Trojaner-Board - ZeuS/ZBot Telekom Warnung OTL Log files

dds.txt:

DDS Logfile:

Code:

DDS (Ver_2012-11-20.01) - NTFS_AMD64 

Internet Explorer: 10.0.9200.16537  BrowserJavaVersion: 10.17.2

Run by Xychor at 3:24:10 on 2013-04-17

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.4095.2563 [GMT 2:00]

.

AV: AVG AntiVirus Free Edition 2013 *Enabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: AVG AntiVirus Free Edition 2013 *Enabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe

C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe

C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin

C:\Program Files (x86)\Winamp\winampa.exe

C:\Program Files (x86)\AVG\AVG2013\avgui.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

C:\Program Files (x86)\AVG\AVG2013\avgcfgex.exe

C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe

C:\Program Files (x86)\AVG\AVG2013\avgemca.exe

C:\Program Files (x86)\AVG\AVG2013\avgnsa.exe

C:\Program Files (x86)\AVG\AVG2013\avgrsa.exe

C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe

C:\Program Files (x86)\Opera\opera.exe

C:\Program Files (x86)\AVG\AVG2013\avgcsrva.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.de/

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll

BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

BHO: Windows Live ID-Anmelde-Hilfsprogramm: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

EB: <No Name>: {555D4D79-4BD2-4094-A395-CFC534424A05} - LocalServer32 - <no file>

EB: <No Name>: {555D4D79-4BD2-4094-A395-CFC534424A05} - LocalServer32 - <no file>

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [WinampAgent] "C:\Program Files (x86)\Winamp\winampa.exe"

mRun: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY

mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

StartupFolder: C:\Users\Xychor\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\Xychor\AppData\Roaming\Dropbox\bin\Dropbox.exe

StartupFolder: C:\Users\Xychor\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\OPENOF~1.LNK - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe

uPolicies-Explorer: NoDrives = dword:0

mPolicies-Explorer: NoDrives = dword:0

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

TCP: NameServer = 192.168.178.1

TCP: Interfaces\{3FB98FC0-7832-403E-AF70-1E6DB50C23A6} : DHCPNameServer = 192.168.178.1

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - <orphaned>

SSODL: WebCheck - <orphaned>

x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s

x64-Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - <orphaned>

x64-SSODL: WebCheck - <orphaned>

.

============= SERVICES / DRIVERS ===============

.

R0 AVGIDSHA;AVGIDSHA;C:\Windows\System32\drivers\avgidsha.sys [2012-10-15 63328]

R0 Avgloga;AVG Logging Driver;C:\Windows\System32\drivers\avgloga.sys [2012-9-21 225120]

R0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\Windows\System32\drivers\avgmfx64.sys [2012-11-16 111968]

R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\Windows\System32\drivers\avgrkx64.sys [2012-9-14 40800]

R1 AVGIDSDriver;AVGIDSDriver;C:\Windows\System32\drivers\avgidsdrivera.sys [2012-10-22 154464]

R1 Avgldx64;AVG AVI Loader Driver;C:\Windows\System32\drivers\avgldx64.sys [2012-10-2 185696]

R1 Avgtdia;AVG TDI Driver;C:\Windows\System32\drivers\avgtdia.sys [2012-9-21 200032]

R2 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [2012-11-16 5814904]

R2 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [2012-10-22 196664]

R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-4-11 418376]

R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-1-18 383264]

R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2013-4-11 25928]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2012-1-2 236544]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-4-11 701512]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2012-1-3 59392]

.

=============== Created Last 30 ================

.

2013-04-17 00:17:25        --------        d-----w-        C:\ProgramData\YTD Video Downloader

2013-04-16 12:14:57        --------        d-----w-        C:\Users\Xychor\AppData\Local\{6D597BA5-480F-4A2D-89B6-B14A8AC095D4}

2013-04-15 15:11:58        --------        d-----w-        C:\Users\Xychor\AppData\Local\{3352C8AE-D080-432D-B58C-A58475BACF90}

2013-04-15 01:44:49        --------        d-----w-        C:\Users\Xychor\AppData\Local\{1B4BF960-C436-4954-A368-2F06B7A741F8}

2013-04-14 20:33:40        --------        d-----w-        C:\Users\Xychor\AppData\Local\{AE4E6BC3-D4B6-4515-9D02-D73E36FE5F75}

2013-04-14 07:43:12        --------        d-----w-        C:\Users\Xychor\AppData\Local\{8D58EB17-9C9B-4C55-823D-8C93BBC389BA}

2013-04-13 17:01:36        861088        ----a-w-        C:\Windows\SysWow64\npDeployJava1.dll

2013-04-13 17:01:28        95648        ----a-w-        C:\Windows\SysWow64\WindowsAccessBridge-32.dll

2013-04-13 16:24:39        --------        d-----w-        C:\Windows\ERUNT

2013-04-13 16:24:36        --------        d-----w-        C:\JRT

2013-04-13 13:59:53        --------        d-----w-        C:\$RECYCLE.BIN

2013-04-13 13:38:45        98816        ----a-w-        C:\Windows\sed.exe

2013-04-13 13:38:45        256000        ----a-w-        C:\Windows\PEV.exe

2013-04-13 13:38:45        208896        ----a-w-        C:\Windows\MBR.exe

2013-04-11 13:26:10        --------        d-----w-        C:\Users\Xychor\AppData\Roaming\Malwarebytes

2013-04-11 13:25:25        25928        ----a-w-        C:\Windows\System32\drivers\mbam.sys

2013-04-11 13:25:25        --------        d-----w-        C:\ProgramData\Malwarebytes

2013-04-11 13:25:25        --------        d-----w-        C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-04-11 13:25:11        --------        d-----w-        C:\Users\Xychor\AppData\Local\Programs

2013-04-10 10:15:05        3717632        ----a-w-        C:\Windows\System32\mstscax.dll

2013-04-10 10:15:05        3217408        ----a-w-        C:\Windows\SysWow64\mstscax.dll

2013-04-10 10:15:04        44032        ----a-w-        C:\Windows\System32\tsgqec.dll

2013-04-10 10:15:04        36864        ----a-w-        C:\Windows\SysWow64\tsgqec.dll

2013-04-10 10:15:04        158720        ----a-w-        C:\Windows\System32\aaclient.dll

2013-04-10 10:15:04        131584        ----a-w-        C:\Windows\SysWow64\aaclient.dll

2013-04-10 10:15:01        3153408        ----a-w-        C:\Windows\System32\win32k.sys

2013-04-10 10:14:59        1655656        ----a-w-        C:\Windows\System32\drivers\ntfs.sys

2013-04-10 10:14:58        223752        ----a-w-        C:\Windows\System32\drivers\fvevol.sys

2013-04-10 10:14:57        5550424        ----a-w-        C:\Windows\System32\ntoskrnl.exe

2013-04-10 10:14:56        3913560        ----a-w-        C:\Windows\SysWow64\ntoskrnl.exe

2013-04-10 10:14:55        6656        ----a-w-        C:\Windows\SysWow64\apisetschema.dll

2013-04-10 10:14:55        43520        ----a-w-        C:\Windows\System32\csrsrv.dll

2013-04-10 10:14:55        3968856        ----a-w-        C:\Windows\SysWow64\ntkrnlpa.exe

2013-04-10 10:14:55        112640        ----a-w-        C:\Windows\System32\smss.exe

2013-03-20 22:49:25        19968        ----a-w-        C:\Windows\System32\drivers\usb8023.sys

.

==================== Find3M  ====================

.

2013-04-13 17:01:23        782240        ----a-w-        C:\Windows\SysWow64\deployJava1.dll

2013-02-25 22:32:44        25256224        ----a-w-        C:\Windows\System32\nvcompiler.dll

2013-02-21 10:30:16        1766912        ----a-w-        C:\Windows\SysWow64\wininet.dll

2013-02-21 10:29:39        2877440        ----a-w-        C:\Windows\SysWow64\jscript9.dll

2013-02-21 10:29:37        61440        ----a-w-        C:\Windows\SysWow64\iesetup.dll

2013-02-21 10:29:37        109056        ----a-w-        C:\Windows\SysWow64\iesysprep.dll

2013-02-21 10:15:07        2240512        ----a-w-        C:\Windows\System32\wininet.dll

2013-02-21 10:14:09        3958784        ----a-w-        C:\Windows\System32\jscript9.dll

2013-02-21 10:14:05        67072        ----a-w-        C:\Windows\System32\iesetup.dll

2013-02-21 10:14:05        136704        ----a-w-        C:\Windows\System32\iesysprep.dll

2013-02-19 12:01:03        2706432        ----a-w-        C:\Windows\SysWow64\mshtml.tlb

2013-02-19 11:42:14        2706432        ----a-w-        C:\Windows\System32\mshtml.tlb

2013-02-19 11:10:53        71680        ----a-w-        C:\Windows\SysWow64\RegisterIEPKEYs.exe

2013-02-19 10:51:18        89600        ----a-w-        C:\Windows\System32\RegisterIEPKEYs.exe

2013-02-12 05:45:24        135168        ----a-w-        C:\Windows\apppatch\AppPatch64\AcXtrnal.dll

2013-02-12 05:45:22        350208        ----a-w-        C:\Windows\apppatch\AppPatch64\AcLayers.dll

2013-02-12 05:45:22        308736        ----a-w-        C:\Windows\apppatch\AppPatch64\AcGenral.dll

2013-02-12 05:45:22        111104        ----a-w-        C:\Windows\apppatch\AppPatch64\acspecfc.dll

2013-02-12 04:48:31        474112        ----a-w-        C:\Windows\apppatch\AcSpecfc.dll

2013-02-12 04:48:26        2176512        ----a-w-        C:\Windows\apppatch\AcGenral.dll

2013-01-19 16:58:38        152576        ----a-w-        C:\Windows\SysWow64\msclmd.dll

2013-01-19 16:58:37        175616        ----a-w-        C:\Windows\System32\msclmd.dll

2013-01-18 15:00:28        6390048        ----a-w-        C:\Windows\System32\nvcpl.dll

2013-01-18 15:00:28        3460896        ----a-w-        C:\Windows\System32\nvsvc64.dll

2013-01-18 15:00:11        884512        ----a-w-        C:\Windows\System32\nvvsvc.exe

2013-01-18 15:00:11        63776        ----a-w-        C:\Windows\System32\nvshext.dll

2013-01-18 15:00:11        2558240        ----a-w-        C:\Windows\System32\nvsvcr.dll

2013-01-18 15:00:11        118560        ----a-w-        C:\Windows\System32\nvmctray.dll

2013-01-18 06:15:24        550176        ----a-w-        C:\Windows\SysWow64\nvStreaming.exe

.

============= FINISH:  3:24:28,48 ===============

--- --- ---

attach.txt:

Code:

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Home Premium 

Boot Device: \Device\HarddiskVolume3

Install Date: 02.01.2012 08:36:54

System Uptime: 16.04.2013 21:01:06 (6 hours ago)

.

Motherboard: ASRock |  | M3A790GXH/128M

Processor: AMD Phenom(tm) II X4 945 Processor | CPUSocket | 3000/200mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 69 GiB total, 8,002 GiB free.

D: is FIXED (NTFS) - 195 GiB total, 41,125 GiB free.

E: is FIXED (NTFS) - 103 GiB total, 15,77 GiB free.

F: is CDROM ()

.

==== Disabled Device Manager Items =============

.

Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}

Description: Cisco Systems VPN Adapter for 64-bit Windows

Device ID: ROOT\NET\0000

Manufacturer: Cisco Systems

Name: Cisco Systems VPN Adapter for 64-bit Windows

PNP Device ID: ROOT\NET\0000

Service: CVirtA

.

==== System Restore Points ===================

.

No restore point in system.

.

==== Installed Programs ======================

.

64 Bit HP CIO Components Installer

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Reader X (10.1.6) - Deutsch

AVG 2013

BitTorrent

CCleaner

Cisco Systems VPN Client 5.0.07.0440

D3DX10

Diablo III

Dropbox

FILSHtray Version 0.11

GIMP 2.6.11

HP Update

IrfanView (remove only)

Java 7 Update 17

Java Auto Updater

Java(TM) 6 Update 22

Junk Mail filter update

Malwarebytes Anti-Malware Version 1.75.0.1300

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1 German Language Pack

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Client Profile DEU Language Pack

Microsoft Application Error Reporting

Microsoft Silverlight

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

MSVCRT

MSVCRT_amd64

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

NVIDIA 3D Vision Treiber 311.06

NVIDIA Grafiktreiber 311.06

NVIDIA Install Application

NVIDIA PhysX

NVIDIA PhysX-Systemsoftware 9.11.0621

NVIDIA Stereoscopic 3D Driver

NVIDIA Systemsteuerung 311.06

NVIDIA Update 1.11.3

NVIDIA Update Components

OpenOffice.org 3.3

Opera 12.13

PDFCreator

Pidgin

Quantum GIS Wroclaw 1.7.3 Wroclaw

RealNetworks - Microsoft Visual C++ 2008 Runtime

RealPlayer

Realtek Ethernet Controller  Driver

Realtek High Definition Audio Driver

RealUpgrade 1.1

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)

Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2518870)

SedLog 2.1.4

swMSM

TeamSpeak 3 Client

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

Visual Studio 2008 x64 Redistributables

Visual Studio 2010 x64 Redistributables

VLC media player 1.1.11

Warhammer Mark of Chaos Manual Patch

Warhammer® Mark of Chaos

Winamp

Winamp Erkennungs-Plug-in

Windows Live Communications Platform

Windows Live Essentials

Windows Live ID Sign-in Assistant

Windows Live Installer

Windows Live Language Selector

Windows Live Mail

Windows Live MIME IFilter

Windows Live Photo Common

Windows Live PIMT Platform

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

WinRAR 4.01 (64-Bit)

World of Warcraft

YTD Video Downloader 3.9.6

.

==== End Of File ===========================