Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Windows 7 Die Eingabeaufforderung ist vom Administrator deaktiviert hilfe (https://www.trojaner-board.de/122019-windows-7-eingabeaufforderung-administrator-deaktiviert-hilfe.html)

Windows7Home 13.08.2012 18:26
Windows 7 Die Eingabeaufforderung ist vom Administrator deaktiviert hilfe
 
http://s1.directupload.net/file/d/2981/siv4zdcw_png.htm

Das ist mein Problem Ich bin Admin Obwohl ich keine Adminrechte hab hier ist mein Hijacktis Log datei : Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:03:51, on 13.08.2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16447)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Uniblue\DriverScanner\dsmonitor.exe
C:\Program Files (x86)\RocketDock\RocketDock.exe
C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\User\Downloads\HiJackThis204.exe
C:\Windows\SysWOW64\DllHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://isearch.avg.com/?cid={171A7F26-E427-4C0D-A654-994F7260582F}&mid=85c75b9063d74d799230a6266f96fe62-b601b520f4e2cb24176d12e3154c432512af6417&lang=de&ds=hk011&pr=sa&d=2012-07-18 18:25:10&v=12.1.0.20&sap=hp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AMD SteadyVideo BHO - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - c:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll" (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll" (file missing)
O3 - Toolbar: loadtbs - {DFEFCDEE-CF1A-4FC8-88AD-129872198372} - C:\Users\User\AppData\Roaming\loadtbs\toolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [NBAgent] "c:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe" /WinStart
O4 - HKLM\..\Run: [ToshibaServiceStation] C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe /hide:60
O4 - HKLM\..\Run: [Cerberus] C:\Windows\system32\Cerberus\server.exe
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [HKLM] C:\Windows\system32\install\explorer.exe
O4 - HKLM\..\Run: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "c:\Program Files (x86)\AMD AVT\bin\kdbsync.exe" aml
O4 - HKCU\..\Run: [TOPI.EXE] C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe /STAR
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files (x86)\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [updater] C:\Users\User\AppData\Local\Temp\updater.exe
O4 - HKLM\..\Policies\Explorer\Run: [Cerberus] C:\Windows\system32\Cerberus\server.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [TOPI.EXE] C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe /STARTUP (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [TOPI.EXE] C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe /STARTUP (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [TOPI.EXE] C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe /STARTUP (User 'Default user')
O4 - .DEFAULT User Startup: TRDCReminder.lnk = C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (User 'Default user')
O4 - Global Startup: Bluetooth Monitor.lnk = ?
O4 - Global Startup: Toshiba Places Icon Utility.lnk = C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: Zu TOSHIBA Bulletin Board hinzufügen - res://C:\Program Files\TOSHIBA\BulletinBoard\TosBBCom.dll/1000
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: @C:\Program Files\TOSHIBA\BulletinBoard\TosNcUi.dll,-229 - {97F922BD-8563-4184-87EE-8C4ACA438823} - C:\Program Files\TOSHIBA\BulletinBoard\TosBBCom.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\TOSHIBA\BulletinBoard\TosNcUi.dll,-228 - {97F922BD-8563-4184-87EE-8C4ACA438823} - C:\Program Files\TOSHIBA\BulletinBoard\TosBBCom.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - c:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll
O18 - Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - c:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - c:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: ConfigFree WiMAX Service (cfWiMAXService) - TOSHIBA CORPORATION - C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
O23 - Service: ConfigFree Service - TOSHIBA CORPORATION - C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: GamesAppService - WildTangent, Inc. - C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe
O23 - Service: GFNEX Service (GFNEXSrv) - Unknown owner - C:\Windows\System32\GFNEXSrv.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @c:\Program Files (x86)\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - c:\Program Files (x86)\Nero\Update\NASvc.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Notebook Performance Tuning Service (TEMPRO) (TemproMonitoringService) - Toshiba Europe GmbH - C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe
O23 - Service: TMachInfo - TOSHIBA Corporation - C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - Unknown owner - C:\Windows\system32\TODDSrv.exe (file missing)
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA HDD SSD Alert Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

--
End of file - 12874 bytes



Hilfe ansonsten werd ich noch verrückt weil das net geht und regedit geht auch net:headbang::headbang:

markusg 14.08.2012 17:11
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Quick Scan Button.
  • Kopiere
    nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

Windows7Home 15.08.2012 14:21
Ich habe mit OTL gescannt und ich glaube das problem ist die vbc.exe datei die bremmst mein Pc und macht meine adminrechte weg aber wenn ich es mit antivirus löschen will sagt mein antivirus unable to clean wenn ich es selber löschen will sagt es ich brauche genehmigung vom TrustedInstaller ich glaub der virus ist unlöschbar und nun zum OTL.txt und Extras.txt ich kann es net reinposten weil es zu lang ist ich habs hochgeladen OTL.txt: https://rapidshare.com/files/2663317485/OTL.Txt

Extras.txt:https://rapidshare.com/files/3810189651/Extras.Txt

Bitte hilft mir :confused: :confused:

markusg 15.08.2012 17:26
bitte packe die dateien und hänge sie hier an.

Windows7Home 15.08.2012 18:50
Sry bin neu hier darum kenne ich mich hir net so gut aus naja ich habe es angehängt naja hilf mir dann hier mit

markusg 15.08.2012 19:49
hi
das hat wenig mit auskennen zu tun, einfach die angepinnten themen lesen.
aber egal jetzt :-)
falls du deinen nutzernamen im log verendert hast, passe ihn im script an

dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.


• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.



Code:
:OTL
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O4 - HKCU..\Run: [updater] C:\Users\User\AppData\Local\Temp\updater.exe (Jesus)

 :Files
C:\Users\User\AppData\Local\Temp\updater.exe
:Commands
[Reboot]


• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!



Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + E Taste.
  • Öffne dein Systemlaufwerk ( meistens C: )
  • Suche nun
    folgenden Ordner: _OTL und öffne diesen.
  • Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner

  • Dies wird eine Movedfiles.zip Datei in _OTL erstellen
  • Lade diese bitte in unseren Uploadchannel
    hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )
Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus :)

für eine weitere analyse benötige ich mal folgendes.
c:\Users\name\AppData\LocalLow\Sun\Java\Deployment\cache
dort rechtsklick auf den ordner cache, diesen mit winrar oder einem anderen programm packen, und im upload channel hochladen bitte
Trojaner-Board Upload Channel
wenn dies erledigt ist, bittemelden.

Windows7Home 16.08.2012 17:00
Der Uploadvorgang war kein problem Hat funktioniert :) hab alles gemacht wie du es gesagt hast der taskmanager und regedit geht jetzt aber net CMD Es hat alles geklappt warte auf ne neue antwort für mein Problem:D Und das mit Java hab ich auch hochgeladen mit upload channel

markusg 16.08.2012 17:09
Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.
Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Windows7Home 16.08.2012 18:21
Cool es hat Gefunkt mein CMD geht wieder :D Danke!!!! Aber wenn ich Youtube Gehe ist es voll langsam falls du noch nen tutorial für meinen blöden virus sagen könntest währe ich froh Falls du noch mein LOG datei brauchst hier :Combofix Logfile:
Code:
ComboFix 12-08-16.01 - User 16.08.2012  18:56:01.1.2 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.3693.1892 [GMT 2:00]
ausgeführt von:: c:\users\User\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\User\AppData\Roaming\taskmgr.exe
c:\users\User\AppData\Roaming\User3SQLite3.dll
c:\users\User\AppData\Roaming\Userlog.dat
c:\users\User\AppData\Roaming\WinDefender
c:\windows\system32\install\explorer.exe
c:\windows\SysWow64\Cerberus
c:\windows\SysWow64\Cerberus\server.exe
c:\windows\SysWow64\install
c:\windows\SysWow64\install\explorer.exe
c:\windows\SysWow64\MSDCSC
c:\windows\SysWow64\taskmgr
c:\windows\SysWow64\WinDir
c:\windows\XSxS
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-07-16 bis 2012-08-16  ))))))))))))))))))))))))))))))
.
.
2012-08-16 17:09 . 2012-08-16 17:09        --------        d-----w-        c:\users\Zafer\AppData\Local\temp
2012-08-16 17:09 . 2012-08-16 17:09        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-08-16 15:41 . 2012-08-16 15:44        --------        d-----w-        C:\_OTL
2012-08-15 18:04 . 2012-07-06 20:07        552960        ----a-w-        c:\windows\system32\drivers\bthport.sys
2012-08-15 10:10 . 2012-05-05 08:36        503808        ----a-w-        c:\windows\system32\srcore.dll
2012-08-15 10:10 . 2012-05-05 07:46        43008        ----a-w-        c:\windows\SysWow64\srclient.dll
2012-08-15 10:10 . 2012-02-11 06:43        751104        ----a-w-        c:\windows\system32\win32spl.dll
2012-08-15 10:10 . 2012-02-11 06:36        559104        ----a-w-        c:\windows\system32\spoolsv.exe
2012-08-15 10:10 . 2012-02-11 06:36        67072        ----a-w-        c:\windows\splwow64.exe
2012-08-15 10:10 . 2012-02-11 05:43        492032        ----a-w-        c:\windows\SysWow64\win32spl.dll
2012-08-15 10:09 . 2012-07-04 22:16        73216        ----a-w-        c:\windows\system32\netapi32.dll
2012-08-15 10:09 . 2012-07-04 22:13        59392        ----a-w-        c:\windows\system32\browcli.dll
2012-08-15 10:09 . 2012-07-04 22:13        136704        ----a-w-        c:\windows\system32\browser.dll
2012-08-15 10:09 . 2012-07-04 21:14        41984        ----a-w-        c:\windows\SysWow64\browcli.dll
2012-08-15 10:08 . 2012-07-18 18:15        3148800        ----a-w-        c:\windows\system32\win32k.sys
2012-08-15 10:08 . 2012-05-14 05:26        956928        ----a-w-        c:\windows\system32\localspl.dll
2012-08-14 14:21 . 2012-08-14 14:21        --------        d-----w-        c:\program files (x86)\12-6_vista_win7_64_dd_ccc_whql
2012-08-13 20:07 . 2012-08-13 20:07        82048        ----a-w-        c:\windows\system32\drivers\amd_sata.sys
2012-08-13 20:07 . 2012-08-13 20:07        35456        ----a-w-        c:\windows\system32\drivers\amd_xata.sys
2012-08-13 20:03 . 2012-08-13 20:03        74344        ----a-w-        c:\windows\system32\RtNicProp64.dll
2012-08-13 20:03 . 2012-08-13 20:03        726160        ----a-w-        c:\windows\system32\drivers\Rt64win7.sys
2012-08-13 12:03 . 2012-08-13 12:11        --------        d-----w-        c:\program files (x86)\Fraps
2012-08-11 10:53 . 2012-08-14 14:56        --------        d-----w-        c:\users\User\AppData\Roaming\GarenaPlus
2012-08-11 10:53 . 2012-08-11 10:53        --------        d-----w-        c:\program files (x86)\Garena Plus
2012-08-11 10:53 . 2012-08-14 14:56        --------        d-----w-        c:\programdata\GarenaMessenger
2012-08-10 20:26 . 2012-08-10 20:26        --------        d-----w-        c:\users\User\AppData\Local\SFK_Team_Inc
2012-08-10 17:30 . 2012-08-10 17:30        --------        d-----w-        c:\program files (x86)\zlack_Box
2012-08-10 00:32 . 2012-08-10 00:36        --------        d-----w-        c:\program files (x86)\SprayR
2012-08-09 22:02 . 2007-12-26 15:30        1970176        ----a-w-        c:\windows\SysWow64\d3dx9.dll
2012-08-09 22:02 . 2007-12-26 15:30        679936        ----a-w-        c:\windows\SysWow64\D3DX81ab.dll
2012-08-09 12:40 . 2012-08-09 12:40        --------        d-----w-        c:\users\Zafer\AppData\Roaming\vlc
2012-08-08 23:08 . 2012-08-08 23:08        9888360        ----a-w-        c:\windows\SysWow64\RtsUStoricon.dll
2012-08-08 23:08 . 2012-08-08 23:08        422504        ----a-w-        c:\windows\system32\RtsUStor.dll
2012-08-08 23:08 . 2012-08-08 23:08        250984        ----a-w-        c:\windows\system32\drivers\RtsUStor.sys
2012-08-08 17:07 . 2011-11-28 12:51        33872        ----a-w-        c:\windows\system32\drivers\anvsnddrv.sys
2012-08-08 00:30 . 2012-08-08 00:30        --------        d-----w-        c:\users\User\AppData\Roaming\InstallShield
2012-08-07 23:25 . 2012-08-08 17:10        --------        d-----w-        c:\users\User\AppData\Roaming\AnvSoft
2012-08-07 21:49 . 2012-08-13 16:42        --------        d-----w-        c:\users\User\AppData\Roaming\DVDVideoSoft
2012-08-07 18:54 . 2012-08-07 18:59        --------        d-----w-        c:\program files\CCleaner
2012-08-07 17:38 . 2012-08-07 18:11        --------        d-----w-        c:\programdata\Fugazo
2012-08-07 17:37 . 2012-08-07 17:37        --------        d-----w-        C:\Games
2012-08-07 17:34 . 2012-08-07 18:11        --------        d-----w-        c:\programdata\PogoDGC
2012-08-06 21:35 . 2012-08-06 21:36        --------        d-----w-        c:\users\User\AppData\Roaming\Dxbx
2012-08-06 21:33 . 2012-08-06 21:33        --------        d-----w-        c:\program files\Microsoft Xbox 360 Accessories
2012-08-06 13:20 . 2012-08-06 13:20        --------        d-----w-        c:\users\Zafer\AppData\Local\Nero_AG
2012-08-06 13:17 . 2012-08-06 13:17        --------        d-----w-        c:\users\Zafer\AppData\Roaming\Nero
2012-08-05 13:03 . 2012-08-05 13:03        --------        d-----w-        c:\users\Zafer\AppData\Local\Windows Live Writer
2012-08-05 13:03 . 2012-08-05 13:03        --------        d-----w-        c:\users\Zafer\AppData\Roaming\Windows Live Writer
2012-08-03 19:43 . 1998-10-29 13:45        306688        ----a-w-        c:\windows\IsUninst.exe
2012-08-03 15:41 . 2012-08-03 15:43        --------        d-----w-        c:\program files (x86)\RocketDock
2012-08-03 14:07 . 2012-08-03 14:07        --------        d-----w-        c:\users\User\AppData\Local\Lazy 8 Studios
2012-08-02 22:12 . 2012-08-02 22:12        --------        d-----w-        c:\programdata\Steam
2012-08-02 22:12 . 2012-08-02 22:13        --------        d-----w-        c:\programdata\PopCap Games
2012-07-31 15:14 . 2012-07-31 15:14        --------        d-----w-        c:\users\User\AppData\Roaming\Xilisoft
2012-07-28 17:40 . 2012-07-28 17:40        --------        d-sh--w-        c:\windows\SysWow64\AI_RecycleBin
2012-07-28 17:39 . 2012-07-28 17:39        --------        d-----w-        c:\users\User\AppData\Roaming\Lansoftware
2012-07-28 17:19 . 2012-07-28 17:19        --------        d-----w-        c:\users\User\AppData\Roaming\Subversion
2012-07-24 16:39 . 2012-07-24 18:51        --------        d-----w-        c:\users\User\AppData\Roaming\DMCache
2012-07-23 23:33 . 2012-07-23 23:33        --------        d-----w-        c:\users\Zafer\AppData\Local\ESET
2012-07-22 21:21 . 2012-07-22 21:21        --------        d-----w-        c:\users\User\AppData\Roaming\RotMG.Production
2012-07-21 20:17 . 2012-08-10 16:18        --------        d-----w-        c:\program files (x86)\PacSteamT
2012-07-21 20:17 . 2012-07-21 20:17        --------        d-----w-        c:\program files (x86)\Common Files\Thraex Software
2012-07-21 17:50 . 2012-07-21 17:50        --------        d-----w-        c:\users\User\AppData\Local\_
2012-07-21 17:45 . 2012-07-21 17:46        --------        d-----w-        c:\users\User\AppData\Roaming\Party Buffalo Drive Explorer
2012-07-21 17:45 . 2012-07-21 17:45        --------        d-----w-        c:\users\User\AppData\Local\FATX_Browser
2012-07-21 07:11 . 2012-07-21 07:11        71680        ----a-w-        c:\windows\system32\frapsv64.dll
2012-07-21 07:11 . 2012-07-21 07:11        65536        ----a-w-        c:\windows\SysWow64\frapsvid.dll
2012-07-20 16:25 . 2012-07-20 16:25        98304        ----a-w-        c:\windows\SysWow64\CmdLineExt.dll
2012-07-20 02:24 . 2012-07-20 02:24        --------        d-----w-        c:\users\Zafer\AppData\Local\AMD
2012-07-19 20:27 . 2012-07-19 20:27        --------        d-----w-        c:\users\User\AppData\Local\AMD
2012-07-19 20:26 . 2012-08-14 15:16        --------        d-----w-        c:\programdata\AMD
2012-07-19 20:26 . 2010-02-18 07:18        46136        ----a-w-        c:\windows\system32\drivers\amdiox64.sys
2012-07-19 20:14 . 2011-06-07 19:55        462848        ----a-w-        c:\windows\system32\ATIDEMGX.dll
2012-07-19 19:37 . 2011-06-07 19:17        366592        ----a-w-        c:\windows\system32\atiadlxx.dll
2012-07-19 17:22 . 2012-07-19 17:22        --------        d-----w-        c:\program files (x86)\Common Files\Steam
2012-07-18 16:18 . 2010-06-17 05:55        545        ----a-w-        c:\windows\UC.PIF
2012-07-18 16:18 . 2010-06-17 05:55        545        ----a-w-        c:\windows\RAR.PIF
2012-07-18 16:18 . 2010-06-17 05:55        545        ----a-w-        c:\windows\PKZIP.PIF
2012-07-18 16:18 . 2010-06-17 05:55        545        ----a-w-        c:\windows\PKUNZIP.PIF
2012-07-18 16:18 . 2010-06-17 05:55        545        ----a-w-        c:\windows\NOCLOSE.PIF
2012-07-18 16:18 . 2010-06-17 05:55        545        ----a-w-        c:\windows\LHA.PIF
2012-07-18 16:18 . 2010-06-17 05:55        545        ----a-w-        c:\windows\ARJ.PIF
2012-07-18 16:18 . 2012-07-18 16:18        --------        d-----w-        C:\totalcmd
2012-07-18 16:18 . 2012-07-18 16:18        --------        d-----w-        c:\users\User\AppData\Roaming\GHISLER
2012-07-18 13:31 . 2004-10-22 00:16        5632        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\DotNetInstaller.exe
2012-07-17 22:29 . 2012-07-17 22:29        1048576        ----a-w-        c:\windows\system32\syndata.bin
2012-07-17 22:29 . 2012-07-17 22:29        68880        ----a-w-        c:\windows\SysWow64\SynTPEnhPS.dll
2012-07-17 22:29 . 2012-07-17 22:29        412944        ----a-w-        c:\windows\system32\drivers\SynTP.sys
2012-07-17 22:29 . 2012-07-17 22:29        229648        ----a-w-        c:\windows\system32\SynTPAPI.dll
2012-07-17 22:29 . 2012-07-17 22:29        150800        ----a-w-        c:\windows\system32\SynTPCo9.dll
2012-07-17 22:29 . 2012-07-17 22:29        113936        ----a-w-        c:\windows\SysWow64\SynTPCOM.dll
2012-07-17 22:29 . 2012-07-17 22:29        280336        ----a-w-        c:\windows\system32\SynCtrl.dll
2012-07-17 22:29 . 2012-07-17 22:29        224528        ----a-w-        c:\windows\SysWow64\SynCtrl.dll
2012-07-17 22:29 . 2012-07-17 22:29        183568        ----a-w-        c:\windows\SysWow64\SynCOM.dll
2012-07-17 22:27 . 2012-07-17 22:27        280224        ----a-w-        c:\windows\system32\drivers\btfilter.sys
2012-07-17 22:19 . 2012-07-17 22:19        3580928        ----a-w-        c:\windows\system32\drivers\athrx.sys
2012-07-17 22:01 . 2012-07-17 22:01        --------        d-----w-        c:\programdata\Uniblue
2012-07-17 22:01 . 2012-08-09 17:25        --------        d-----w-        c:\users\User\AppData\Roaming\Uniblue
2012-07-17 22:01 . 2012-08-09 17:25        --------        d-----w-        c:\program files (x86)\Uniblue
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-15 16:29 . 2012-06-26 14:31        426184        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2012-08-15 16:29 . 2012-06-26 14:31        70344        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-08-15 10:04 . 2012-06-06 22:11        62134624        ----a-w-        c:\windows\system32\MRT.exe
2012-08-13 20:03 . 2011-08-08 06:37        107552        ----a-w-        c:\windows\system32\RTNUninst64.dll
2012-07-17 22:29 . 2011-02-03 17:56        421648        ----a-w-        c:\windows\system32\SynCOM.dll
2012-07-06 09:11 . 2012-07-06 09:12        955840        ----a-w-        c:\windows\system32\npDeployJava1.dll
2012-07-06 09:11 . 2012-07-06 09:12        839096        ----a-w-        c:\windows\system32\deployJava1.dll
2012-07-05 20:06 . 2012-06-06 18:02        772544        ----a-w-        c:\windows\SysWow64\npDeployJava1.dll
2012-07-05 20:06 . 2011-08-08 08:32        687544        ----a-w-        c:\windows\SysWow64\deployJava1.dll
2012-07-05 19:07 . 2012-07-05 19:07        2300696        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2012-07-05 19:07 . 2012-07-05 19:07        42776        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2012-07-05 19:07 . 2012-07-05 19:07        1236816        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2012-06-22 14:32 . 2012-07-03 15:50        405144        ----a-w-        c:\windows\SysWow64\Newtonsoft.Json.Net20.dll
2012-06-15 14:03 . 2012-06-15 14:03        53248        ----a-w-        C:\zlib.dll
2012-06-15 14:03 . 2012-06-15 14:03        28672        ----a-w-        C:\uncompress.exe
2012-06-11 11:50 . 2012-06-11 11:50        187392        ----a-w-        c:\windows\system32\clinfo.exe
2012-06-11 11:50 . 2012-06-11 11:50        75264        ----a-w-        c:\windows\system32\OpenVideo64.dll
2012-06-11 11:50 . 2012-06-11 11:50        65024        ----a-w-        c:\windows\SysWow64\OpenVideo.dll
2012-06-11 11:50 . 2012-06-11 11:50        63488        ----a-w-        c:\windows\system32\OVDecode64.dll
2012-06-11 11:50 . 2012-06-11 11:50        56320        ----a-w-        c:\windows\SysWow64\OVDecode.dll
2012-06-11 11:50 . 2012-06-11 11:50        16457728        ----a-w-        c:\windows\system32\amdocl64.dll
2012-06-11 11:49 . 2012-06-11 11:49        13008896        ----a-w-        c:\windows\SysWow64\amdocl.dll
2012-06-09 05:43 . 2012-07-11 08:20        14172672        ----a-w-        c:\windows\system32\shell32.dll
2012-06-08 14:53 . 2012-06-08 14:53        51776        ----a-w-        c:\windows\system32\drivers\pssdk41.sys
2012-06-06 15:03 . 2012-06-06 15:03        0        ---ha-w-        c:\users\User\AppData\Local\BITD029.tmp
2012-06-06 06:06 . 2012-07-11 08:20        2004480        ----a-w-        c:\windows\system32\msxml6.dll
2012-06-06 06:06 . 2012-07-11 08:20        1881600        ----a-w-        c:\windows\system32\msxml3.dll
2012-06-06 06:02 . 2012-07-11 08:20        1133568        ----a-w-        c:\windows\system32\cdosys.dll
2012-06-06 05:05 . 2012-07-11 08:20        1390080        ----a-w-        c:\windows\SysWow64\msxml6.dll
2012-06-06 05:05 . 2012-07-11 08:20        1236992        ----a-w-        c:\windows\SysWow64\msxml3.dll
2012-06-06 05:03 . 2012-07-11 08:20        805376        ----a-w-        c:\windows\SysWow64\cdosys.dll
2012-06-05 14:03 . 2012-07-05 21:25        224088        ----a-w-        c:\windows\system32\drivers\VBoxDrv.sys
2012-06-05 14:03 . 2012-07-05 21:25        130904        ----a-w-        c:\windows\system32\drivers\VBoxUSBMon.sys
2012-06-05 14:03 . 2012-06-05 14:03        147288        ----a-w-        c:\windows\system32\drivers\VBoxNetAdp.sys
2012-06-05 14:02 . 2012-06-05 14:02        320856        ------w-        c:\windows\system32\VBoxNetFltNobj.dll
2012-06-02 22:19 . 2012-06-24 07:36        38424        ----a-w-        c:\windows\system32\wups.dll
2012-06-02 22:19 . 2012-06-24 07:37        2428952        ----a-w-        c:\windows\system32\wuaueng.dll
2012-06-02 22:19 . 2012-06-24 07:37        57880        ----a-w-        c:\windows\system32\wuauclt.exe
2012-06-02 22:19 . 2012-06-24 07:37        44056        ----a-w-        c:\windows\system32\wups2.dll
2012-06-02 22:19 . 2012-06-24 07:36        701976        ----a-w-        c:\windows\system32\wuapi.dll
2012-06-02 22:15 . 2012-06-24 07:37        2622464        ----a-w-        c:\windows\system32\wucltux.dll
2012-06-02 22:15 . 2012-06-24 07:36        99840        ----a-w-        c:\windows\system32\wudriver.dll
2012-06-02 13:19 . 2012-06-24 07:36        186752        ----a-w-        c:\windows\system32\wuwebv.dll
2012-06-02 13:15 . 2012-06-24 07:36        36864        ----a-w-        c:\windows\system32\wuapp.exe
2012-06-02 05:50 . 2012-07-11 08:20        458704        ----a-w-        c:\windows\system32\drivers\cng.sys
2012-06-02 05:48 . 2012-07-11 08:20        95600        ----a-w-        c:\windows\system32\drivers\ksecdd.sys
2012-06-02 05:48 . 2012-07-11 08:20        151920        ----a-w-        c:\windows\system32\drivers\ksecpkg.sys
2012-06-02 05:45 . 2012-07-11 08:20        340992        ----a-w-        c:\windows\system32\schannel.dll
2012-06-02 05:44 . 2012-07-11 08:20        307200        ----a-w-        c:\windows\system32\ncrypt.dll
2012-06-02 04:40 . 2012-07-11 08:20        22016        ----a-w-        c:\windows\SysWow64\secur32.dll
2012-06-02 04:40 . 2012-07-11 08:20        225280        ----a-w-        c:\windows\SysWow64\schannel.dll
2012-06-02 04:39 . 2012-07-11 08:20        219136        ----a-w-        c:\windows\SysWow64\ncrypt.dll
2012-06-02 04:34 . 2012-07-11 08:20        96768        ----a-w-        c:\windows\SysWow64\sspicli.dll
2012-05-31 04:04 . 2012-07-06 08:42        9013136        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{61E1F0F2-E44A-4E53-8483-A481C3378235}\mpengine.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{DFEFCDEE-CF1A-4FC8-88AD-129872198372}"= "c:\users\User\AppData\Roaming\loadtbs\toolbar.dll" [2012-06-07 640000]
.
[HKEY_CLASSES_ROOT\clsid\{dfefcdee-cf1a-4fc8-88ad-129872198372}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOPI.EXE"="c:\program files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe" [2011-05-16 846936]
"RocketDock"="c:\program files (x86)\RocketDock\RocketDock.exe" [2007-09-02 495616]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"NBAgent"="c:\program files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe" [2011-06-29 1409424]
"ToshibaServiceStation"="c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2010-11-29 1294712]
"VirtualCloneDrive"="c:\program files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2011-03-07 89456]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"TOPI.EXE"="c:\program files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe" [2011-05-16 846936]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth Monitor.lnk - c:\program files (x86)\TOSHIBA\Bluetooth Monitor\BtMon2.exe [2012-8-8 91464]
Toshiba Places Icon Utility.lnk - c:\program files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe [2011-8-8 1492352]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
TRDCReminder.lnk - c:\program files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe [2011-5-24 1875456]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer3"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages        REG_MULTI_SZ          kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-08 136176]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-15 250056]
R3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [2010-02-18 46136]
R3 anvsnddrv;AnvSoft Virtual Sound Device;c:\windows\system32\drivers\anvsnddrv.sys [2011-11-28 33872]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-04-01 183560]
R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [2012-07-17 280224]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
R3 GGSAFERDriver;GGSAFER Driver;c:\program files (x86)\Garena Plus\Room\safedrv.sys [x]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-08 136176]
R3 libusb0;LibUsb-Win32 - Kernel Driver 03/20/2007, 0.1.12.1;c:\windows\system32\DRIVERS\libusb0.sys [2011-03-19 43456]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 pspdisp;pspdisp;c:\windows\system32\DRIVERS\pspdisp_x64.sys [2011-03-19 4608]
R3 PsSdk41;PsSdk41;c:\windows\system32\Drivers\pssdk41.sys [2012-06-08 51776]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2012-08-08 250984]
R3 TDEIO;TDEIO; [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2012-06-05 147288]
R3 VBoxNetFlt;VirtualBox Bridged Networking Service; [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys [2012-08-13 82048]
S0 amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys [2012-08-13 35456]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2012-05-02 27760]
S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2012-03-14 209768]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2012-03-14 148528]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-06-07 204288]
S2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [2010-01-28 249200]
S2 ConfigFree Service;ConfigFree Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [2009-03-10 46448]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2012-03-07 913144]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2012-03-14 137144]
S2 GFNEXSrv;GFNEX Service;c:\windows\System32\GFNEXSrv.exe [2010-09-09 162824]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2011-03-29 598312]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
S2 TemproMonitoringService;Notebook Performance Tuning Service (TEMPRO);c:\program files (x86)\Toshiba TEMPRO\TemproSvc.exe [2011-02-10 112080]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2011-06-07 9360896]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2011-06-07 309760]
S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [2011-02-08 38096]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2012-08-13 726160]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
S3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2010-11-29 54136]
S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2010-12-08 137632]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-08-16 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-26 16:29]
.
2012-08-16 c:\windows\Tasks\DriverScanner.job
- c:\program files (x86)\Uniblue\DriverScanner\dsmonitor.exe [2012-07-17 10:51]
.
2012-08-10 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2362461307-470646400-428607046-1001Core.job
- c:\users\Zafer\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-06-10 09:13]
.
2012-08-15 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2362461307-470646400-428607046-1001UA.job
- c:\users\Zafer\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-06-10 09:13]
.
2012-08-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-08 09:43]
.
2012-08-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-08 09:43]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Toshiba TEMPRO"="c:\program files (x86)\Toshiba TEMPRO\TemproTray.exe" [2011-02-10 1546720]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-01-12 11775592]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-01-10 2186856]
"TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2010-12-08 710040]
"TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376]
"Toshiba Registration"="c:\program files\TOSHIBA\Registration\ToshibaReminder.exe" [2011-08-08 150992]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2012-03-07 4081008]
"XboxStat"="c:\program files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2009-09-30 825184]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = https://isearch.avg.com/?cid={171A7F26-E427-4C0D-A654-994F7260582F}&mid=85c75b9063d74d799230a6266f96fe62-b601b520f4e2cb24176d12e3154c432512af6417&lang=de&ds=hk011&pr=sa&d=2012-07-18 18:25&v=12.1.0.20&sap=hp
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Zu TOSHIBA Bulletin Board hinzufügen - c:\program files\TOSHIBA\BulletinBoard\TosBBCom.dll/1000
IE: {{97F922BD-8563-4184-87EE-8C4ACA438823} - {5D29E593-73A5-400A-B3BD-6B7A1AF05A31} - c:\program files\TOSHIBA\BulletinBoard\TosBBCom.dll
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\otmuewti.default\
FF - prefs.js: browser.search.selectedEngine - AVG Secure Search
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKLM-Run-Cerberus - c:\windows\system32\Cerberus\server.exe
Toolbar-Locked - (no file)
WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)
HKLM-Run-TosNC - c:\program files (x86)\Toshiba\BulletinBoard\TosNcCore.exe
HKLM-Run-TosReelTimeMonitor - c:\program files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
HKLM-Run-TPwrMain - c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE
HKLM-Run-TCrdMain - c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
  00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-08-16  19:15:05
ComboFix-quarantined-files.txt  2012-08-16 17:15
.
Vor Suchlauf: 13 Verzeichnis(se), 54.298.185.728 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 53.710.131.200 Bytes frei
.
- - End Of File - - A04F138DF61B4A0BC4203350926A74AB
--- ---

markusg 20.08.2012 12:03
sorry für die wartezeit, nutzt du den pc zum onlinebanking, einkaufen, für sonstige zahlungsabwicklungen, oder ähnlich wichtiges, wie berufliches?

Windows7Home 31.08.2012 22:27
Bei mir auch sry weil hab net rein gekuckt ich benutze mein pc zum gaming und zum online kaufen und videos kucken und zum arbeiten

markusg 06.09.2012 16:59
hi
dann sollten wir neu aufsetzen
der pc muss neu aufgesetzt und dann abgesichert werden
1. Datenrettung:2. Formatieren, Windows neu instalieren:3. PC absichern: http://www.trojaner-board.de/96344-a...-rechners.html
ich werde außerdem noch weitere punkte dazu posten.
4. alle Passwörter ändern!
5. nach PC Absicherung, die gesicherten Daten prüfen und falls sauber: zurückspielen.
6. werde ich dann noch was zum absichern von Onlinebanking mit Chip Card Reader + Star Money sagen.


Alle Zeitangaben in WEZ +1. Es ist jetzt 12:21 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19