Trojaner-Board
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Virus Windows Update Ukash..mich hats auch getroffen.Hier die Log Files... (https://www.trojaner-board.de/116652-virus-windows-update-ukash-mich-hats-getroffen-log-files.html)

cosinus 11.06.2012 14:11
Geht der normale Modus immer noch nicht? :wtf:
Auch nach TDSS-Killer und Combofix?

nighthunter 11.06.2012 14:17
er fährt zwar hoch,internet geht auch auch wenn ich nen ordner öffnen will passiert nix mehr...dann isser tot,kann ihn dann nichtmal runterfahren. :-(

cosinus 11.06.2012 15:30
Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).



Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

nighthunter 11.06.2012 19:19
nabend,also hier die drei logs:

Gmer:

Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-06-11 19:54:35
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 WDC_WD25 rev.01.0
Running: 73pli6cp.exe; Driver: C:\Users\GNTER~1\AppData\Local\Temp\awtcrpod.sys


---- Kernel code sections - GMER 1.0.15 ----

.xreloc        C:\Windows\System32\drivers\sfsync04.sys                                                                unknown last section [0x80737000, 0xC5E, 0x40000040]
?              C:\Users\GNTER~1\AppData\Local\Temp\awtcrpod.sys                                                        Das System kann die angegebene Datei nicht finden. !

---- User IAT/EAT - GMER 1.0.15 ----

IAT            C:\Windows\Explorer.EXE[1656] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown]                    [74747817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[1656] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage]                    [7478B4E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[1656] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI]                [7474BB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[1656] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode]          [7473F695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[1656] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup]                    [747475E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[1656] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC]                  [7473E7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[1656] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM]      [747773F5] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[1656] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream]        [7474DA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[1656] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight]                [7473FFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[1656] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth]                  [7473FF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[1656] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage]                  [747371CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[1656] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM]          [747CCAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[1656] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile]              [7476C8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[1656] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics]                [7473D968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[1656] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree]                          [74736853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[1656] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc]                          [7473687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[1656] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode]            [74742AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT            C:\Windows\Explorer.EXE[1656] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateThread]              [100027E0] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll (Acer eDataSecurity Management PSD DragDrop Protection/Egis Incorporated)
IAT            C:\Windows\Explorer.EXE[1656] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FreeLibraryAndExitThread]  [10001B60] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll (Acer eDataSecurity Management PSD DragDrop Protection/Egis Incorporated)
IAT            C:\Windows\Explorer.EXE[1656] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress]            [10002B60] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll (Acer eDataSecurity Management PSD DragDrop Protection/Egis Incorporated)
IAT            C:\Windows\Explorer.EXE[1656] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA]              [100011D0] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll (Acer eDataSecurity Management PSD DragDrop Protection/Egis Incorporated)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                                  Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SYSTEM\CurrentControlSet\Services\BthPort\Parameters\Keys\001e4cd6cac9                             
Reg            HKLM\SYSTEM\CurrentControlSet\Services\BthPort\Parameters\Keys\001e4cd6cac9@002345b2c4ee                0xAC 0x9B 0x5B 0x40 ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\BthPort\Parameters\Keys\001e4cd6cac9@0023f1b97b4a                0x0A 0x73 0xEF 0x5B ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\BthPort\Parameters\Keys\001e4cd6cac9@0024ef7363d9                0xF9 0x02 0xA3 0x2A ...
Reg            HKLM\SYSTEM\CurrentControlSet\Services\BthPort\Parameters\Keys\001e4cd6cac9@3039261b5b27                0x31 0x56 0x99 0xE8 ...
Reg            HKLM\SYSTEM\ControlSet003\Services\BthPort\Parameters\Keys\001e4cd6cac9 (not active ControlSet)         
Reg            HKLM\SYSTEM\ControlSet003\Services\BthPort\Parameters\Keys\001e4cd6cac9@002345b2c4ee                    0xAC 0x9B 0x5B 0x40 ...
Reg            HKLM\SYSTEM\ControlSet003\Services\BthPort\Parameters\Keys\001e4cd6cac9@0023f1b97b4a                    0x0A 0x73 0xEF 0x5B ...
Reg            HKLM\SYSTEM\ControlSet003\Services\BthPort\Parameters\Keys\001e4cd6cac9@0024ef7363d9                    0xF9 0x02 0xA3 0x2A ...
Reg            HKLM\SYSTEM\ControlSet003\Services\BthPort\Parameters\Keys\001e4cd6cac9@3039261b5b27                    0x31 0x56 0x99 0xE8 ...

---- EOF - GMER 1.0.15 ----
osam:

Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 20:02:01 on 11.06.2012

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit
Default Browser: Mozilla Corporation Firefox 12.0

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl
"habu.cpl" - "Razer Inc." - C:\Windows\system32\habu.cpl
"ISUSPM.cpl" - "Macrovision Corporation" - C:\Windows\system32\ISUSPM.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"QuickTime" - ? - C:\Users\Günter\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"AFS" (AFS) - "Oak Technology Inc." - C:\Windows\system32\drivers\AFS.sys
"AlfaFF File System mini-filter" (AlfaFF) - "Alfa Corporation" - C:\Windows\System32\Drivers\AlfaFF.sys
"atksgt" (atksgt) - ? - C:\Windows\System32\DRIVERS\atksgt.sys  (File found, but it contains no detailed information)
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"avkmgr" (avkmgr) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avkmgr.sys
"awtcrpod" (awtcrpod) - ? - C:\Users\GNTER~1\AppData\Local\Temp\awtcrpod.sys  (Hidden registry entry, rootkit activity | File not found)
"catchme" (catchme) - ? - C:\ComboFix\catchme.sys  (File not found)
"Dritek General Port I/O" (DritekPortIO) - "Dritek System Inc." - C:\PROGRA~1\LAUNCH~1\DPortIO.sys
"int15" (int15) - ? - C:\Windows\system32\drivers\int15.sys  (File found, but it contains no detailed information)
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"lirsgt" (lirsgt) - ? - C:\Windows\System32\DRIVERS\lirsgt.sys  (File found, but it contains no detailed information)
"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbam.sys
"NTIPPKernel" (NTIPPKernel) - "Cyberlink Corp." - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys
"PSDFilter" (PSDFilter) - "Egis Incorporated" - C:\Windows\System32\DRIVERS\psdfilter.sys
"PSDNServ" (PSDNServ) - "Egis Incorporated" - C:\Windows\System32\DRIVERS\PSDNServ.sys
"PSDVdisk" (psdvdisk) - "Egis Incorporated" - C:\Windows\System32\DRIVERS\PSDVdisk.sys
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\Windows\System32\Drivers\PxHelp20.sys
"Sony Ericsson Device 1018 driver (WDM)" (s1018bus) - "MCCI Corporation" - C:\Windows\System32\DRIVERS\s1018bus.sys
"Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS)" (s1018nd5) - "MCCI Corporation" - C:\Windows\System32\DRIVERS\s1018nd5.sys
"Sony Ericsson Device 1018 USB Ethernet Emulation (WDM)" (s1018unic) - "MCCI Corporation" - C:\Windows\System32\DRIVERS\s1018unic.sys
"Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM)" (s1018mgmt) - "MCCI Corporation" - C:\Windows\System32\DRIVERS\s1018mgmt.sys
"Sony Ericsson Device 1018 USB WMC Modem Driver" (s1018mdm) - "MCCI Corporation" - C:\Windows\System32\DRIVERS\s1018mdm.sys
"Sony Ericsson Device 1018 USB WMC Modem Filter" (s1018mdfl) - "MCCI Corporation" - C:\Windows\System32\DRIVERS\s1018mdfl.sys
"Sony Ericsson Device 1018 USB WMC OBEX Interface" (s1018obex) - "MCCI Corporation" - C:\Windows\System32\DRIVERS\s1018obex.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys
"StarForce Protection Environment Driver (version 1.x)" (sfdrv01) - "Protection Technology (StarForce)" - C:\Windows\System32\drivers\sfdrv01.sys
"StarForce Protection Helper Driver (version 2.x)" (sfhlp02) - "Protection Technology (StarForce)" - C:\Windows\System32\drivers\sfhlp02.sys
"StarForce Protection Synchronization Driver (version 4.x)" (sfsync04) - "Protection Technology (StarForce)" - C:\Windows\System32\drivers\sfsync04.sys
"truecrypt" (truecrypt) - "TrueCrypt Foundation" - C:\Windows\System32\drivers\truecrypt.sys
"UBHelper" (UBHelper) - "NewTech Infosystems Corporation" - C:\Windows\system32\drivers\UBHelper.sys
"Upper Class Filter Driver" (NTIDrvr) - "NewTech Infosystems, Inc." - C:\Windows\System32\DRIVERS\NTIDrvr.sys
"{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}" ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796}) - "Cyberlink Corp." - C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
-----( HKLM\Software\Classes\Protocols\Handler )-----
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -  (File not found | COM-object registry key not found)
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -  (File not found | COM-object registry key not found)
{A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - ? - C:\Windows\system32\nvcpl.dll  (File not found)
{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} "DragDropProtect Class" - "Egis Incorporated" - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll
{2b45bd21-71f8-4c8c-a87a-7eeb25a1a3e0} "EPM-PO Shell Extensions" - ? - epm-po.dll  (File not found)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -  (File not found | COM-object registry key not found)
{8F9D8FBE-C5C1-4B65-986E-51235C9283E8} "FPLaunchCache" - "Arachnoid Biometrics Identification Group Corp." - C:\Program Files\Acer\Acer Bio Protection\FPLaunchCache.dll
{00020d75-0000-0000-c000-000000000046} "lnkfile" - ? -  (File not found | COM-object registry key not found)
{7842554E-6BED-11D2-8CDB-B05550C10000} "Monitor Class" - "Broadcom Corporation." - C:\Windows\system32\btncopy.dll
{3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} "NVIDIA CPL Context Menu Extension" - ? - C:\Windows\system32\nvshext.dll  (File not found)
{FFB699E0-306A-11d3-8BD1-00104B6F7516} "NVIDIA CPL Extension" - ? - C:\Windows\system32\nvcpl.dll  (File not found)
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -  (File not found | COM-object registry key not found)
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBarLayout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} "Java Plug-in 1.6.0_06" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} "Java Plug-in 1.6.0_07" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_31" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} "Java Plug-in 1.6.0_31" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_31" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_31.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
"@btrez.dll,-4015" - ? - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
"Quick-Launching Area" - ? - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "Acer eDataSecurity Management" - "Egis Incorporated." - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\ssv.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID Sign-in Helper" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[LSA Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Lsa )-----
"Notification packages" - ? - C:\Program Files\Acer\Acer Bio Protection\PwdFilter  (File not found)

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Günter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"BTTray.lnk" - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe  (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"AeroSnap" - ? - D:\4.Programme\eigen installierte Programme\aerosnap desktop tool\AeroSnap\AeroSnap.exe
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"CLMLServer" - "CyberLink" - "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe"
"eAudio" - "Acer Incorporated" - "C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe"
"eDataSecurity Loader" - "Egis Incorporated" - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
"ePower_DMC" - "Acer Inc." - C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe
"Habu" - ? - C:\Program Files\Razer\Habu\razerhid.exe
"IAAnotif" - "Intel Corporation" - C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
"LManager" - "Dritek System Inc." - C:\PROGRA~1\LAUNCH~1\LManager.exe
"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
"PlayMovie" - "Acer Corp." - "C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe"
"PLFSetI" - ? - C:\Windows\PLFSetI.exe
"QuickTime Task" - ? - "C:\Users\Günter\QTTask.exe" -atboottime
"WarReg_PopUp" - "Acer Incorporated" - C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe
"ZPdtWzdVitaKey MC3000" - "Arachnoid Biometrics Identification Group Corp." - "C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe" show

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"CLHNService" (CLHNService) - ? - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
"eDataSecurity Service" (eDataSecurity Service) - "Egis Incorporated" - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
"Empowering Technology Service" (ETService) - ? - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
"Google Update-Dienst (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Intel(R) Matrix Storage Event Monitor" (IAANTMON) - "Intel Corporation" - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
"LightScribeService Direct Disc Labeling Service" (LightScribeService) - "Hewlett-Packard Company" - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
"MobilityService" (MobilityService) - ? - C:\Acer\Mobility Center\MobilityService.exe -p  (File not found)
"Mozilla Maintenance Service" (MozillaMaintenance) - "Mozilla Foundation" - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
"NTI Backup Now 5 Agent Service" (BUNAgentSvc) - "NewTech Infosystems, Inc." - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
"NTI Backup Now 5 Backup Service" (NTIBackupSvc) - "NewTech InfoSystems, Inc." - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
"NTI Backup Now 5 Scheduler Service" (NTISchedulerSvc) - ? - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe  (File found, but it contains no detailed information)
"NVIDIA Display Driver Service" (nvsvc) - ? - C:\Windows\system32\nvvsvc.exe  (File not found)
"Seagate Service" (FreeAgentGoNext Service) - "Seagate Technology LLC" - D:\4.Programme\eigen installierte Programme\Sync\FreeAgentService.exe
"Validity Fingerprint Service" (vfsFPService) - "Validity Sensors, Inc." - C:\Windows\system32\vfsFPService.exe
"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

[Winlogon]
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"AWinNotifyVitaKey MC3000" - "Arachnoid Biometrics Identification Group Corp." - C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
und der aswMBR:

Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-06-11 20:04:19
-----------------------------
20:04:19.650    OS Version: Windows 6.0.6002 Service Pack 2
20:04:19.650    Number of processors: 2 586 0xF0D
20:04:19.650    ComputerName: GÜNTER-NOTEBOOK  UserName: Günter
20:04:20.693    Initialize success
20:05:51.865    AVAST engine defs: 12061100
20:06:03.640    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
20:06:03.642    Disk 0 Vendor: WDC_WD25 01.0 Size: 238475MB BusType: 3
20:06:03.993    Disk 0 MBR read successfully
20:06:04.072    Disk 0 MBR scan
20:06:04.095    Disk 0 unknown MBR code
20:06:04.205    Disk 0 Partition 1 00    27 Hidden NTFS WinRE NTFS        10240 MB offset 2048
20:06:04.277    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS      114116 MB offset 20973568
20:06:04.356    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS      110489 MB offset 254683136
20:06:04.437    Disk 0 Partition 4 00    12  Compaq diag NTFS        3628 MB offset 480964608
20:06:04.730    Disk 0 scanning sectors +488394752
20:06:05.123    Disk 0 scanning C:\Windows\system32\drivers
20:07:21.832    Service scanning
20:07:43.081    Modules scanning
20:08:28.322    Disk 0 trace - called modules:
20:08:28.347    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys
20:08:28.363    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x87446ac8]
20:08:28.370    3 CLASSPNP.SYS[8b5be8b3] -> nt!IofCallDriver -> [0x8653a1a0]
20:08:28.376    5 acpi.sys[8069f6bc] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x8655a028]
20:08:28.880    AVAST engine scan C:\Windows
20:08:50.688    AVAST engine scan C:\Windows\system32
20:11:56.972    AVAST engine scan C:\Windows\system32\drivers
20:12:17.188    AVAST engine scan C:\Users\Günter
20:13:54.964    Disk 0 MBR has been saved successfully to "D:\Desktop\MBR.dat"
20:13:55.020    The log file has been saved successfully to "D:\Desktop\aswMBR.txt"
hoffe das ist alles richtig so.
kannst du für einen laien für mich vielleicht kurz erklären wo und was das problem ist?ich will nur für mich versuchen zu verstehen was du machst ;)
ich hab mal was von fernwartung gehört.was ist das und geht das in meinem fall vllt auch?

cosinus 11.06.2012 21:04
Wir sollten den MBR fixen, sichere für den Fall der Fälle ALLE wichtigen Daten, auch wenn meistens alles glatt geht.

Hinweis: Mach bitte NICHT den MBR-Fix, wenn du noch andere Betriebssysteme wie zB Ubuntu installiert hast, ein MBR-Fix mit Windows-Tools macht ein parallel installiertes (Dualboot) Linux unbootbar.
Mach den Fix auch dann nicht, wenn du zB mit TrueCrypt oder anderen Verschlüsselungsprogrammen eine Vollverschlüsselung der Windowspartition bzw. gesamten Festplatte hast

Starte nach der Datensicherung aswmbr erneut und klick auf den Button FIXMBR.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!

Anschließend Windows neu starten und ein neues Log mit aswMBR machen.

nighthunter 12.06.2012 13:05
ich bin mir nicht sicher dass das geklappt hat,ging so schnell und wurde kein neustart verlangt.hier der log

Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-06-12 14:02:09
-----------------------------
14:02:09.052    OS Version: Windows 6.0.6002 Service Pack 2
14:02:09.052    Number of processors: 2 586 0xF0D
14:02:09.053    ComputerName: GÜNTER-NOTEBOOK  UserName: Günter
14:02:37.134    Initialize success
14:02:47.947    AVAST engine defs: 12061100
14:02:53.334    Verifying
14:03:03.334    Disk 0 Windows 600 MBR fixed successfully
14:03:58.991    Disk 0 MBR has been saved successfully to "D:\Desktop\MBR.dat"
14:03:58.991    The log file has been saved successfully to "D:\Desktop\aswMBR.txt"

cosinus 12.06.2012 13:54
Das ist nur das FIxlog. Du musst aswMBR neu starten und scannen lassen

nighthunter 12.06.2012 17:44
ah okay,und nach dem scan dann auch nochmal auf save log?und dann fix?

so hab nun den scan nochmal gemacht:

Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-06-12 18:48:19
-----------------------------
18:48:19.073    OS Version: Windows 6.0.6002 Service Pack 2
18:48:19.073    Number of processors: 2 586 0xF0D
18:48:19.074    ComputerName: GÜNTER-NOTEBOOK  UserName: Günter
18:48:50.622    Initialize success
18:49:01.417    AVAST engine defs: 12061100
18:50:24.701    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
18:50:24.701    Disk 0 Vendor: WDC_WD25 01.0 Size: 238475MB BusType: 3
18:50:24.716    Disk 0 MBR read successfully
18:50:24.732    Disk 0 MBR scan
18:50:24.732    Disk 0 Windows VISTA default MBR code
18:50:24.747    Disk 0 Partition 1 00    27 Hidden NTFS WinRE NTFS        10240 MB offset 2048
18:50:24.763    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS      114116 MB offset 20973568
18:50:24.779    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS      110489 MB offset 254683136
18:50:24.825    Disk 0 Partition 4 00    12  Compaq diag NTFS        3628 MB offset 480964608
18:50:24.825    Disk 0 scanning sectors +488394752
18:50:24.919    Disk 0 scanning C:\Windows\system32\drivers
18:50:34.700    Service scanning
18:50:57.445    Modules scanning
18:51:00.456    Disk 0 trace - called modules:
18:51:00.487    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys
18:51:00.487    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x87446ac8]
18:51:00.503    3 CLASSPNP.SYS[8b5bd8b3] -> nt!IofCallDriver -> [0x8653a150]
18:51:00.503    5 acpi.sys[806926bc] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x8655a028]
18:51:01.485    AVAST engine scan C:\Windows
18:51:05.307    AVAST engine scan C:\Windows\system32
18:53:46.143    AVAST engine scan C:\Windows\system32\drivers
18:53:57.968    AVAST engine scan C:\Users\Günter
19:00:29.294    AVAST engine scan C:\ProgramData
19:01:35.298    Scan finished successfully
19:11:47.005    Disk 0 MBR has been saved successfully to "D:\Desktop\MBR.dat"
19:11:47.005    The log file has been saved successfully to "D:\Desktop\aswMBR.txt"
und dann nochmal nach dem scan mit anschließendem fixen
Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-06-12 18:48:19
-----------------------------
18:48:19.073    OS Version: Windows 6.0.6002 Service Pack 2
18:48:19.073    Number of processors: 2 586 0xF0D
18:48:19.074    ComputerName: GÜNTER-NOTEBOOK  UserName: Günter
18:48:50.622    Initialize success
18:49:01.417    AVAST engine defs: 12061100
18:50:24.701    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
18:50:24.701    Disk 0 Vendor: WDC_WD25 01.0 Size: 238475MB BusType: 3
18:50:24.716    Disk 0 MBR read successfully
18:50:24.732    Disk 0 MBR scan
18:50:24.732    Disk 0 Windows VISTA default MBR code
18:50:24.747    Disk 0 Partition 1 00    27 Hidden NTFS WinRE NTFS        10240 MB offset 2048
18:50:24.763    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS      114116 MB offset 20973568
18:50:24.779    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS      110489 MB offset 254683136
18:50:24.825    Disk 0 Partition 4 00    12  Compaq diag NTFS        3628 MB offset 480964608
18:50:24.825    Disk 0 scanning sectors +488394752
18:50:24.919    Disk 0 scanning C:\Windows\system32\drivers
18:50:34.700    Service scanning
18:50:57.445    Modules scanning
18:51:00.456    Disk 0 trace - called modules:
18:51:00.487    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys
18:51:00.487    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x87446ac8]
18:51:00.503    3 CLASSPNP.SYS[8b5bd8b3] -> nt!IofCallDriver -> [0x8653a150]
18:51:00.503    5 acpi.sys[806926bc] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x8655a028]
18:51:01.485    AVAST engine scan C:\Windows
18:51:05.307    AVAST engine scan C:\Windows\system32
18:53:46.143    AVAST engine scan C:\Windows\system32\drivers
18:53:57.968    AVAST engine scan C:\Users\Günter
19:00:29.294    AVAST engine scan C:\ProgramData
19:01:35.298    Scan finished successfully
19:11:47.005    Disk 0 MBR has been saved successfully to "D:\Desktop\MBR.dat"
19:11:47.005    The log file has been saved successfully to "D:\Desktop\aswMBR.txt"
19:11:53.573    Verifying
19:12:03.635    Disk 0 Windows 600 MBR fixed successfully
20:04:08.143    Disk 0 MBR has been saved successfully to "D:\Desktop\MBR.dat"
20:04:08.174    The log file has been saved successfully to "D:\Desktop\aswMBRfix.txt"

cosinus 12.06.2012 21:54
Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

nighthunter 13.06.2012 13:32
Das klingt doch schon ganz gut,was soll mit eventuellen funden gemacht werden?löschen oder nicht?

cosinus 13.06.2012 16:15
Malwarebytes entfernen also in die Quarantäne schicken
Bei SASW nur erstmal das Log posten, nichts löschen (also in die Q schicken)

nighthunter 13.06.2012 21:54
Code:
Malwarebytes Anti-Malware (Test) 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.06.13.03

Windows Vista Service Pack 2 x86 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 7.0.6002.18005
Günter :: GÜNTER-NOTEBOOK [Administrator]

Schutz: Deaktiviert

13.06.2012 14:16:22
mbam-log-2012-06-13 (14-16-22).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 388648
Laufzeit: 55 Minute(n), 44 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 06/13/2012 at 06:39 PM

Application Version : 5.0.1150

Core Rules Database Version : 8726
Trace Rules Database Version: 6538

Scan type      : Complete Scan
Total Scan Time : 01:49:59

Operating System Information
Windows Vista Home Premium 32-bit, Service Pack 2 (Build 6.00.6002)
UAC Off - Administrator

Memory items scanned      : 376
Memory threats detected  : 0
Registry items scanned    : 34354
Registry threats detected : 1
File items scanned        : 211544
File threats detected    : 31

Adware.IEPlugin
        HKCR\Remove

Adware.Tracking Cookie
        C:\Users\Günter\AppData\Roaming\Microsoft\Windows\Cookies\SLIRXF8D.txt [ /eaeacom.112.2o7.net ]
        C:\Users\Günter\AppData\Roaming\Microsoft\Windows\Cookies\K69EBE0M.txt [ /ad.dyntracker.de ]
        C:\Users\Günter\AppData\Roaming\Microsoft\Windows\Cookies\6D0T1U03.txt [ /dyntracker.com ]
        C:\Users\Günter\AppData\Roaming\Microsoft\Windows\Cookies\DHFTBDFJ.txt [ /zanox.com ]
        C:\Users\Günter\AppData\Roaming\Microsoft\Windows\Cookies\U8OE91PF.txt [ /fastclick.net ]
        C:\Users\Günter\AppData\Roaming\Microsoft\Windows\Cookies\NUDHJL54.txt [ /apmebf.com ]
        C:\Users\Günter\AppData\Roaming\Microsoft\Windows\Cookies\7W41AYED.txt [ /www.zanox-affiliate.de ]
        C:\Users\Günter\AppData\Roaming\Microsoft\Windows\Cookies\6ZEOQT66.txt [ /track.adform.net ]
        C:\Users\Günter\AppData\Roaming\Microsoft\Windows\Cookies\LZJ5TQAC.txt [ /mediaplex.com ]
        C:\Users\Günter\AppData\Roaming\Microsoft\Windows\Cookies\9J9WHSHA.txt [ /adform.net ]
        C:\Users\Günter\AppData\Roaming\Microsoft\Windows\Cookies\UXDOM6O8.txt [ /tracking.quisma.com ]
        C:\Users\Günter\AppData\Roaming\Microsoft\Windows\Cookies\YFJY9ZST.txt [ /doubleclick.net ]
        C:\Users\Günter\AppData\Roaming\Microsoft\Windows\Cookies\J193TUA2.txt [ /adfarm1.adition.com ]
        C:\Users\Günter\AppData\Roaming\Microsoft\Windows\Cookies\EU2CYGDN.txt [ /ad.zanox.com ]
        C:\Users\Günter\AppData\Roaming\Microsoft\Windows\Cookies\VZ44SXYF.txt [ /smartadserver.com ]
        C:\Users\Günter\AppData\Roaming\Microsoft\Windows\Cookies\Z5Q5LA41.txt [ /atdmt.com ]
        C:\Users\Günter\AppData\Roaming\Microsoft\Windows\Cookies\O8AIRE9O.txt [ /zanox-affiliate.de ]
        C:\USERS\GüNTER\Cookies\DHFTBDFJ.txt [ Cookie:günter@zanox.com/ ]
        C:\USERS\GüNTER\Cookies\U8OE91PF.txt [ Cookie:günter@fastclick.net/ ]
        C:\USERS\GüNTER\Cookies\NUDHJL54.txt [ Cookie:günter@apmebf.com/ ]
        C:\USERS\GüNTER\Cookies\6ZEOQT66.txt [ Cookie:günter@track.adform.net/ ]
        C:\USERS\GüNTER\Cookies\LZJ5TQAC.txt [ Cookie:günter@mediaplex.com/ ]
        C:\USERS\GüNTER\Cookies\9J9WHSHA.txt [ Cookie:günter@adform.net/ ]
        C:\USERS\GüNTER\Cookies\UXDOM6O8.txt [ Cookie:günter@tracking.quisma.com/ ]
        C:\USERS\GüNTER\Cookies\EU2CYGDN.txt [ Cookie:günter@ad.zanox.com/ ]
        C:\USERS\GüNTER\Cookies\Z5Q5LA41.txt [ Cookie:günter@atdmt.com/ ]
        C:\USERS\GüNTER\Cookies\O8AIRE9O.txt [ Cookie:günter@zanox-affiliate.de/ ]
        media1.shufuni.com [ C:\USERS\GüNTER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\NM2KFRD7 ]
        staticedge.hardsextube.com [ C:\USERS\GüNTER\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\NM2KFRD7 ]
        accounts.google.com [ C:\USERS\GüNTER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\HYPG6NZK.DEFAULT\COOKIES.SQLITE ]

Trojan.Agent/Gen-FakeAV
        C:\PROGRAM FILES\WINRAR\DEFAULT.SFX

cosinus 14.06.2012 10:33
Sieht ok aus, da wurden nur Cookies gefunden und ein Fehlalarm gemeldet.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )


Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

nighthunter 14.06.2012 11:30
ok danke erstmal soweit.probleme gibts genug,im normalen modus geht nach wie vor kaum was.wenn ich ihn hochfahre dauert es erstmal ewig bis er fertig ist,wenn ich dann zb firefox öffne gehts zwei minten lang gut,dann bleibt er hängen.die sanduhr dreht sich und nix geht mehr...thunderbird geht auch nicht...
und der ganze rechner ist mega langsam geworden :(
Wäre es eventuell sinnvoll den ganzen rechner mal komplett platt zu machen?wenn ja die daten wie musik und dokumente usw hab ich ja gesichert.ist nur die frage wie ich an meine emails ran komme.die wäre auch wohl wichtig.
und ich hab keine windows cd ums dann eventuell neu drauf zu machen...

cosinus 14.06.2012 13:27
Hm naja, Logs sind ok aber wenn der normale Modus einfach nicht will und zu kaputt ist :balla:
Ja, dann dürfte eine Neuinstallation wohl am sinnvollsten sein. Alles kann man leider nicht reparieren, manchmal muss ein Neubau her ;)


Alle Zeitangaben in WEZ +1. Es ist jetzt 01:01 Uhr.
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131