Trojaner-Board
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Kürzlich angezeigter Backdoor:/win32/cybot.B und Rootkit noch im System? (https://www.trojaner-board.de/107549-kuerzlich-angezeigter-backdoor-win32-cybot-b-rootkit-noch-system.html)

lillix 06.01.2012 00:47
So, habe Combofix durchgenommen, es kamen keine Meldungen zu Updates oder sonstigem, sondern er hat sofort nach dem Programmstart angefangen zu scannen; hier die Logdatei
Code:
ComboFix 12-01-05.01 - A** R*** 06.01.2012  0:18.1.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6002.2.1252.49.1031.18.2045.1384 [GMT 1:00]
ausgeführt von:: d:\desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\System32\Desktop_.ini
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-12-05 bis 2012-01-05  ))))))))))))))))))))))))))))))
.
.
2012-01-05 15:21 . 2012-01-05 15:21        56200        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{4C9128F9-532A-4218-9712-9AAB7BAC91BB}\offreg.dll
2012-01-05 10:02 . 2012-01-05 10:02        --------        d-----w-        c:\programdata\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}
2012-01-04 22:02 . 2012-01-04 22:02        --------        d-----w-        c:\program files\ESET
2012-01-04 16:53 . 2012-01-04 16:53        --------        d-----w-        c:\program files\7-Zip
2012-01-03 21:01 . 2011-11-21 10:47        6823496        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{4C9128F9-532A-4218-9712-9AAB7BAC91BB}\mpengine.dll
2012-01-01 12:47 . 2012-01-01 12:47        --------        d-----w-        c:\users\A** R**\AppData\Roaming\Malwarebytes
2012-01-01 12:47 . 2012-01-01 12:47        --------        d-----w-        c:\programdata\Malwarebytes
2012-01-01 12:47 . 2012-01-01 12:47        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2012-01-01 12:47 . 2011-12-10 14:24        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-01-01 12:30 . 2011-11-07 08:26        939368        ----a-w-        c:\windows\system32\flash.ocx
2012-01-01 12:30 . 2012-01-01 12:30        --------        d-----w-        c:\users\A** R**\AppData\Local\PackageAware
2011-12-30 22:09 . 2011-12-30 22:09        --------        d-----w-        c:\programdata\PC Tools
2011-12-30 19:43 . 2011-12-30 19:43        19416        ----a-w-        c:\program files\Mozilla Firefox\AccessibleMarshal.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-30 19:43 . 2011-05-10 16:49        134104        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"????r"="" [?]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2006-12-01 4186112]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-23 815104]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-01-02 464168]
"WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2006-12-20 90191]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-12-20 7766016]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-12-20 81920]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-854496051-4105752481-171786061-1000]
"EnableNotificationsRef"=dword:00000001
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 38904216
*Deregistered* - 38904216
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation        REG_MULTI_SZ          FontCache
.
.
------- Zusätzlicher Suchlauf -------
.
uSearchMigratedDefaultURL =
mStart Page =
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\A** R**\AppData\Roaming\Mozilla\Firefox\Profiles\83r1d5sg.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - hxxp://www.freitag.de/kultur
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM-Run-eRecoveryService - (no file)
AddRemove-{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA} - c:\programdata\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}\bm_installer.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-01-06 00:30
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2012-01-06  00:38:23
ComboFix-quarantined-files.txt  2012-01-05 23:38
.
Vor Suchlauf: 8 Verzeichnis(se), 25.680.564.224 Bytes frei
Nach Suchlauf: 11 Verzeichnis(se), 25.494.097.920 Bytes frei
.
- - End Of File - - 42A8B618B4DF3A85838D7EF1D9AB7A8D
Eine guuute Nacht gewünscht,
Lillix

cosinus 06.01.2012 14:14
Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:
Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"????r"=-
3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

lillix 06.01.2012 15:09
Hat geklappt! Nachdem ich die CombofixLogfile auf dem Desktop gespeichert hatte, ging der Explorer irgendwie nicht, es kam eine Meldung über eine Löschung eines Registrierungsschlüssels, aber nach dem Neustart scheint wieder alles in Butter! Hier die Logdatei
Code:
ComboFix 12-01-05.01 - A** R** 06.01.2012  14:38:13.2.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6002.2.1252.49.1031.18.2045.1281 [GMT 1:00]
ausgeführt von:: d:\desktop\ComboFix.exe
Benutzte Befehlsschalter :: d:\desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-12-06 bis 2012-01-06  ))))))))))))))))))))))))))))))
.
.
2012-01-06 13:48 . 2012-01-06 13:48        --------        d-----w-        c:\users\A** R**\AppData\Local\temp
2012-01-06 13:48 . 2012-01-06 13:48        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-01-06 12:18 . 2012-01-06 12:18        56200        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{4C9128F9-532A-4218-9712-9AAB7BAC91BB}\offreg.dll
2012-01-05 23:42 . 2012-01-05 23:42        --------        d-----w-        c:\windows\Sun
2012-01-05 10:02 . 2012-01-05 10:02        --------        d-----w-        c:\programdata\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}
2012-01-04 22:02 . 2012-01-04 22:02        --------        d-----w-        c:\program files\ESET
2012-01-04 16:53 . 2012-01-04 16:53        --------        d-----w-        c:\program files\7-Zip
2012-01-03 21:01 . 2011-11-21 10:47        6823496        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{4C9128F9-532A-4218-9712-9AAB7BAC91BB}\mpengine.dll
2012-01-01 12:47 . 2012-01-01 12:47        --------        d-----w-        c:\users\A** R**\AppData\Roaming\Malwarebytes
2012-01-01 12:47 . 2012-01-01 12:47        --------        d-----w-        c:\programdata\Malwarebytes
2012-01-01 12:47 . 2012-01-01 12:47        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2012-01-01 12:47 . 2011-12-10 14:24        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-01-01 12:30 . 2011-11-07 08:26        939368        ----a-w-        c:\windows\system32\flash.ocx
2012-01-01 12:30 . 2012-01-01 12:30        --------        d-----w-        c:\users\A** R**\AppData\Local\PackageAware
2011-12-30 22:09 . 2011-12-30 22:09        --------        d-----w-        c:\programdata\PC Tools
2011-12-30 19:43 . 2011-12-30 19:43        19416        ----a-w-        c:\program files\Mozilla Firefox\AccessibleMarshal.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-30 19:43 . 2011-05-10 16:49        134104        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((  SnapShot@2012-01-05_23.30.31  )))))))))))))))))))))))))))))))))))))))))
.
- 2007-01-19 10:34 . 2012-01-05 15:23        70480              c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2007-01-19 10:34 . 2012-01-06 12:22        70480              c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2007-09-05 09:39 . 2012-01-06 12:22        19044              c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-854496051-4105752481-171786061-1000_UserData.bin
- 2007-09-05 09:39 . 2012-01-05 15:23        19044              c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-854496051-4105752481-171786061-1000_UserData.bin
- 2012-01-05 15:21 . 2012-01-05 15:21        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-01-06 12:18 . 2012-01-06 12:18        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-01-05 15:21 . 2012-01-05 15:21        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2012-01-06 12:18 . 2012-01-06 12:18        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2007-09-04 13:44 . 2012-01-06 13:32        366402              c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2006-11-02 13:05 . 2012-01-06 12:22        130402              c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2011-02-09 19:38 . 2012-01-05 15:20        346156              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-02-09 19:38 . 2012-01-05 23:52        346156              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2011-05-10 18:15 . 2012-01-05 15:20        689660              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-854496051-4105752481-171786061-1000-8192.dat
+ 2011-05-10 18:15 . 2012-01-05 23:52        689660              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-854496051-4105752481-171786061-1000-8192.dat
+ 2011-06-08 21:31 . 2012-01-05 23:52        689660              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-854496051-4105752481-171786061-1000-12288.dat
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"????r"="" [?]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2006-12-01 4186112]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-23 815104]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-01-02 464168]
"WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2006-12-20 90191]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-12-20 7766016]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-12-20 81920]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-854496051-4105752481-171786061-1000]
"EnableNotificationsRef"=dword:00000001
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation        REG_MULTI_SZ          FontCache
.
.
------- Zusätzlicher Suchlauf -------
.
uSearchMigratedDefaultURL =
mStart Page =
TCP: DhcpNameServer = 83.169.184.33 83.169.184.97
FF - ProfilePath - c:\users\A** R**\AppData\Roaming\Mozilla\Firefox\Profiles\83r1d5sg.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - hxxp://www.freitag.de/kultur
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-01-06 14:48
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2012-01-06  14:56:46
ComboFix-quarantined-files.txt  2012-01-06 13:56
ComboFix2.txt  2012-01-05 23:38
.
Vor Suchlauf: 10 Verzeichnis(se), 25.434.103.808 Bytes frei
Nach Suchlauf: 11 Verzeichnis(se), 25.376.116.736 Bytes frei
.
- - End Of File - - 2B8BBFD73061810F287C85FD428157CA
Danke und viele Grüße,
Lilli

cosinus 06.01.2012 15:37
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

lillix 06.01.2012 23:44
Alles klar, gesagt, getan. Großes Dankeschön! Hier also die drei Logs;
[code]
GMER Logfile:
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-01-06 22:57:53
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Hitachi_HTS541616J9SA00 rev.SB4OC70P
Running: 5wzco674.exe; Driver: C:\Users\A***~1\AppData\Local\Temp\uwliqfog.sys


---- System - GMER 1.0.15 ----

SSDT            9C6CD15C                                                                                                            ZwCreateThread
SSDT            9C6CD148                                                                                                            ZwOpenProcess
SSDT            9C6CD14D                                                                                                            ZwOpenThread
SSDT            9C6CD157                                                                                                            ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

.text          ntkrnlpa.exe!KeSetEvent + 221                                                                                      826B39A4 4 Bytes  [5C, D1, 6C, 9C]
.text          ntkrnlpa.exe!KeSetEvent + 3F1                                                                                      826B3B74 4 Bytes  [48, D1, 6C, 9C]
.text          ntkrnlpa.exe!KeSetEvent + 40D                                                                                      826B3B90 4 Bytes  [4D, D1, 6C, 9C]
.text          ntkrnlpa.exe!KeSetEvent + 621                                                                                      826B3DA4 4 Bytes  [57, D1, 6C, 9C]
.text          C:\Windows\system32\DRIVERS\nvlddmkm.sys                                                                            section is writeable [0x8CA0D340, 0x2932D7, 0xE8000020]

---- User IAT/EAT - GMER 1.0.15 ----

IAT            C:\Windows\Explorer.EXE[3092] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown]                              [74907817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[3092] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage]                                [7495A86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[3092] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI]                            [7490BB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[3092] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode]                      [748FF695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[3092] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup]                                [749075E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[3092] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC]                            [748FE7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[3092] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM]                [74938395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[3092] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream]                    [7490DA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[3092] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight]                            [748FFFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[3092] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth]                            [748FFF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[3092] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage]                              [748F71CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[3092] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM]                      [7498CAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[3092] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile]                        [7492C8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[3092] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics]                            [748FD968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[3092] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree]                                      [748F6853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[3092] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc]                                    [748F687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[3092] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode]                        [74902AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18342_none_9e54f8aaca13c773\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                                            Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                                            Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                   
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                C:\Program Files\DAEMON Tools Lite\
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                0xD4 0xC3 0x97 0x02 ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                0
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                              0x0B 0x14 0x7F 0xD6 ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                         
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                        0x20 0x01 0x00 0x00 ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                    0xFA 0x4E 0x63 0x00 ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                     
Reg            HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                0x04 0x2B 0xC2 0x02 ...
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)               
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                    C:\Program Files\DAEMON Tools Lite\
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                    0xD4 0xC3 0x97 0x02 ...
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                    0
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                  0x0B 0x14 0x7F 0xD6 ...
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)     
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                            0x20 0x01 0x00 0x00 ...
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                        0xFA 0x4E 0x63 0x00 ...
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet) 
Reg            HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                    0x04 0x2B 0xC2 0x02 ...

---- EOF - GMER 1.0.15 ----
--- --- ---


Code:
OSAM Logfile:

       
Code:

       
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 23:08:58 on 06.01.2012

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit
Default Browser: Mozilla Corporation Firefox 6.0

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl
"ISUSPM.cpl" - "Macrovision Corporation" - C:\Windows\system32\ISUSPM.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgio" (avgio) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"catchme" (catchme) - ? - C:\Users\A**~1\AppData\Local\Temp\catchme.sys  (File not found)
"Conexant Setup API" (UIUSys) - ? - C:\Windows\System32\DRIVERS\UIUSYS.SYS  (File not found)
"int15" (int15) - ? - C:\Acer\Empowering Technology\eRecovery\int15.sys  (File found, but it contains no detailed information)
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"PSDFilter" (PSDFilter) - "HiTRUST" - C:\Windows\System32\DRIVERS\psdfilter.sys
"PSDNSERVER" (PSDNServ) - "HiTRUST" - C:\Windows\System32\drivers\PSDNServ.sys
"psdvdisk" (psdvdisk) - "HiTRUST" - C:\Windows\System32\drivers\psdvdisk.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys
"Upper Class Filter Driver" (NTIDrvr) - "NewTech Infosystems, Inc." - C:\Windows\System32\DRIVERS\NTIDrvr.sys

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807553E5-5146-11D5-A672-00B0D022E945} "text/xml" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)
{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)
{94586423-855F-4EB2-9F6A-D9DA5658DBE3} "Context menu" - ? - C:\PROGRA~1\FREEM4~1\m4a_menu.dll  (File found, but it contains no detailed information)
{2b45bd21-71f8-4c8c-a87a-7eeb25a1a3e0} "EPM-PO Shell Extensions" - ? - epm-po.dll  (File not found)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)
{00020d75-0000-0000-c000-000000000046} "lnkfile" - ? -   (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\OFFICE11\msohev.dll
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll  (File found, but it contains no detailed information)

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)
<binary data> "{DFEFCDEE-CF1A-4FC8-88AD-48514E463B27}" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} "Java Plug-in 1.6.0_02" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} "Java Plug-in 1.6.0_05" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} "Java Plug-in 1.6.0_07" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_26.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
{67DABFBF-D0AB-41FA-9C46-CC0F21721616} "{67DABFBF-D0AB-41FA-9C46-CC0F21721616}" - ? -   (File not found | COM-object registry key not found) / hxxp://download.divx.com/player/DivXBrowserPlugin.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Recherchieren" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "AcroIEHlprObj Class" - "Adobe Systems Incorporated" - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\A** R**\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"AdobeCS4ServiceManager" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"eDataSecurity Loader" - "HiTRUST" - C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
"WarReg_PopUp" - "Acer Inc." - C:\Acer\WR_PopUp\WarReg_PopUp.exe

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\Windows\system32\mdimon.dll
"PDF995 Monitor" - ? - C:\Windows\system32\pdf995mon.dll  (File found, but it contains no detailed information)
"PDFCreator" - ? - C:\Windows\system32\pdfcmnnt.dll  (File found, but it contains no detailed information)

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##" (Bonjour Service) - "Apple Computer, Inc." - C:\Program Files\Bonjour\mDNSResponder.exe
"@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Scheduler" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
"eDSService.exe" (eDataSecurity Service) - "HiTRSUT" - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
"eLock Service" (eLockService) - "Acer Inc." - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
"eNet Service" (eNet Service) - "Acer Inc." - C:\Acer\Empowering Technology\eNet\eNet Service.exe
"ePower Service" (WMIService) - "acer" - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
"eRecovery Service" (eRecoveryService) - "Acer Inc." - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
"eSettings Service" (eSettingsService) - ? - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
"FLEXnet Licensing Service" (FLEXnet Licensing Service) - "Acresso Software Inc." - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
"LightScribeService Direct Disc Labeling Service" (LightScribeService) - "Hewlett-Packard Company" - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"MobilityService" (MobilityService) - ? - C:\Acer\Mobility Center\MobilityService.exe  (File found, but it contains no detailed information)
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"SBSD Security Center Service" (SBSDWSCService) - "Safer Networking Ltd." - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
"Symantec Lic NetConnect service" (CLTNetCnService) - ? - "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon  (File not found)

[Winlogon]
-----( HKCU\Control Panel\Desktop )-----
"SCRNSAVE.EXE" - ? - C:\Windows\system32\FLIGHT~1.SCR  (File not found)

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Computer, Inc." - C:\Program Files\Bonjour\mdnsNSP.dll

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
Code:
aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-06 23:18:41
-----------------------------
23:18:41.058    OS Version: Windows 6.0.6002 Service Pack 2
23:18:41.058    Number of processors: 2 586 0xE0C
23:18:41.058    ComputerName: A**-PC  UserName:
23:19:07.156    Initialize success
23:20:37.989    AVAST engine defs: 12010601
23:20:45.383    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
23:20:45.399    Disk 0 Vendor: Hitachi_HTS541616J9SA00 SB4OC70P Size: 152627MB BusType: 3
23:20:45.461    Disk 0 MBR read successfully
23:20:45.461    Disk 0 MBR scan
23:20:45.508    Disk 0 unknown MBR code
23:20:45.508    Disk 0 Partition 1 00    27 Hidden NTFS WinRE NTFS        7993 MB offset 63
23:20:45.555    Disk 0 Partition 2 80 (A) 06        FAT16 NTFS        72472 MB offset 16370235
23:20:45.586    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS        72159 MB offset 164794770
23:20:45.617    Disk 0 scanning sectors +312576705
23:20:45.695    Disk 0 scanning C:\Windows\system32\drivers
23:21:09.017    Service scanning
23:21:10.905    Modules scanning
23:21:23.400    Disk 0 trace - called modules:
23:21:23.431    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll ataport.SYS pciide.sys PCIIDEX.SYS atapi.sys
23:21:23.447    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8593eac8]
23:21:23.447    3 CLASSPNP.SYS[889c18b3] -> nt!IofCallDriver -> [0x8526d918]
23:21:23.463    5 acpi.sys[882976bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x8524cb98]
23:21:23.962    AVAST engine scan C:\Windows
23:21:34.320    AVAST engine scan C:\Windows\system32
23:24:52.097    AVAST engine scan C:\Windows\system32\drivers
23:25:06.465    AVAST engine scan C:\Users\A** R**
23:27:48.549    AVAST engine scan C:\ProgramData
23:32:49.644    Scan finished successfully
23:33:35.945    Disk 0 MBR has been saved successfully to "D:\Desktop\MBR.dat"
23:33:35.945    The log file has been saved successfully to "D:\Desktop\aswMBR.txt"

cosinus 07.01.2012 00:09
Zitat:
23:20:45.508 Disk 0 unknown MBR code
Wir sollten den MBR fixen, sichere für den Fall der Fälle ALLE wichtigen Daten, auch wenn meistens alles glatt geht.

Hinweis: Mach bitte NICHT den MBR-Fix, wenn du noch andere Betriebssysteme wie zB Ubuntu installiert hast, ein MBR-Fix mit Windows-Tools macht ein parallel installiertes (Dualboot) Linux unbootbar.

Starte nach der Datensicherung aswmbr erneut und klick auf den Button FIXMBR.
Anschließend Windows neu starten und ein neues Log mit aswMBR machen.

lillix 07.01.2012 12:34
Ok! Hoffe ich habe alles richtig gemacht, es ging alles ganz schnell, der MBRFix, und auch die Log ist ziemlich kurz im Vergleich zu den anderen.. habe es so verstanden sie NACH dem Neustart zu machen...?!
Hier ist sie:
Code:
aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-07 12:28:50
-----------------------------
12:28:50.161    OS Version: Windows 6.0.6002 Service Pack 2
12:28:50.161    Number of processors: 2 586 0xE0C
12:28:50.161    ComputerName: A**-PC  UserName:
12:28:51.003    Initialize success
12:29:03.764    AVAST engine defs: 12010601
12:30:47.145    The log file has been saved successfully to "D:\Desktop\aswMBR701.txt"
LG!!

cosinus 07.01.2012 15:33
Nein da ist was schiefgegeangen. Einfach wie beim ersten Mal aswMBR nochmal ausführen, das Log muss wesentlich länger sein

lillix 07.01.2012 16:40
ok, hoffe das ist nun das Log das du benötigst.. habe nochmal gescannt und dann die Logfile davon hier
Code:
aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-07 16:23:27
-----------------------------
16:23:27.166    OS Version: Windows 6.0.6002 Service Pack 2
16:23:27.166    Number of processors: 2 586 0xE0C
16:23:27.166    ComputerName: A**-PC  UserName:
16:23:27.977    Initialize success
16:23:40.441    AVAST engine defs: 12010601
16:23:44.762    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
16:23:44.778    Disk 0 Vendor: Hitachi_HTS541616J9SA00 SB4OC70P Size: 152627MB BusType: 3
16:23:44.794    Disk 0 MBR read successfully
16:23:44.794    Disk 0 MBR scan
16:23:44.809    Disk 0 Windows VISTA default MBR code
16:23:44.809    Disk 0 Partition 1 00    27 Hidden NTFS WinRE NTFS        7993 MB offset 63
16:23:44.840    Disk 0 Partition 2 80 (A) 06        FAT16 NTFS        72472 MB offset 16370235
16:23:44.856    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS        72159 MB offset 164794770
16:23:44.872    Disk 0 scanning sectors +312576705
16:23:44.981    Disk 0 scanning C:\Windows\system32\drivers
16:24:04.652    Service scanning
16:24:07.632    Modules scanning
16:25:14.213    Disk 0 trace - called modules:
16:25:14.260    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll ataport.SYS pciide.sys PCIIDEX.SYS atapi.sys
16:25:14.260    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85a27898]
16:25:14.275    3 CLASSPNP.SYS[889b88b3] -> nt!IofCallDriver -> [0x8526ff08]
16:25:14.291    5 acpi.sys[8829e6bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x851f47d8]
16:25:14.759    AVAST engine scan C:\Windows
16:25:25.164    AVAST engine scan C:\Windows\system32
16:28:43.471    AVAST engine scan C:\Windows\system32\drivers
16:28:58.541    AVAST engine scan C:\Users\A** R**
16:31:33.636    AVAST engine scan C:\ProgramData
16:35:58.150    Scan finished successfully
16:36:19.896    Disk 0 MBR has been saved successfully to "D:\Desktop\MBR.dat"
16:36:19.912    The log file has been saved successfully to "D:\Desktop\aswMBR701.txt"

cosinus 07.01.2012 16:46
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!


Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


lillix 07.01.2012 17:07
Ooh, das hört sich super an!
Logs folgen!
Noch eine Frage, kann ich diese ganzen Programme, die ich für diese Reinigungs-Aktion runtergeladen habe, nach Beenden wieder deinstallieren? Habe mal gelesen, dass sich Antiviren-Software möglicherweise gegenseitig behindern.. Stimmt das? Oder soll ich sie für den Fall der Fälle mal drauf lassen?
Wirklich nochmal vielen Dank für deine ausführliche Betreuung bei diesem Problem!!
LG, Lilli

cosinus 07.01.2012 17:09
Mach doch erst die Kontrollscans die Programme werden dann wieder gelöscht wenn wir durch sind!
Und Malwarebytes hat einen Updatebutton!

lillix 07.01.2012 23:17
Uff, geschafft, hier die drei Logs:
Code:
Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org

Datenbank Version: v2012.01.07.03

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 8.0.6001.19170
A** R** :: A**-PC [Administrator]

07.01.2012 17:23:13
mbam-log-2012-01-07 (17-23-13).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 354257
Laufzeit: 1 Stunde(n), 36 Minute(n), 25 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Superantispy hat einen gefunden, als es mich anschliessend fragte was es damit tun soll, habe ich "remove" geklickt, hoffe das war angemessen..
Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 01/07/2012 at 09:08 PM

Application Version : 5.0.1142

Core Rules Database Version : 8112
Trace Rules Database Version: 5924

Scan type      : Complete Scan
Total Scan Time : 01:59:04

Operating System Information
Windows Vista Home Premium 32-bit, Service Pack 2 (Build 6.00.6002)
UAC On - Administrator

Memory items scanned      : 646
Memory threats detected  : 0
Registry items scanned    : 36181
Registry threats detected : 0
File items scanned        : 236197
File threats detected    : 1

Trojan.Agent/Gen-Malintent
        C:\PROGRAM FILES\WINRAR\DEFAULT.SFX
Code:
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internetesets_scanner_update returned -1 esets_gle=1
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=dfc29408f729fc438993d748e1bdcf1e
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-01-05 12:37:51
# local_time=2012-01-05 01:37:51 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1797 16775165 100 94 291284 98375365 297063 0
# compatibility_mode=5892 16776573 100 100 27874 163249978 0 0
# compatibility_mode=8192 67108863 100 0 6290 6290 0 0
# scanned=215699
# found=17
# cleaned=0
# scan_time=6620
C:\Program Files\Uniblue\RegistryBooster\Launcher.exe        Win32/RegistryBooster application (unable to clean)        00000000000000000000000000000000        I
C:\Program Files\Uniblue\RegistryBooster\rbmonitor.exe        Win32/RegistryBooster application (unable to clean)        00000000000000000000000000000000        I
C:\Program Files\Uniblue\RegistryBooster\rbnotifier.exe        Win32/RegistryBooster application (unable to clean)        00000000000000000000000000000000        I
C:\Program Files\Uniblue\RegistryBooster\rb_move_serial.exe        Win32/RegistryBooster application (unable to clean)        00000000000000000000000000000000        I
C:\Program Files\Uniblue\RegistryBooster\rb_ubm.exe        Win32/RegistryBooster application (unable to clean)        00000000000000000000000000000000        I
C:\Program Files\Uniblue\RegistryBooster\registrybooster.exe        Win32/RegistryBooster application (unable to clean)        00000000000000000000000000000000        I
C:\Users\A** R**\AppData\Local\Temp\mia5E27.tmp\data\OFFLINE\7F895C1F\DE39FC21\Launcher.exe        Win32/RegistryBooster application (unable to clean)        00000000000000000000000000000000        I
C:\Users\A** R**\AppData\Local\Temp\mia5E27.tmp\data\OFFLINE\7F895C1F\DE39FC21\rbmonitor.exe        Win32/RegistryBooster application (unable to clean)        00000000000000000000000000000000        I
C:\Users\A** R**\AppData\Local\Temp\mia5E27.tmp\data\OFFLINE\7F895C1F\DE39FC21\rbnotifier.exe        Win32/RegistryBooster application (unable to clean)        00000000000000000000000000000000        I
C:\Users\A** R**\AppData\Local\Temp\mia5E27.tmp\data\OFFLINE\7F895C1F\DE39FC21\rb_move_serial.exe        Win32/RegistryBooster application (unable to clean)        00000000000000000000000000000000        I
C:\Users\A** R**\AppData\Local\Temp\mia5E27.tmp\data\OFFLINE\7F895C1F\DE39FC21\rb_ubm.exe        Win32/RegistryBooster application (unable to clean)        00000000000000000000000000000000        I
C:\Users\A** R**\AppData\Local\Temp\mia5E27.tmp\data\OFFLINE\7F895C1F\DE39FC21\registrybooster.exe        Win32/RegistryBooster application (unable to clean)        00000000000000000000000000000000        I
C:\Users\A** R**\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26\1c7d99da-5bca682c        a variant of Java/Exploit.CVE-2011-3544.Q trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\A** R**\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35\1e525ae3-5ce99075        Win32/TrojanDownloader.Zurgop.AI trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\A** R**\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48\3bd82270-7d144126        Java/Exploit.CVE-2011-3544.P trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\A** R**\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5\43458f85-1cceb575        a variant of Java/Agent.BR trojan (unable to clean)        00000000000000000000000000000000        I
${Memory}        Win32/RegistryBooster application        00000000000000000000000000000000        I
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internet# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=dfc29408f729fc438993d748e1bdcf1e
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-01-07 10:04:08
# local_time=2012-01-07 11:04:08 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1797 16775165 100 94 541444 98625525 18829 0
# compatibility_mode=5892 16776573 100 100 3837 163500138 0 0
# compatibility_mode=8192 67108863 100 0 256450 256450 0 0
# scanned=214925
# found=0
# cleaned=0
# scan_time=6438
PS: weisst du an welchn Administrator ich mich hier im Forum am besten wende, wenn es um Änderungen älterer Beiträge geht? Habe gesehen, dass ich öfter mal vergessen habe meinen Namen in den Scripts zu "versternen"...
Liebe Grüße,
Lilli

cosinus 08.01.2012 19:43
Melde die entsprechenden Beiträge einfach

Da wurde nur ein Fehlalarm gemeldet.
Rechner soweit wieder im Lot?

lillix 08.01.2012 20:19
Jaa, der Rechner scheint wieder im Lot zu sein; bei seiner Benutzung tauchen zumindest keine ungewöhnlichen Beeinträchtigungen mehr auf. Speicherplatz ist wieder der alte und es kommt mir vor, als ob er wesentlich ruhiger läuft als vor der "Operation" :)
Wenn du meinst, dass er bereinigt ist, glaub ich das SEHR GERNE! Also echt vielen Dank nochmal für deine Schritt-für-Schritt Unterstützung und gut verständlichen Anleitung.. bin eigentlich eher computerdoof, aber hat alles so ganz gut geklappt!!
Viele Grüße,
Lilli


Alle Zeitangaben in WEZ +1. Es ist jetzt 15:30 Uhr.
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131