \SystemRoot\system32\drivers\disk.sys 0x8B5DC000 \SystemRoot\system32\drivers\CLASSPNP.SYS 0x8B400000 \SystemRoot\system32\drivers\crcdisk.sys 0x833CB000 \SystemRoot\system32\DRIVERS\tunmp.sys 0x833D4000 \SystemRoot\system32\DRIVERS\intelppm.sys 0x8FE0B000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys 0x907A8000 \SystemRoot\system32\DRIVERS\nvBridge.kmd 0x8FA01000 \SystemRoot\System32\drivers\dxgkrnl.sys 0x8FAA1000 \SystemRoot\System32\drivers\watchdog.sys 0x8FAAD000 \SystemRoot\system32\DRIVERS\usbuhci.sys 0x8FAB8000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0x8FAF6000 \SystemRoot\system32\DRIVERS\usbehci.sys 0x8FB05000 \SystemRoot\system32\DRIVERS\HDAudBus.sys 0x8FB92000 \SystemRoot\System32\Drivers\cdrbsdrv.SYS 0x8FB9B000 \SystemRoot\system32\DRIVERS\cdrom.sys 0x8FBB3000 \SystemRoot\system32\DRIVERS\l160x86.sys 0x8FBC2000 \SystemRoot\system32\DRIVERS\ASACPI.sys 0x8FBCA000 \SystemRoot\system32\DRIVERS\serial.sys 0x8FBE4000 \SystemRoot\system32\DRIVERS\serenum.sys 0x907AA000 \SystemRoot\system32\DRIVERS\i8042prt.sys 0x8FBEE000 \SystemRoot\system32\DRIVERS\kbdclass.sys 0x907BD000 \SystemRoot\system32\DRIVERS\msiscsi.sys 0x90C07000 \SystemRoot\system32\DRIVERS\storport.sys 0x90C48000 \SystemRoot\system32\DRIVERS\TDI.SYS 0x90C53000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0x90C6A000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0x90C75000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0x90C98000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0x90CA7000 \SystemRoot\system32\DRIVERS\raspptp.sys 0x90CBB000 \SystemRoot\system32\DRIVERS\rassstp.sys 0x90CD0000 \SystemRoot\system32\DRIVERS\rdpdr.sys 0x90D59000 \SystemRoot\system32\DRIVERS\termdd.sys 0x90D69000 \SystemRoot\system32\DRIVERS\mouclass.sys 0x90D74000 \SystemRoot\system32\DRIVERS\swenum.sys 0x90D76000 \SystemRoot\system32\DRIVERS\ks.sys 0x90DA0000 \SystemRoot\system32\DRIVERS\mssmbios.sys 0x90DAA000 \SystemRoot\system32\DRIVERS\umbus.sys 0x90DB7000 \SystemRoot\system32\DRIVERS\usbhub.sys 0x90DEC000 \SystemRoot\System32\Drivers\NDProxy.SYS 0x90E01000 \SystemRoot\system32\drivers\RTKVHDA.sys 0x9100F000 \SystemRoot\system32\drivers\portcls.sys 0x9103C000 \SystemRoot\system32\drivers\drmk.sys 0x91061000 \SystemRoot\system32\DRIVERS\MpFilter.sys 0x91088000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0x91091000 \SystemRoot\System32\Drivers\Null.SYS 0x91098000 \SystemRoot\System32\Drivers\Beep.SYS 0x910A8000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS 0x910AF000 \SystemRoot\System32\drivers\vga.sys 0x910BB000 \SystemRoot\System32\drivers\VIDEOPRT.SYS 0x910DC000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0x910E4000 \SystemRoot\system32\drivers\rdpencdd.sys 0x910EC000 \SystemRoot\System32\Drivers\Msfs.SYS 0x910F7000 \SystemRoot\System32\Drivers\Npfs.SYS 0x91105000 \SystemRoot\System32\DRIVERS\rasacd.sys 0x9110E000 \SystemRoot\system32\DRIVERS\tdx.sys 0x91124000 \SystemRoot\system32\DRIVERS\hidusb.sys 0x9112D000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS 0x9113D000 \SystemRoot\system32\DRIVERS\USBD.SYS 0x9113F000 \SystemRoot\system32\DRIVERS\mouhid.sys 0x91147000 \SystemRoot\system32\DRIVERS\smb.sys 0x9115B000 \SystemRoot\system32\drivers\afd.sys 0x911A3000 \SystemRoot\System32\DRIVERS\netbt.sys 0x911D5000 \SystemRoot\system32\DRIVERS\pacer.sys 0x911EB000 \SystemRoot\system32\DRIVERS\netbios.sys 0x907EC000 \SystemRoot\system32\DRIVERS\wanarp.sys 0x805DA000 \??\E:\superantispyware\SASKUTIL.SYS 0x911F9000 \??\E:\superantispyware\SASDIFSV.SYS 0x9180C000 \SystemRoot\system32\DRIVERS\rdbss.sys 0x91848000 \SystemRoot\system32\drivers\nsiproxy.sys 0x91852000 \SystemRoot\system32\drivers\csc.sys 0x918AD000 \SystemRoot\System32\Drivers\dfsc.sys 0x918C4000 \SystemRoot\system32\drivers\AsIO.sys 0x918C6000 \SystemRoot\System32\Drivers\crashdmp.sys 0x918D3000 \SystemRoot\System32\Drivers\dump_dumpata.sys 0x918DE000 \SystemRoot\System32\Drivers\dump_atapi.sys 0x9D0D0000 \SystemRoot\System32\win32k.sys 0x918E6000 \SystemRoot\System32\drivers\Dxapi.sys 0x918F0000 \SystemRoot\system32\DRIVERS\monitor.sys 0x9D2F0000 \SystemRoot\System32\TSDDD.dll 0x9D310000 \SystemRoot\System32\cdd.dll 0x9D320000 \SystemRoot\System32\ATMFD.DLL 0x918FF000 \SystemRoot\system32\drivers\luafv.sys 0x9191A000 \??\C:\Windows\system32\drivers\acedrv01.sys 0x91975000 \??\C:\Windows\system32\drivers\acedrv02.sys 0x80C09000 \??\C:\Windows\system32\drivers\acedrv03.sys 0x80C68000 \??\C:\Windows\system32\drivers\acedrv04.sys 0x80CC7000 \??\C:\Windows\system32\drivers\acedrv05.sys 0x80D26000 \??\C:\Windows\system32\drivers\acedrv06.sys 0x80D86000 \??\C:\Windows\system32\drivers\acedrv07.sys 0x80E0D000 \??\C:\Windows\system32\drivers\ACEDRV09.sys 0x80E70000 \SystemRoot\system32\DRIVERS\tifsfilt.sys 0x80E80000 \SystemRoot\system32\drivers\spsys.sys 0x80F30000 \SystemRoot\system32\DRIVERS\lltdio.sys 0x80F40000 \SystemRoot\system32\DRIVERS\rspndr.sys 0x80F53000 \SystemRoot\system32\DRIVERS\asyncmac.sys 0x80F5C000 \SystemRoot\system32\drivers\HTTP.sys 0x80FC9000 \SystemRoot\System32\DRIVERS\srvnet.sys 0x80FE6000 \SystemRoot\system32\DRIVERS\bowser.sys 0x80DE8000 \SystemRoot\System32\drivers\mpsdrv.sys 0x919D4000 \SystemRoot\system32\drivers\mrxdav.sys 0x833AB000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0xA4A0C000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys 0xA4A45000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys 0xA4A5D000 \SystemRoot\System32\DRIVERS\srv2.sys 0xA4A85000 \SystemRoot\System32\DRIVERS\srv.sys 0xA4AD4000 \SystemRoot\system32\drivers\peauth.sys 0xA4BB2000 \SystemRoot\System32\Drivers\secdrv.SYS 0xA4BBC000 \SystemRoot\System32\drivers\tcpipreg.sys 0xA4BC8000 \SystemRoot\system32\DRIVERS\cdfs.sys 0xA4BDE000 \SystemRoot\system32\DRIVERS\MpNWMon.sys 0xA4BFA000 \??\C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{D466CA8F-55D8-4E08-AAB7-DDF418803F41}\MpKsl1d162cca.sys 0x833E3000 \??\C:\Users\Heiko\AppData\Local\Temp\uxldypow.sys 0x77980000 \Windows\System32\ntdll.dll Processes (total 50): 0 System Idle Process 4 System 568 C:\Windows\System32\smss.exe 700 csrss.exe 748 C:\Windows\System32\wininit.exe 760 csrss.exe 792 C:\Windows\System32\services.exe 808 C:\Windows\System32\lsass.exe 816 C:\Windows\System32\lsm.exe 984 C:\Windows\System32\winlogon.exe 1012 C:\Windows\System32\svchost.exe 1056 C:\Windows\System32\nvvsvc.exe 1084 C:\Windows\System32\svchost.exe 1136 C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe 1276 C:\Windows\System32\svchost.exe 1304 C:\Windows\System32\svchost.exe 1364 C:\Windows\System32\svchost.exe 1468 C:\Windows\System32\audiodg.exe 1496 C:\Windows\System32\svchost.exe 1548 C:\Windows\System32\SLsvc.exe 1604 C:\Windows\System32\svchost.exe 1692 C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe 1704 C:\Windows\System32\nvvsvc.exe 1836 C:\Windows\System32\svchost.exe 424 C:\Windows\System32\spoolsv.exe 656 C:\Windows\System32\svchost.exe 1584 C:\Windows\System32\taskeng.exe 2052 C:\Windows\System32\dwm.exe 2116 C:\Windows\System32\taskeng.exe 2248 C:\Program Files\ASUS\AASP\1.00.40\aaCenter.exe 2360 C:\Windows\RtHDVCpl.exe 2392 C:\Program Files\Microsoft Security Client\msseces.exe 2600 C:\Windows\explorer.exe 2628 C:\Windows\System32\bgsvcgen.exe 2676 C:\Program Files\Canon\DIAS\CnxDIAS.exe 2888 C:\Windows\System32\svchost.exe 2960 C:\Windows\System32\svchost.exe 2992 C:\Windows\System32\SearchIndexer.exe 3176 E:\Spybot - Search & Destroy\SDWinSec.exe 3448 C:\Windows\System32\taskeng.exe 3800 C:\Windows\System32\wbem\unsecapp.exe 3820 WmiPrvSE.exe 3116 C:\Windows\System32\svchost.exe 2820 C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 3924 C:\Program Files\Internet Explorer\ieuser.exe 3228 C:\Program Files\Internet Explorer\iexplore.exe 2492 C:\Windows\System32\Macromed\Flash\FlashUtil10i_ActiveX.exe 1940 C:\Windows\System32\SearchProtocolHost.exe 2228 C:\Windows\System32\SearchFilterHost.exe 4028 C:\Users\Heiko\Desktop\MBRCheck.exe \\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00100000 (NTFS) \\.\E: --> \\.\PhysicalDrive0 at offset 0x00000019`00100000 (NTFS) \\.\F: --> \\.\PhysicalDrive0 at offset 0x00000032`00100000 (NTFS) \\.\G: --> \\.\PhysicalDrive0 at offset 0x0000004b`00200000 (NTFS) \\.\H: --> \\.\PhysicalDrive0 at offset 0x00000069`00300000 (NTFS) PhysicalDrive0 Model Number: SAMSUNGHD501LJ, Rev: CR100-10 Size Device Name MBR Status -------------------------------------------- 465 GB \\.\PhysicalDrive0 Windows 2008 MBR code detected SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979 Done! |
|
20.04.2011, 18:13
| #15 |
| | Postbank 20 Tans-Phishing-Overlay Der Treiber ist laut OSAM runter vom System, das Overlay kommt noch immer. Hier das Log nach dem Neustart: OSAM Logfile: Code:
ATTFilter Report of OSAM: Autorun Manager v5.0.11926.0 hxxp://www.online-solutions.ru/en/ Saved at 19:04:37 on 20.04.2011 OS: Windows Vista Business Edition Service Pack 2 (Build 6002), 32-bit Default Browser: Microsoft Corporation Internet Explorer 7.00.6000.16386 Scanner Settings [x] Rootkits detection (hidden registry) [x] Rootkits detection (hidden files) [x] Retrieve files information [x] Check Microsoft signatures Filters [ ] Trusted entries [ ] Empty entries [x] Hidden registry entries (rootkit activity) [x] Exclusively opened files [x] Not found files [x] Files without detailed information [x] Existing files [ ] Non-startable services [ ] Non-startable drivers [x] Active entries [x] Disabled entries [Control Panel Objects] -----( %SystemRoot%\system32 )----- "nvcpl.cpl" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.cpl "zmhhpaudio.cpl" - "ZOOM" - C:\Windows\system32\zmhhpaudio.cpl -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )----- "Adobe Gamma" - ? - C:\Program "Wacom Tablett" - ? - C:\Windows\system32\WacomTablet.cpl (File not found) [Drivers] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "acedrv01" (acedrv01) - "ACE GmbH" - C:\Windows\system32\drivers\acedrv01.sys "acedrv02" (acedrv02) - "ACE GmbH" - C:\Windows\system32\drivers\acedrv02.sys "acedrv03" (acedrv03) - "ACE GmbH" - C:\Windows\system32\drivers\acedrv03.sys "acedrv04" (acedrv04) - "Protect Software GmbH" - C:\Windows\system32\drivers\acedrv04.sys "acedrv05" (acedrv05) - "Protect Software GmbH" - C:\Windows\system32\drivers\acedrv05.sys "acedrv06" (acedrv06) - "Protect Software GmbH" - C:\Windows\system32\drivers\acedrv06.sys "acedrv07" (acedrv07) - "Protect Software GmbH" - C:\Windows\system32\drivers\acedrv07.sys "ACEDRV09" (ACEDRV09) - "Protect Software GmbH" - C:\Windows\system32\drivers\ACEDRV09.sys "Acronis Snapshots Manager" (snapman) - "Acronis" - C:\Windows\System32\DRIVERS\snapman.sys "Acronis True Image Backup Archive Explorer" (timounter) - "Acronis" - C:\Windows\System32\DRIVERS\timntr.sys "Acronis True Image FS Filter" (tifsfilter) - "Acronis" - C:\Windows\System32\DRIVERS\tifsfilt.sys "AsIO" (AsIO) - ? - C:\Windows\System32\drivers\AsIO.sys (File found, but it contains no detailed information) "catchme" (catchme) - ? - C:\cofi\catchme.sys (File not found) "cdrbsdrv" (cdrbsdrv) - "B.H.A Corporation" - C:\Windows\system32\drivers\cdrbsdrv.sys "ENTECH" (ENTECH) - "EnTech Taiwan" - C:\Windows\system32\DRIVERS\ENTECH.sys "giveio" (giveio) - ? - C:\Windows\System32\giveio.sys (File found, but it contains no detailed information) "IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys (File not found) "IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys (File not found) "IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys (File not found) "LANCOM Secure Client NDIS6 Driver" (ncplelhp) - ? - C:\Windows\System32\DRIVERS\ncplelhp.sys (File not found) "Logitech POP Suppression Filter" (lvpopflt) - ? - C:\Windows\System32\DRIVERS\lvpopflt.sys (File not found) "Logitech USB Monitor Filter" (LVUSBSta) - ? - C:\Windows\System32\drivers\LVUSBSta.sys (File not found) "MpKsl11745789" (MpKsl11745789) - "Microsoft Corporation" - C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{C2CDA158-138D-48C8-9849-C6BD75026180}\MpKsl11745789.sys "MpKsl47c56faf" (MpKsl47c56faf) - ? - C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{A308A4AE-2FC1-4156-A5D9-8B76C067CCE8}\MpKsl47c56faf.sys (File not found) "QuickCam Pro for Notebooks(UVC)" (LVUVC) - ? - C:\Windows\System32\DRIVERS\lvuvc.sys (File not found) "SASDIFSV" (SASDIFSV) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - E:\superantispyware\SASDIFSV.SYS "SASKUTIL" (SASKUTIL) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - E:\superantispyware\SASKUTIL.SYS "speedfan" (speedfan) - "Windows (R) 2000 DDK provider" - C:\Windows\System32\speedfan.sys "StarForce Protection Environment Driver (version 1.x)" (sfdrv01) - "Protection Technology (StarForce)" - C:\Windows\System32\drivers\sfdrv01.sys "StarForce Protection Helper Driver (version 2.x)" (sfhlp02) - "Protection Technology (StarForce)" - C:\Windows\System32\drivers\sfhlp02.sys "StarForce Protection Synchronization Driver (version 2.x)" (sfsync02) - "Protection Technology" - C:\Windows\System32\drivers\sfsync02.sys "SynasUSB" (SynasUSB) - "SIA Syncrosoft" - C:\Windows\System32\drivers\SynasUSB.sys "ZOOM H Series High Performance Audio Driver Service" (ZMHHPAudioSrv) - "ZOOM" - C:\Windows\System32\drivers\zmhhpau.sys [Explorer] -----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )----- {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? - (File not found | COM-object registry key not found) {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? - (File not found | COM-object registry key not found) {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? - (File not found | COM-object registry key not found) {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? - (File not found | COM-object registry key not found) -----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )----- {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - ? - C:\Program {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - E:\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll -----( HKLM\Software\Classes\Protocols\Handler )----- {314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - ? - C:\Program {828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL {828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )----- {AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? - (File not found | COM-object registry key not found) -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )----- {911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? - (File not found | COM-object registry key not found) {CF67796C-F57F-45F8-92FB-AD698826C602} ".contact shell context menu" - ? - C:\Program {8082C5E6-4C27-48ec-A809-B8E1122E8F97} ".contact shell extension handler" - ? - C:\Program {16C2C29D-0E5F-45f3-A445-03E03F587B7D} ".group shell context menu" - ? - C:\Program {4F58F63F-244B-4c07-B29F-210BE59BE9B4} ".group shell extension handler" - ? - C:\Program {23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - ? - E:\7-Zip\7-zip.dll {C539A15A-3AF9-4c92-B771-50CB78F5C751} "Acronis True Image Shell Context Menu Extension" - "Acronis" - E:\TrueImage\tishell.dll {C539A15B-3AF9-4c92-B771-50CB78F5C751} "Acronis True Image Shell Extension" - "Acronis" - E:\TrueImage\tishell.dll {1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? - (File not found | COM-object registry key not found) {34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? - (File not found | COM-object registry key not found) {13D3C4B8-B179-4ebb-BF62-F704173E7448} "CLSID_ContactReadingPane" - ? - C:\Program {0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? - (File not found | COM-object registry key not found) {3B52CC4A-19E9-43F5-A626-F89267A5E43F} "ddsExtractor Class" - ? - C:\Program {A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - ? - C:\Program {AE1514A4-5D7D-4D1B-BC7F-320E6962B0DD} "DropTarget Class" - "HHD Software Ltd." - E:\HexEditorNeo\FileDocument.dll {09A47860-11B0-4DA5-AFA5-26D86198A780} "EPP" - "Microsoft Corporation" - C:\PROGRA~1\MI239C~1\shellext.dll {2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? - (File not found | COM-object registry key not found) {32714800-2E5F-11d0-8B85-00AA0044F941} "For &People..." - ? - C:\Program {00020d75-0000-0000-c000-000000000046} "lnkfile" - ? - (File not found | COM-object registry key not found) {FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D} "Meine freigegebenen Ordner" - ? - C:\Program {2206CDB2-19C1-11D1-89E0-00C04FD7A829} "Microsoft OLE DB Service Component Data Links" - ? - C:\Program {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} "NVIDIA CPL Context Menu Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvshext.dll {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - E:\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll {087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - E:\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll {63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - E:\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll {3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - E:\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll {00f20eb5-8fd6-4d9d-b75e-36801766c8f1} "PhotoAcqDropTarget" - ? - C:\Program {82AA9188-44E0-40B9-B956-43A10C315B4F} "RootShellFolder Class" - "SmartSoft Ltd." - E:\SmartFTP Client\sfFTPShellExtension.dll {C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? - (File not found | COM-object registry key not found) {E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? - (File not found | COM-object registry key not found) {2ED7FD81-CBA6-45E5-A49A-5E84889A94E2} "ShellDragDropHandler Class" - "SmartSoft Ltd." - E:\SmartFTP Client\sfShellTools.dll {7568C3F3-DF7E-436A-95C2-772819DF58B4} "ShellFolderExternal Class" - "SmartSoft Ltd." - E:\SmartFTP Client\sfFavoritesShellExtension.dll {119310E6-5FB7-4eeb-BEDB-9E229E76B9B4} "ShellFolderMultiUploadDestination Class" - "SmartSoft Ltd." - E:\SmartFTP Client\sfFTPShellExtension.dll {3B164627-7060-47BB-A1BE-DF5540B02821} "ShellFolderMultiUploadSource Class" - "SmartSoft Ltd." - E:\SmartFTP Client\sfFTPShellExtension.dll {6E0A0931-B89D-45B7-8BF0-F221A6D67257} "ShellFolderRoot Class" - "SmartSoft Ltd." - E:\SmartFTP Client\sfFavoritesShellExtension.dll {EB5EE1F3-041A-4c03-9D51-2BEC6715FB00} "ShellFolderSearchRoot Class" - "SmartSoft Ltd." - E:\SmartFTP Client\sfFTPShellExtension.dll {F87DED31-303F-4ED1-9BCE-D360FBC74E0A} "SmartFTP ContextMenu Shell Extension" - "SmartSoft Ltd." - E:\SmartFTP Client\sfShellTools.dll {EA5A76F7-8138-4B53-B0F5-ADCC730CAFBD} "SmartFTP Drop ShellIconOverlayHandler" - "SmartSoft Ltd." - E:\SmartFTP Client\sfShellTools.dll {FD504287-1372-40d2-ACA6-216A8FCC243D} "SmartFTP FavoritesShellFolder Class" - "SmartSoft Ltd." - E:\SmartFTP Client\sfFavoritesShellExtension.dll {0848278D-D88B-445b-BEDC-7DFBDB061F5F} "SmartFTP FavoritesShellFolderDesktop class" - "SmartSoft Ltd." - E:\SmartFTP Client\sfFavoritesShellExtension.dll {40FDFA48-5F4E-4627-A78E-6A49A3D4492F} "SmartFTP ShellDropHandler Class" - "SmartSoft Ltd." - E:\SmartFTP Client\sfShellTools.dll {15D633E2-AD00-465b-9EC7-F56B7CDF8E27} "Tablet PC Input Panel" - ? - C:\Program {DBD8E168-244D-448C-9922-25508950D1DC} "USIShellExt Class" - ? - C:\Program {d8559eb9-20c0-410e-beda-7ed416aecc2a} "Windows Defender" - ? - C:\Program {2781761E-28E0-4109-99FE-B9D127C57AFE} "Windows Defender IOfficeAntiVirus implementation" - ? - C:\Program {6b9228da-9c15-419e-856c-19e768a13bdc} "Windows gadget DropTarget" - ? - C:\Program {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A} "Windows Photo Gallery Viewer Image Verbs" - ? - C:\Program {E598560B-28D5-46aa-A14A-8A3BEA34B576} "Windows Photo Gallery Viewer Video Verbs" - ? - C:\Program {da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? - (File not found | COM-object registry key not found) {37efd44d-ef8d-41b1-940d-96973a50e9e0} "Windows Sidebar Properties" - ? - C:\Program [Internet Explorer] -----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )----- <binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found) -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )----- {53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - E:\SPYBOT~1\SDHelper.dll "ICQ7.4" - "ICQ, LLC." - E:\ICQ7.4\ICQ.exe -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )----- {18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - ? - C:\Program {53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - E:\SPYBOT~1\SDHelper.dll {9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID Sign-in Helper" - ? - C:\Program [Logon] -----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )----- "desktop.ini" - ? - C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini "Dropbox.lnk" - "Dropbox, Inc." - C:\Users\Heiko\AppData\Roaming\Dropbox\bin\Dropbox.exe (Shortcut exists | File exists) -----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )----- "desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini "SpeedFan.lnk" - "Almico Software (www.almico.com)" - E:\SpeedFan\speedfan.exe (Shortcut exists | File exists) -----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )----- "Advlib" - ? - C:\Users\Heiko\AppData\Roaming\Dvdpack\modfree.exe (File found, but it contains no detailed information) "SpybotSD TeaTimer" - "Safer-Networking Ltd." - E:\Spybot - Search & Destroy\TeaTimer.exe -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )----- "Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe" "MSC" - "Microsoft Corporation" - "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [Print Monitors] -----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )----- "avm:" - "AVM Berlin GmbH" - C:\Windows\system32\avmprmon.dll "Canon MFNP Port" - "CANON INC." - C:\Windows\system32\CNCENPM.dll "CPCA Language Monitor3b" - "CANON INC." - C:\Windows\system32\CNAS0MOK.DLL "PDFCreator" - ? - C:\Windows\system32\pdfcmnnt.dll (File found, but it contains no detailed information) [Services] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "@%ProgramFiles%\Windows Defender\MsMpRes.dll,-103" (WinDefend) - ? - C:\Program "@C:\Program Files\Microsoft Security Client\Antimalware\MpAsDesc.dll,-243" (NisSrv) - "Microsoft Corporation" - C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe "@C:\Program Files\NOS\bin\getPlus_Helper.dll,-101" (getPlusHelper) - ? - C:\Program "@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe "Adobe LM Service" (Adobe LM Service) - "Adobe Systems" - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe "B's Recorder GOLD Library General Service" (bgsvcgen) - "B.H.A Corporation" - C:\Windows\System32\bgsvcgen.exe "Canon Driver Information Assist Service" (Canon Driver Information Assist Service) - "CANON INC." - C:\Program Files\Canon\DIAS\CnxDIAS.exe "Google Updater Service" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe "M-Audio Series II MIDI Installer" (MA_CMIDI_InstallerService) - ? - C:\Program "Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe "Microsoft Antimalware Service" (MsMpSvc) - "Microsoft Corporation" - C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe "NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe "Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE "SBSD Security Center Service" (SBSDWSCService) - "Safer Networking Ltd." - E:\Spybot - Search & Destroy\SDWinSec.exe "SQL Server (SQLEXPRESS)" (MSSQL$SQLEXPRESS) - "Microsoft Corporation" - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe "SQL Server VSS Writer" (SQLWriter) - "Microsoft Corporation" - C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe "SQL Server-Browser" (SQLBrowser) - "Microsoft Corporation" - C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe "Ulead Burning Helper" (UleadBurningHelper) - ? - C:\Program "Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE ===[ Logfile end ]=========================================[ Logfile end ]=== If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru |
|
| Themen zu Postbank 20 Tans-Phishing-Overlay |
| adware.relevantknowledge, anleitung, anti-malware, appdata, badjoke.killfiles, dateien, detected, einloggen, explorer, firefox, java, langsamer, laptop, malwarebytes, nicht mehr, pdf, probleme, roaming, router, shell, software, starten, superantispyware, system, system32, temp, unbekannt |
Linear-Darstellung
