| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Trojaner TR/Spy.Ipsiut.l in C:\Windows\System32\vdmdbg32.dllWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
23.05.2011, 20:40
| #16 |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  Trojaner TR/Spy.Ipsiut.l in C:\Windows\System32\vdmdbg32.dll Dann bitte jetzt CF ausführen: ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
24.05.2011, 07:34
| #17 |
 | Trojaner TR/Spy.Ipsiut.l in C:\Windows\System32\vdmdbg32.dll guten Morgen,
__________________unhide.exe habe ich über Nacht laufen lassen, aber es war grad noch immer nicht fertig. Gier aber die Log-datei von ComboFix: Combofix Logfile: Code:
ATTFilter ComboFix 11-05-23.02 - Michi 24.05.2011 8:19.1.2 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1252.49.1031.18.3039.1920 [GMT 2:00]
ausgeführt von:: c:\users\Michi\Desktop\cofi.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\users\Michi\AppData\Roaming\Local
c:\users\Michi\AppData\Roaming\Local\Temp\DDM\Settings\0.ddi
c:\users\Michi\AppData\Roaming\Local\Temp\DDM\Settings\1.ddi
c:\users\Michi\AppData\Roaming\Local\Temp\DDM\Settings\2.ddi
c:\users\Michi\AppData\Roaming\Local\Temp\DDM\Settings\gossip.girl.405.hdtv-lol.avi.ddr
c:\users\Michi\AppData\Roaming\Local\Temp\DDM\Settings\Gossip.Girl.S04E04.hdtv.xvid-2hd.avi.ddr
c:\users\Michi\AppData\Roaming\Local\Temp\DDM\Settings\gossip.girl.s04e04.hdtv.xvid_2hd.avi.ddr
c:\users\Michi\AppData\Roaming\Local\Temp\DDM\Settings\settings.ddi
c:\users\Michi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\gossip.girl.405.hdtv-lol.avi.ddp
c:\users\Michi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Gossip.Girl.S04E04.hdtv.xvid-2hd.avi.ddp
c:\users\Michi\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\gossip.girl.s04e04.hdtv.xvid_2hd.avi.ddp
c:\windows\system32\spool\prtprocs\w32x86\Xrpp_b.dll
.
.
((((((((((((((((((((((( Dateien erstellt von 2011-04-24 bis 2011-05-24 ))))))))))))))))))))))))))))))
.
.
2011-05-24 06:26 . 2011-05-24 06:28 -------- d-----w- c:\users\Michi\AppData\Local\temp
2011-05-24 06:26 . 2011-05-24 06:26 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-05-22 11:55 . 2011-05-22 12:39 -------- d-----w- c:\program files\Spybot - Search & Destroy
2011-05-22 11:55 . 2011-05-22 12:36 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2011-05-22 10:25 . 2011-05-22 10:25 2560 ----a-w- c:\windows\_MSRSTRT.EXE
2011-05-21 23:13 . 2011-05-21 23:13 -------- d-----w- c:\programdata\Skype Extras
2011-05-21 23:13 . 2011-05-21 23:13 -------- d-----w- c:\program files\Common Files\Skype
2011-05-20 13:33 . 2011-05-09 20:46 6962000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{1D8BB98E-7728-4099-A811-9FE113BE3A53}\mpengine.dll
2011-05-17 19:56 . 2011-04-09 05:56 123904 ----a-w- c:\windows\system32\poqexec.exe
2011-05-12 21:09 . 2011-05-12 21:09 -------- d-----w- c:\programdata\Kaspersky Lab Setup Files
2011-05-12 14:59 . 2011-05-12 14:59 -------- d-----w- c:\users\Public\Juniper Networks
2011-05-12 14:59 . 2010-07-21 15:26 398704 ----a-w- c:\windows\system32\dsNcSmartCardProv.dll
2011-05-12 14:59 . 2010-07-21 15:26 345456 ----a-w- c:\windows\system32\dsNcCredProv.dll
2011-05-12 14:57 . 2011-05-12 14:59 -------- d-----w- c:\program files\Juniper Networks
2011-05-12 14:57 . 2011-05-12 15:00 -------- d-----w- c:\users\Michi\AppData\Roaming\Juniper Networks
2011-05-12 08:21 . 2011-05-12 08:21 -------- d-----w- c:\users\Michi\AppData\Roaming\Uniblue
2011-05-12 08:21 . 2011-05-12 08:21 -------- dc----w- c:\programdata\{AB2D8F2E-F7AD-4446-A11A-50D846B2CF2A}
2011-05-12 08:21 . 2011-05-12 08:21 -------- d-----w- c:\program files\Uniblue
2011-05-12 08:19 . 2011-05-12 08:19 -------- d-----w- c:\users\Michi\AppData\Local\PackageAware
2011-05-12 08:04 . 2011-05-12 08:04 -------- d-----w- c:\users\Michi\AppData\Roaming\Malwarebytes
2011-05-12 08:04 . 2010-12-20 16:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-12 08:04 . 2011-05-12 08:04 -------- d-----w- c:\programdata\Malwarebytes
2011-05-12 08:04 . 2010-12-20 16:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-12 08:04 . 2011-05-15 18:34 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-05-11 09:40 . 2011-05-11 09:40 -------- d-----w- c:\windows\system32\wbem\en-US
2011-05-11 07:14 . 2011-03-25 03:06 258560 ----a-w- c:\windows\system32\drivers\usbhub.sys
2011-05-11 07:14 . 2011-03-25 03:06 284160 ----a-w- c:\windows\system32\drivers\usbport.sys
2011-05-11 07:14 . 2011-03-25 03:06 75776 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2011-05-11 07:14 . 2011-03-25 03:06 43008 ----a-w- c:\windows\system32\drivers\usbehci.sys
2011-05-11 07:14 . 2011-03-25 03:06 20480 ----a-w- c:\windows\system32\drivers\usbohci.sys
2011-05-11 07:14 . 2011-03-25 03:06 24064 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2011-05-11 07:14 . 2011-03-25 03:06 5888 ----a-w- c:\windows\system32\drivers\usbd.sys
2011-05-11 07:14 . 2011-04-09 06:13 3957632 ----a-w- c:\windows\system32\ntkrnlpa.exe
2011-05-11 07:14 . 2011-04-09 06:13 3901824 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-05-03 18:55 . 2011-05-03 18:55 -------- d-----w- c:\program files\MestRe-C
2011-04-30 17:10 . 2011-04-14 16:40 142296 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-04-30 17:10 . 2011-04-14 16:40 89048 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll
2011-04-30 17:10 . 2011-04-14 16:40 781272 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2011-04-30 17:10 . 2011-04-14 16:40 465880 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2011-04-30 17:10 . 2011-04-14 16:40 1874904 ----a-w- c:\program files\Mozilla Firefox\mozjs.dll
2011-04-30 17:10 . 2011-04-14 16:40 15832 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll
2011-04-30 17:10 . 2010-01-01 08:00 1974616 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_42.dll
2011-04-30 17:10 . 2010-01-01 08:00 1892184 ----a-w- c:\program files\Mozilla Firefox\d3dx9_42.dll
2011-04-28 11:00 . 2011-02-18 05:33 31232 ----a-w- c:\windows\system32\prevhost.exe
2011-04-28 10:59 . 2011-03-11 05:44 143744 ----a-w- c:\windows\system32\drivers\nvstor.sys
2011-04-28 10:59 . 2011-03-11 05:44 146304 ----a-w- c:\windows\system32\drivers\storport.sys
2011-04-28 10:59 . 2011-03-11 05:44 1210240 ----a-w- c:\windows\system32\drivers\ntfs.sys
2011-04-28 10:59 . 2011-03-11 05:44 117120 ----a-w- c:\windows\system32\drivers\nvraid.sys
2011-04-28 10:59 . 2011-03-11 05:43 332160 ----a-w- c:\windows\system32\drivers\iaStorV.sys
2011-04-28 10:59 . 2011-03-11 05:43 80256 ----a-w- c:\windows\system32\drivers\amdsata.sys
2011-04-28 10:59 . 2011-03-11 05:43 22400 ----a-w- c:\windows\system32\drivers\amdxata.sys
2011-04-28 10:59 . 2011-03-11 05:39 1686016 ----a-w- c:\windows\system32\esent.dll
2011-04-28 10:59 . 2011-03-11 05:37 74240 ----a-w- c:\windows\system32\fsutil.exe
2011-04-28 10:59 . 2011-03-12 11:31 442880 ----a-w- c:\windows\system32\XpsPrint.dll
2011-04-28 10:59 . 2011-02-26 05:33 2614784 ----a-w- c:\windows\explorer.exe
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-18 17:21 . 2011-04-18 17:21 65536 ----a-r- c:\users\Michi\AppData\Roaming\Microsoft\Installer\{F428D0FB-765D-40EB-BDD8-A1E7F5C597FA}\Shortcut0.C3A146F5_4B48_11D5_A819_00B0D0428C0C.exe
2011-03-27 16:02 . 2010-10-24 21:51 137656 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-03-11 05:40 . 2011-04-13 10:42 1164288 ----a-w- c:\windows\system32\mfc42u.dll
2011-03-11 05:40 . 2011-04-13 10:42 1137664 ----a-w- c:\windows\system32\mfc42.dll
2011-03-08 05:38 . 2011-04-13 10:42 740864 ----a-w- c:\windows\system32\inetcomm.dll
2011-03-03 05:29 . 2011-04-13 10:43 132608 ----a-w- c:\windows\system32\dnsrslvr.dll
2011-03-03 05:27 . 2011-04-13 10:43 28672 ----a-w- c:\windows\system32\dnscacheugc.exe
2011-03-03 03:31 . 2011-04-13 10:42 2331136 ----a-w- c:\windows\system32\win32k.sys
2011-02-24 05:32 . 2011-04-13 10:42 288256 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2011-04-14 16:40 . 2011-04-30 17:10 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2005-08-11 249856]
"RegistryBooster"="c:\program files\Uniblue\RegistryBooster\launcher.exe" [2011-03-14 67456]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-04-18 15146376]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-03 281768]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-12-09 1226608]
"DivX Download Manager"="c:\program files\DivX\DivX Plus Web Player\DDmService.exe" [2010-12-08 63360]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2010-12-06 74752]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2008-12-09 08:27 98304 ----a-w- c:\windows\System32\VESWinlogon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-08-18 176128]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-05-10 136360]
S2 MSSQL$CSSQL05;SQL Server (CSSQL05);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2010-12-10 29293408]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S3 netw5v32;Intel(R) Wireless WiFi Link 5000-Serie - Adaptertreiber für Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys [2007-08-03 9344]
S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
S3 yukonw7;NDIS6.2-Miniporttreiber für Marvell Yukon-Ethernet-Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-07-13 311296]
.
.
Inhalt des "geplante Tasks" Ordners
.
2011-05-24 c:\windows\Tasks\RegistryBooster.job
- c:\program files\Uniblue\RegistryBooster\rbmonitor.exe [2011-03-14 15:31]
.
.
------- Zusätzlicher Suchlauf -------
.
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
TCP: {30984299-7820-46AF-BC5E-778E1437EB0E} = 141.20.1.31,141.20.1.3
FF - ProfilePath - c:\users\Michi\AppData\Roaming\Mozilla\Firefox\Profiles\tovtpma0.default\
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\atieclxx.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Juniper Networks\Common Files\dsNcService.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\conhost.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Sony\VAIO Event Service\VESMgr.exe
c:\windows\system32\DllHost.exe
c:\program files\Sony\VAIO Event Service\VESMgrSub.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-05-24 08:31:36 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2011-05-24 06:31
.
Vor Suchlauf: 23 Verzeichnis(se), 104.360.116.224 Bytes frei
Nach Suchlauf: 29 Verzeichnis(se), 104.408.068.096 Bytes frei
.
- - End Of File - - 1C413880E5CA35BCED9A607CDE48A00B
|
|
24.05.2011, 12:07
| #18 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Trojaner TR/Spy.Ipsiut.l in C:\Windows\System32\vdmdbg32.dllZitat:
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen. Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst. Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
__________________ |
|
24.05.2011, 15:14
| #19 | |
| | Trojaner TR/Spy.Ipsiut.l in C:\Windows\System32\vdmdbg32.dll Okay, here we go: GMER Logfile: Code:
ATTFilter GMER 1.0.15.15627 - hxxp://www.gmer.net
Rootkit scan 2011-05-24 15:58:15
Windows 6.1.7600 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Hitachi_HTS543232L9SA00 rev.FB4OC43C
Running: jhtjv3r5.exe; Driver: C:\Users\Michi\AppData\Local\Temp\pxdyipob.sys
---- Kernel code sections - GMER 1.0.15 ----
.text ntkrnlpa.exe!ZwSaveKeyEx + 13BD 82E93569 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82EB8092 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text C:\Windows\system32\DRIVERS\atikmdag.sys section is writeable [0x91626000, 0x2D5378, 0xE8000020]
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2616] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [75DF5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2616] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [75DF5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2616] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [75DF5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe[2616] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [75DF5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
Device \Driver\ACPI_HAL \Device\000000b0 halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\LanmanServer\Linkage@Bind ????0???????????usbstor.inf?????????????? ???????Z?????????????1????????????&????????????????????????????????5????????????&??????0??-4??LAN-Verbindung* 27??????? ???????Z?????????????1??????????*?&???????????????????????? ???????????????????U?1??????*?&??? ????????????????????-??????????dr???????????N????????????&??????.???t??LAN-Verbindung* 28??????????????Microsoft-6zu4-Adapter #52?6?2???????{??????p???TCPIP6TUNNEL?Tcpip6??????????????????e???????????????l??{8D6C7F81-D39E-41A9-9E26-44AA0D036205}??? ??? ?????????????????????1??????????=?&????????????????????????????????A??????????du?????? 7??????????????@nettun.inf,%msft%;Microsoft?????????????????????????????????????????B???e???????????????????????????????????????????????????t??text????text?0????????????????????6?????????????????????tB??????????wpdfs.inf????? ??A????????????N???????????????:????????????2????Microsoft???? ????????????????????????"?????p???????????\\?\wpdbusenumroot#umb#2&37c186b&0&storage#volume#_??_sd#vid_02&oid_544d&pid_sd02g&rev_2.8#5&10
Reg HKLM\SYSTEM\CurrentControlSet\services\LanmanServer\Linkage@Route ????????Microsoft???*6to4mp?8D??????se??tunnel???????????????.???.??? ???????b?????????????.????????*?&?&??????????????????????????????????????????????????????????l????? *?????????????????EventLog-Application???????????????????????????g?????????????????????????d??????????????????????? ???????g?????????????1????????????????????? ???????????????????g?1????????>???????????{4d36e972-e325-11ce-bfc1-08002be10318}\0011???????N?????????????????.NTx86?A5-??????????? ???????g?????????????1????????????????????? ???????????????????g?1????????????????????@msmouse.inf,%msmfg%;Microsoft??????????????????? ???????g?????????????1????????????????????? ???????????????????g?1??????????????????????N? ??????????D?????????????B??????????????????Microsoft-6zu4-Adapter #17?9F8??? ???g???e?????e?e??????ad??????? ???????h?????????????1????????????????????? ???????????????????g?1?????????????????????????e???????e???f??????????????????????????????? ???????h?????????????1???????????????????????h????????????????? ???????????????????h?1???
Reg HKLM\SYSTEM\CurrentControlSet\services\LanmanServer\Linkage@Export ????????192.168.0.1?????????????? ?????????????????????1????????????????????? ???????????????????m?1????????????????????\Device\{B154DF00-21EB-403E-9C0D-0130D11B6A80}??09??????????? ?????????????????????1????????????????????Microsoft-6zu4-Adapter #20??????? ???????????????????m?1????????????????????Microsoft-6zu4-Adapter #45?6?2??????????????? ?????????????????????1????????????????????? ???????????????????m?1????????????????????6to4mp.ndi???????????????????????????????????????????????e??@nettun.inf,%6to4mp.displayname%;Microsoft-6zu4-Adapter?????@nettun.inf,%6to4mp.displayname%;Microsoft-6zu4-Adapter??????????????l?m???????l????????????????????tunnel???????????????&???e???????????????????????????????????????????????B??tunnel???k??{4d36e972-e325-11ce-bfc1-08002be10318}\0053?? ??A7??????????????????????????????Microsoft???????????{4d36e972-e325-11ce-bfc1-08002be10318}\0037?10??{4d36e972-e325-11ce-bfc1-08002be10318}?-4C??????????????????????????????????????????? ????????????????????????"???????????????????0????
Reg HKLM\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Linkage@Bind ????????@nettun.inf,%6to4mp.displayname%;Microsoft-6zu4-Adapter?????????????????????6.1.7600.16385??????*6to4mp?????????????????????????????????????37????l?????????????????????{4d36e972-e325-11ce-bfc1-08002be10318}??????? ??????????????????*6to4mp??-??? ????????????????????????????$?N?&?????????{4d36e972-e325-11ce-bfc1-08002be10318}\0038???????????????????????????N?????????????????{753BDA76-FC29-458C-B213-B0E8FD45A002}???????????????????????s??? ???????????????????????????e??????????????????????????????????????????????????????????? ???????1??????????? ????????????????????????????$?N???????????{4d36e972-e325-11ce-bfc1-08002be10318}\0028???????????????????????????N?????????????????{21403B74-FAE7-4F17-8729-0F2A13B76FD9}???????????????????????s??? ???????????????????????????e??????????????? ?????????????????????1????????????&???????????????????????? ???????????????????|?1??????*?&??? ??????rei??????????????????????????????????????????????LAN-Verbindung* 22???????????????l??????????????????????????nd????$??????n?
Reg HKLM\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Linkage@Route ?????????????????????v???????????????????????n??WUDFRd?ip6??????????????????????????? ???????s??????sl????N??????t?????DSS???????????????????????????????????????????B??????CE??Root\*6TO4MP\0044????????z???????3???????????????????????0??????????????????????????????????????????????????USB\ROOT_HUB&VID8086&PID2935&REV0003?USB\ROOT_HUB&VID8086&PID2935?USB\ROOT_HUB?????????????????????s?n???????h???????????e???????????B????X??????|???t??????????????? ??????????????????????????????????????????????????\??\USB#ROOT_HUB#4&3c0f5c3&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8}SAD??? ?????????????????????-???????????????db-??????????? ???????????????????????????????????????f??????????????? ?????????????????????1??L????????? ???????????????????????????????? ?????????????????????1????????????&???????????????????????? ?????????????????????1????????????????????? ?????????????????????1????????????????????????????????????????????????????usbport.inf:Generic.Section.NTx86:ROOTHUB.Dev:6.1.7600.16788:usb\root_hub???????????????????? ?
Reg HKLM\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Linkage@Export ?????????????????????????????i??????????tunnel??????????????MSAFD NetBIOS [\Device\NetBT_Tcpip6_{BC2ADF94-37FD-4EBC-9FA1-B7DBCA1CAD07}] SEQPACKET 84?2??? ???????????????????/????????"?????????????????????? ???????0???????????????????p?????eip???????+?????;?????????????????i??????????.N????$??????}???????C???????????????????????????i???w???????????.????????????:??????E????????????????????????6??????1???????m??????cdfs?????????????????????B??C:\Windows\system32\sw2_ttls.dll????? ???(???5?????.25???????_??????????? ???;??????????????????????MSAFD NetBIOS [\Device\NetBT_Tcpip6_{BC2ADF94-37FD-4EBC-9FA1-B7DBCA1CAD07}] DATAGRAM 84?E2??? ???????????????????/????????"???@?????????8-??MSAFD NetBIOS [\Device\NetBT_Tcpip6_{24B7EF70-4D09-4CC6-B224-FCD5C731E1F2}] SEQPACKET 86?F??? ???????????????????/????????"???A??????????-??? ???????????????????/????????"???B?????????????????????????????????????????????????????????????????T????????????C???t??????????????????l??????????????????????????????????????????????????????????????
Reg HKLM\SYSTEM\ControlSet002\services\LanmanServer\Linkage@Bind ???f?s??{4d36e97d-e325-11ce-bfc1-08002be10318}??????{00000000-0000-0000-ffff-ffffffffffff}?rti??? ???????????????????????????e?????????n??????N????????????????????e???f?????f?f????{4d36e97d-e325-11ce-bfc1-08002be10318}??????{4d36e97d-e325-11ce-bfc1-08002be10318}???????????7??????s????????????D??????-0????:????????g????????????????????? ???????f???????????d????????$????????????????.?&???????f??????????????????? ???????f???????????????????????????????f??? ???????f?????f???????1??L????????? ??????-?-?????f???f???f????????? ???????f?????f???????1????????????&???????????????????????? ???????f?????????????1???????????????????????f????? ???????f?????f???????1????????????????????{00000000-0000-0000-ffff-ffffffffffff}?yst???? ??f???????e??? ???f??????????????????? ???????f???????????U?1?????????????????????????f??????????????????????????? ???????f?????f???????1?????????????????????????7???????e???????f??????????? ???????f???????????U?1?????????????????????????U???????????????????-??25?????f????? ???????f?????f???????
Reg HKLM\SYSTEM\ControlSet002\services\LanmanServer\Linkage@Route ???k?s?????? ??????????s?????????s??????????????@volume.inf,%msft%;Microsoft?????l?l?????????????????????????????k???????????????k???????e?????l?&???????y????????????????????????X??m??????????????????????????????????????LegacyDriver?????l???l?l?k????????????????????:??????4?g?7?????????????????????????s?3???????????,???????????????m??????????? ??????????????????????82???????????????????????????????????????????????????m?????s?0???????????l???????????????l?l?????????????????l??????????????????????????? ???n??????????????usbccgp?&?????V??t?????????e?????????????????????????l???????z???????????l???l?l????????????? ???????k?????k?????k????????????$??????????R???????k??????s????l??? ???????k???????????k??????????b????????????????y??LegacyDriver????*6to4mp????????k?&??LegacyDriver??????N??k??? ????D??4??{8ECC055D-047F-11D1-A537-0000F8753ED1}??????????????????????????t????l??????????????86???k???????????????????????????????????????????|???i?k?k?k?k???l????X??m????????????????????????????m??????l???k??? ???????k?????
Reg HKLM\SYSTEM\ControlSet002\services\LanmanServer\Linkage@Export ???p?????|???????????????????????????????????????p??? ???f???6???????7??system32\drivers\fltmgr.sys?????????????????????????@%systemroot%\system32\wkssvc.dll,-1004?????Microsoft???????t???????????TDI???????:??s????????h?????11???????????p???0???2??????????? ???????o????????????????????(?4?X??????????????????????????????????0???????????????r??tO??????????????????????????? ???????[??????????*6to4mp??e??Tdx?nsi?????\SystemRoot\System32\drivers\dxgkrnl.sys????FSFilter Bottom?????FSFilter Infrastructure??????????????p??????????????????? ???????o?????q????Pq?2??????$?h?Z???????????N??p?????????e????@%SystemRoot%\System32\dnsapi.dll,-101???????????p??????p?????h??p????????h?????%SystemRoot%\system32\svchost.exe -k NetworkService???????N??p?????????n????@%SystemRoot%\System32\dnsapi.dll,-102?????????q0????p??? 8??p??????????????NT AUTHORITY\NetworkService????????????????????????????q????????????????????????t??????? ?????????????,? q???????????????????p???????????e??????????????????????? F??q???????????????q????b??p?
Reg HKLM\SYSTEM\ControlSet002\services\LanmanWorkstation\Linkage@Bind ???l?????l??? ???????k?????l?????l????????????I????????S?????k?l?l?l?l???l??Microsoft???????????? ??l??????????????STORAGE\Volume??????????????{4d36e972-e325-11ce-bfc1-08002be10318}\0006???????<??l?????g????????????????t????l???????k???????????l?l?l??? t??????????????????????l???3???s???????s????<??l?????g?????l??? ??????????????x????????l???????????l???????????????????????l??????????6.1.7600.16385????????*??l???o?? (??WAN Miniport (IKEv2)?3???l?l?????l??? ???????k?????l?????k????????????6? ???????????????????????????????? ???????l???????????k??????????P????????????????l???????3???l??Net??????l?????l?&??? ???????l???????????l??????????N???????????{8ECC055D-047F-11D1-A537-0000F8753ED1}??????{8ECC055D-047F-11D1-A537-0000F8753ED1}??????????????????????????????????????????????????pt???????????????????????j?j?l?l???????????l?????l??? ???????k?????l?????k????????????9? ???????Dt??LegacyDriver? ???l??? ???????l???????????k??????????\????????????????l??????s???tunnel???????l?????l?&??{8ECC055D-047F-11D1-A537-0000F8
Reg HKLM\SYSTEM\ControlSet002\services\LanmanWorkstation\Linkage@Route ???l?????l??? ???????k?????l?????k????????????9? ???????Dt??LegacyDriver? ???l??? ???????l???????????k??????????\????????????????l??????s???tunnel???????l?????l?&??{8ECC055D-047F-11D1-A537-0000F8753ED1}?0?0??? `??????0??????????LegacyDriver?????????l???-??e5????N??l????????????????????????????????????X??????????????????????????????????????????????????????z??LegacyDriver?????????????l?los??{00000000-0000-0000-0000-000000000000}???????l???????????????????????????????????????l??????????netavpna.inf?????????????????????? ??l???1??????Ndi-Mp-AgileVpn?Vp???????????p??in????(??l???1???1??ms_agilevpnminiport??1???????????????1???????l???????????????????????????????????????????l?l????{4d36e972-e325-11ce-bfc1-08002be10318}??Ne??@netrasa.inf,%msft%;Microsoft?????X?????????????storage\volume??????Microsoft???????????????????{4d36e972-e325-11ce-bfc1-08002be10318}???????????????????????????k??????p????l???????1??{4d36e972-e325-11ce-bfc1-08002be10318}???????????j???????e??@netrasa.inf,%msft%;Microsoft????????z?????????????
Reg HKLM\SYSTEM\ControlSet002\services\LanmanWorkstation\Linkage@Export ????????????????????t??????? ?????????????,? q???????????????????p???????????e??????????????????????? F??q???????????????q????b??p??????????????????SeChangeNotifyPrivilege?SeCreateGlobalPrivilege??????????q???????????q???????????????????????????????????????p?p?p?p?p?p?p?p?p?p?p?p????? ???????p?????p?????p?2??????,?F??? ???????????%SystemRoot%\System32\dnsrslvr.dll????????????????????????????????B??q????????n?????%SystemRoot%\System32\dnsext.dll????? ???????q???????????q?2??????????????????????<??s????????h?????? ???????p???????????p?2????????????????????????????0??????????????????????????? ??????????? ??????????????????????????????????????????????????? ????(??????P???????????????????????????????????????? ???????p?????p???????2???????????????????o???????q???q???q????????? ???????q???????????q?2??????????????0??????????????????????????????????????????q???????????????q??????0???5355?UDP?????q?q?q?q?q????????????????0?????? ???????o?????q??????????????$???[??????c??@%systemroot%\system32\dot3svc.dll,-1102???????
---- EOF - GMER 1.0.15 ----
OSAM Logfile: Code:
ATTFilter Report of OSAM: Autorun Manager v5.0.11926.0 hxxp://www.online-solutions.ru/en/ Saved at 16:08:41 on 24.05.2011 OS: Windows 7 (Build 7600), 32-bit Default Browser: Mozilla Corporation Firefox 4.0.1 Scanner Settings [x] Rootkits detection (hidden registry) [x] Rootkits detection (hidden files) [x] Retrieve files information [x] Check Microsoft signatures Filters [ ] Trusted entries [ ] Empty entries [x] Hidden registry entries (rootkit activity) [x] Exclusively opened files [x] Not found files [x] Files without detailed information [x] Existing files [ ] Non-startable services [ ] Non-startable drivers [x] Active entries [x] Disabled entries [Common] -----( %SystemRoot%\Tasks )----- "RegistryBooster.job" - "Uniblue Systems Limited" - C:\Program Files\Uniblue\RegistryBooster\rbmonitor.exe [Control Panel Objects] -----( %SystemRoot%\system32 )----- "cmmx01.cpl" - "combit GmbH" - C:\Windows\system32\cmmx01.cpl "DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\Windows\system32\DivXControlPanelApplet.cpl "ISUSPM.cpl" - "Macrovision Corporation" - C:\Windows\system32\ISUSPM.cpl -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )----- "mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\MLCFG32.CPL "QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl [Drivers] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "Apple Mobile USB Driver" (USBAAPL) - "Apple, Inc." - C:\Windows\System32\Drivers\usbaapl.sys "avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys "avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys "catchme" (catchme) - ? - C:\Users\Michi\AppData\Local\Temp\catchme.sys (File not found) "pxdyipob" (pxdyipob) - ? - C:\Users\Michi\AppData\Local\Temp\pxdyipob.sys (Hidden registry entry, rootkit activity | File not found) "Sony DMI Call service" (DMICall) - "Sony Corporation" - C:\Windows\System32\DRIVERS\DMICall.sys "ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys [Explorer] -----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )----- {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll -----( HKLM\Software\Classes\Protocols\Filter )----- {807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL -----( HKLM\Software\Classes\Protocols\Handler )----- {314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - c:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL {88FED34C-F0CA-4636-A375-3CB6248B04CD} "Local Groove Web Services Protocol" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )----- {B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )----- {DE902992-61FC-4A01-8091-53E1895C9775} "CDR Icon Handler" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\x86\ShellXP.dll {7AD101F2-0B93-4D66-A1CA-DF73F3C4377B} "CDR preview provider" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\x86\ShellVista.dll {7FA63AC0-F5BC-4F3B-A9CF-94328D812B62} "CDR Property Handler" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\x86\ShellVista.dll {1462EBAA-96E7-4D93-9A66-0E4068DE4FCF} "CDR Thumbnail provider" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\x86\ShellXP.dll {DE902994-61FC-4A01-8091-53E1895C9775} "CMX Icon Handler" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\x86\ShellXP.dll {1462EBAC-96E7-4D93-9A66-0E4068DE4FCF} "CMX Thumbnail provider" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\x86\ShellXP.dll "CorelDRAW Shell Extension Component" - ? - (File not found | COM-object registry key not found) {DE902993-61FC-4A01-8091-53E1895C9775} "CPT Icon Handler" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\x86\ShellXP.dll {7FA63AC1-F5BC-4F3B-A9CF-94328D812B62} "CPT Property Handler" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\x86\ShellVista.dll {1462EBAB-96E7-4D93-9A66-0E4068DE4FCF} "CPT Thumbnail provider" - "Corel Corporation" - c:\Program Files\Common Files\Corel\Shared\Shell Extension\x86\ShellXP.dll {99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll {993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll {5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\ONFILTER.DLL {00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\MLSHEXT.DLL {C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll {0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\OLKFSTUB.DLL {45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll {B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\WinRAR\rarext.dll [Internet Explorer] -----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )----- ITBar7Height "ITBar7Height" - ? - (File not found | COM-object registry key not found) <binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found) -----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )----- {8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_22.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab {F27237D7-93C8-44C2-AC6E-D6057B9A918F} "JuniperSetupClientControl Class" - "Juniper Networks" - C:\Windows\Downloaded Program Files\JuniperSetupClient.ocx / https://juniper.net/dana-cached/sc/JuniperSetupClient.cab -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )----- {48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll {53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll {FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Plugins\Extension )----- "CS ChemDraw Pro Plugin" - "CambridgeSoft.Com" - C:\Program Files\Internet Explorer\PLUGINS\Npcdp32.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )----- {18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll {593DDEC6-7468-4cdd-90E1-42DADAA222E9} "DivX HiQ" - "DivX, LLC" - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll {326E768D-4182-46FD-9C16-1449A49795F4} "DivX Plus Web Player HTML5 <video>" - "DivX, LLC" - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll {72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll {DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll {53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [Logon] -----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )----- "desktop.ini" - ? - C:\Users\Michi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini -----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )----- "desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini "McAfee Security Scan Plus.lnk" - "McAfee, Inc." - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (Shortcut exists | File exists) -----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )----- "ISUSPM Startup" - "Macrovision Corporation" - "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup "RegistryBooster" - "Uniblue Systems Limited" - "C:\Program Files\Uniblue\RegistryBooster\launcher.exe" delay 20000 "Skype" - "Skype Technologies S.A." - "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized "SpybotSD TeaTimer" - "Safer-Networking Ltd." - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )----- "Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" "avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min "DivX Download Manager" - "DivX, LLC" - "C:\Program Files\DivX\DivX Plus Web Player\DDmService.exe" start "DivXUpdate" - ? - "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW "GrooveMonitor" - "Microsoft Corporation" - "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" "ISUSScheduler" - "Macrovision Corporation" - "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start "QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime "SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe" "WinampAgent" - "Nullsoft, Inc." - "C:\Program Files\Winamp\winampa.exe" [Print Monitors] -----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )----- "Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll [Services] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe "Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe "Juniper Network Connect Service" (dsNcService) - "Juniper Networks" - C:\Program Files\Juniper Networks\Common Files\dsNcService.exe "McAfee Security Scan Component Host Service" (McComponentHostService) - "McAfee, Inc." - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe "Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe "Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE "Microsoft Office Groove Audit Service" (Microsoft Office Groove Audit Service) - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe "Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE "SBSD Security Center Service" (SBSDWSCService) - "Safer Networking Ltd." - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe "SQL Server (CSSQL05)" (MSSQL$CSSQL05) - "Microsoft Corporation" - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe "SQL Server Browser" (SQLBrowser) - "Microsoft Corporation" - C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe "SQL Server VSS Writer" (SQLWriter) - "Microsoft Corporation" - C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe "VAIO Event Service" (VAIO Event Service) - "Sony Corporation" - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe [Winlogon] -----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )----- "VESWinlogon" - "Sony Corporation" - C:\Windows\system32\VESWinlogon.dll ===[ Logfile end ]=========================================[ Logfile end ]=== If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru[/QUOTE] Zitat:
|
|
24.05.2011, 17:35
| #20 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Trojaner TR/Spy.Ipsiut.l in C:\Windows\System32\vdmdbg32.dll Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs. Denk dran beide Tools zu updaten vor dem Scan!! Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt: ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten |
|
25.05.2011, 23:24
| #21 | |||
| | Trojaner TR/Spy.Ipsiut.l in C:\Windows\System32\vdmdbg32.dll Okay, hier die log-dateien: Zitat:
Zitat:
Zitat:
|
|
26.05.2011, 09:22
| #22 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Trojaner TR/Spy.Ipsiut.l in C:\Windows\System32\vdmdbg32.dllZitat:
 
__________________ Logfiles bitte immer in CODE-Tags posten |
|
26.05.2011, 12:58
| #23 |
| | Trojaner TR/Spy.Ipsiut.l in C:\Windows\System32\vdmdbg32.dll Das hatte mir ein Kollege raufgemacht, da die Arbeits-CD gerade im Umlauf war. (nutze das Program aber gar nicht mehr, da nun die CD wieder aufgetaucht ist und das eigentliche drauf ist.) Ging davon aus, das alles klar geht damit, aber wenn ich das richtig verstehe, ist es ne gecrackte Version. Das war mir nicht recht bewusst (naiv, ich weiß). Sorry... Habs runter geschmissen auch wenn zu spät realisiert. |
|
26.05.2011, 13:16
| #24 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Trojaner TR/Spy.Ipsiut.l in C:\Windows\System32\vdmdbg32.dll Sei froh, dass wir das am Ende gefunden, die Bereinigung ist von meiner Seite aus nämlich durch, es wurden nur noch Überreste gefunden. Rechner wieder im Lot oder noch Probleme oder andere Funde?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
26.05.2011, 14:26
| #25 |
| | Trojaner TR/Spy.Ipsiut.l in C:\Windows\System32\vdmdbg32.dll Naja, bin schon erschrocken das ich das noch drauf hatte und v.a. dass es nicht rechtens war. Nen Anschiss an den Kolleen steht noch aus und ab sofort wird alles selbst rauf gemacht... Mein Outlook funktioniert nicht mehr richtig (werd es später neu installieren und die ganzen Such-und Reinigungstools entfernen, vielleicht klappts dann wieder) und ich kann meine eigenden Dateien und Dokumente noch immer nicht öffnen. Vielleicht das unhide.exe nochmal versuchen? Ansonsten scheint alles okay. Jedenfalls vielen Dank für die viele Hilfe! |
|
26.05.2011, 19:26
| #26 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Trojaner TR/Spy.Ipsiut.l in C:\Windows\System32\vdmdbg32.dllZitat:
Problem durch Neu-/Reparaturinstallation behoben?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Trojaner TR/Spy.Ipsiut.l in C:\Windows\System32\vdmdbg32.dll |
| .dll, antivir, appdata, avira, avira antivir, bericht, bytes, datei, entfernen, folge, free, gelöscht, hängen, klicke, löschen, neustart, nt.dll, programm, system, system32, temp, trojaner, trojanische pferd, warnung, windows, zugriff |
Linear-Darstellung
