Trojaner-Board
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Verschlüsselungs-Trojaner am.9.6. eingefangen (https://www.trojaner-board.de/117313-verschluesselungs-trojaner-9-6-eingefangen.html)

cosinus 21.06.2012 19:08
Starte Windows neu im abgesicherten Modus (mit Netzwerktreibern nach Möglichkeit), manchmal hakt das Fixen mit OTL im normalen Modus aber sehr oft funktioniert der Fix im abgesicherte Modus.

Totalbird 22.06.2012 11:30
Hallo Arne,

:wtf: abgesicherter Modus lässt sich nun mal wieder nicht starten.

(Kurzzeitiges Bluescreen aufblitzen Syndrom)

Hatte ich zu Anfang schonmal. *gnarrrf*

Gruß Thomas

cosinus 22.06.2012 12:37
Dann starte nochmal OTLPE und mach darüber den Fix

Totalbird 22.06.2012 13:35
Nööö Sorry,

da funzd auch nichts. OTLPE.Exe zieht 98% CPU :kloppen:

Mehr passiert leider nicht

Gruss T.

cosinus 22.06.2012 13:51
Äh du hast auch von der CD gebootet? :wtf: :confused:

Totalbird 22.06.2012 14:03
Jawoll habe ich. Von der CD gebootet.

Bin mit Reatogo X-PE angemeldet auf dem Laptop und mit OTLPE versucht den Fix auszuführen.


Gruss T.

cosinus 24.06.2012 14:54
Dann überpringen wir OTL erstmal...

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Totalbird 26.06.2012 11:56
Hallo Arne,

anbei das Log vom TDSS Lauf.

Code:
13:49:06.0046 3224        TDSS rootkit removing tool 2.7.42.0 Jun 25 2012 21:18:44
13:49:06.0671 3224        ============================================================
13:49:06.0671 3224        Current date / time: 2012/06/26 13:49:06.0671
13:49:06.0671 3224        SystemInfo:
13:49:06.0671 3224       
13:49:06.0671 3224        OS Version: 5.1.2600 ServicePack: 3.0
13:49:06.0671 3224        Product type: Workstation
13:49:06.0671 3224        ComputerName: SASKIAS
13:49:06.0671 3224        UserName: Saskia
13:49:06.0671 3224        Windows directory: E:\WINDOWS
13:49:06.0671 3224        System windows directory: E:\WINDOWS
13:49:06.0671 3224        Processor architecture: Intel x86
13:49:06.0671 3224        Number of processors: 2
13:49:06.0671 3224        Page size: 0x1000
13:49:06.0671 3224        Boot type: Normal boot
13:49:06.0671 3224        ============================================================
13:49:08.0562 3224        Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
13:49:08.0562 3224        ============================================================
13:49:08.0562 3224        \Device\Harddisk0\DR0:
13:49:08.0562 3224        MBR partitions:
13:49:08.0562 3224        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0xC34F28D
13:49:08.0578 3224        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0xC34F30B, BlocksNum 0x10E713B5
13:49:08.0578 3224        ============================================================
13:49:08.0625 3224        C: <-> \Device\Harddisk0\DR0\Partition0
13:49:08.0671 3224        E: <-> \Device\Harddisk0\DR0\Partition1
13:49:08.0671 3224        ============================================================
13:49:08.0671 3224        Initialize success
13:49:08.0671 3224        ============================================================
13:50:17.0828 3424        ============================================================
13:50:17.0828 3424        Scan started
13:50:17.0828 3424        Mode: Manual; SigCheck; TDLFS;
13:50:17.0828 3424        ============================================================
13:50:18.0093 3424        Abiosdsk - ok
13:50:18.0109 3424        abp480n5 - ok
13:50:18.0156 3424        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) E:\WINDOWS\system32\DRIVERS\ACPI.sys
13:50:18.0625 3424        ACPI - ok
13:50:18.0671 3424        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) E:\WINDOWS\system32\DRIVERS\ACPIEC.sys
13:50:18.0781 3424        ACPIEC - ok
13:50:18.0781 3424        adpu160m - ok
13:50:18.0796 3424        aec            (8bed39e3c35d6a489438b8141717a557) E:\WINDOWS\system32\drivers\aec.sys
13:50:18.0906 3424        aec - ok
13:50:18.0937 3424        AegisP          (375eb0b97e3950adef3633c27a82438b) E:\WINDOWS\system32\DRIVERS\AegisP.sys
13:50:18.0968 3424        AegisP ( UnsignedFile.Multi.Generic ) - warning
13:50:18.0968 3424        AegisP - detected UnsignedFile.Multi.Generic (1)
13:50:19.0015 3424        AFD            (1e44bc1e83d8fd2305f8d452db109cf9) E:\WINDOWS\System32\drivers\afd.sys
13:50:19.0078 3424        AFD - ok
13:50:19.0171 3424        AgereSoftModem  (4e6294a06be883c9bd685a8dfd9fcd4e) E:\WINDOWS\system32\DRIVERS\AGRSM.sys
13:50:19.0312 3424        AgereSoftModem - ok
13:50:19.0328 3424        Aha154x - ok
13:50:19.0328 3424        aic78u2 - ok
13:50:19.0343 3424        aic78xx - ok
13:50:19.0390 3424        Alerter        (738d80cc01d7bc7584be917b7f544394) E:\WINDOWS\system32\alrsvc.dll
13:50:19.0546 3424        Alerter - ok
13:50:19.0593 3424        ALG            (190cd73d4984f94d823f9444980513e5) E:\WINDOWS\System32\alg.exe
13:50:19.0828 3424        ALG - ok
13:50:19.0828 3424        AliIde - ok
13:50:19.0843 3424        amsint - ok
13:50:19.0984 3424        Apple Mobile Device (7ef47644b74ebe721cc32211d3c35e76) E:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
13:50:20.0015 3424        Apple Mobile Device - ok
13:50:20.0062 3424        AppMgmt        (d45960be52c3c610d361977057f98c54) E:\WINDOWS\System32\appmgmts.dll
13:50:20.0281 3424        AppMgmt - ok
13:50:20.0375 3424        Arp1394        (b5b8a80875c1dededa8b02765642c32f) E:\WINDOWS\system32\DRIVERS\arp1394.sys
13:50:20.0468 3424        Arp1394 - ok
13:50:20.0484 3424        asc - ok
13:50:20.0484 3424        asc3350p - ok
13:50:20.0500 3424        asc3550 - ok
13:50:20.0609 3424        aspnet_state    (0e5e4957549056e2bf2c49f4f6b601ad) E:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
13:50:20.0640 3424        aspnet_state - ok
13:50:20.0656 3424        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) E:\WINDOWS\system32\DRIVERS\asyncmac.sys
13:50:20.0750 3424        AsyncMac - ok
13:50:20.0781 3424        atapi          (9f3a2f5aa6875c72bf062c712cfa2674) E:\WINDOWS\system32\DRIVERS\atapi.sys
13:50:20.0953 3424        atapi - ok
13:50:20.0953 3424        Atdisk - ok
13:50:21.0000 3424        Atmarpc        (9916c1225104ba14794209cfa8012159) E:\WINDOWS\system32\DRIVERS\atmarpc.sys
13:50:21.0093 3424        Atmarpc - ok
13:50:21.0140 3424        ATSWPDRV        (293e8cc3c246a89f4cca75b024ad757f) E:\WINDOWS\system32\DRIVERS\ATSwpDrv.sys
13:50:21.0187 3424        ATSWPDRV - ok
13:50:21.0218 3424        AudioSrv        (58ed0d5452df7be732193e7999c6b9a4) E:\WINDOWS\System32\audiosrv.dll
13:50:21.0328 3424        AudioSrv - ok
13:50:21.0359 3424        audstub        (d9f724aa26c010a217c97606b160ed68) E:\WINDOWS\system32\DRIVERS\audstub.sys
13:50:21.0453 3424        audstub - ok
13:50:21.0500 3424        b57w2k          (f96038aa1ec4013a93d2420fc689d1e9) E:\WINDOWS\system32\DRIVERS\b57xp32.sys
13:50:21.0531 3424        b57w2k - ok
13:50:21.0593 3424        Beep            (da1f27d85e0d1525f6621372e7b685e9) E:\WINDOWS\system32\drivers\Beep.sys
13:50:21.0703 3424        Beep - ok
13:50:21.0765 3424        BITS            (d6f603772a789bb3228f310d650b8bd1) E:\WINDOWS\system32\qmgr.dll
13:50:21.0937 3424        BITS - ok
13:50:22.0093 3424        Bonjour Service (db5bea73edaf19ac68b2c0fad0f92b1a) E:\Programme\Bonjour\mDNSResponder.exe
13:50:22.0125 3424        Bonjour Service - ok
13:50:22.0171 3424        Browser        (b42057f06bbb98b31876c0b3f2b54e33) E:\WINDOWS\System32\browser.dll
13:50:22.0328 3424        Browser - ok
13:50:22.0453 3424        CA_LIC_CLNT    (e6108b2580a74c041a72418ec31513d7) E:\Programme\CA\SharedComponents\CA_LIC\lic98rmt.exe
13:50:22.0468 3424        CA_LIC_CLNT ( UnsignedFile.Multi.Generic ) - warning
13:50:22.0468 3424        CA_LIC_CLNT - detected UnsignedFile.Multi.Generic (1)
13:50:22.0484 3424        CA_LIC_SRVR    (41695350a5475b4e0fd689142ed5dbf6) E:\Programme\CA\SharedComponents\CA_LIC\lic98rmtd.exe
13:50:22.0500 3424        CA_LIC_SRVR ( UnsignedFile.Multi.Generic ) - warning
13:50:22.0500 3424        CA_LIC_SRVR - detected UnsignedFile.Multi.Generic (1)
13:50:22.0531 3424        cbidf2k        (90a673fc8e12a79afbed2576f6a7aaf9) E:\WINDOWS\system32\drivers\cbidf2k.sys
13:50:22.0718 3424        cbidf2k - ok
13:50:22.0718 3424        cd20xrnt - ok
13:50:22.0734 3424        Cdaudio        (c1b486a7658353d33a10cc15211a873b) E:\WINDOWS\system32\drivers\Cdaudio.sys
13:50:22.0937 3424        Cdaudio - ok
13:50:23.0000 3424        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) E:\WINDOWS\system32\drivers\Cdfs.sys
13:50:23.0187 3424        Cdfs - ok
13:50:23.0218 3424        Cdrom          (1f4260cc5b42272d71f79e570a27a4fe) E:\WINDOWS\system32\DRIVERS\cdrom.sys
13:50:23.0312 3424        Cdrom - ok
13:50:23.0312 3424        Changer - ok
13:50:23.0359 3424        CiSvc          (28e3040d1f1ca2008cd6b29dfebc9a5e) E:\WINDOWS\system32\cisvc.exe
13:50:23.0453 3424        CiSvc - ok
13:50:23.0468 3424        ClipSrv        (778a30ed3c134eb7e406afc407e9997d) E:\WINDOWS\system32\clipsrv.exe
13:50:23.0546 3424        ClipSrv - ok
13:50:23.0656 3424        clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) E:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
13:50:23.0718 3424        clr_optimization_v2.0.50727_32 - ok
13:50:23.0734 3424        CmBatt          (0f6c187d38d98f8df904589a5f94d411) E:\WINDOWS\system32\DRIVERS\CmBatt.sys
13:50:23.0843 3424        CmBatt - ok
13:50:23.0843 3424        CmdIde - ok
13:50:23.0859 3424        Compbatt        (6e4c9f21f0fae8940661144f41b13203) E:\WINDOWS\system32\DRIVERS\compbatt.sys
13:50:23.0968 3424        Compbatt - ok
13:50:23.0968 3424        COMSysApp - ok
13:50:23.0984 3424        Cpqarray - ok
13:50:24.0046 3424        CryptSvc        (611f824e5c703a5a899f84c5f1699e4d) E:\WINDOWS\System32\cryptsvc.dll
13:50:24.0187 3424        CryptSvc - ok
13:50:24.0234 3424        ctxusbm        (cb6ff7012bb5d59d7c12350db795ce1f) E:\WINDOWS\system32\DRIVERS\ctxusbm.sys
13:50:24.0250 3424        ctxusbm - ok
13:50:24.0250 3424        dac2w2k - ok
13:50:24.0265 3424        dac960nt - ok
13:50:24.0312 3424        DcomLaunch      (3127afbf2c1ed0ab14a1bbb7aaecb85b) E:\WINDOWS\system32\rpcss.dll
13:50:24.0406 3424        DcomLaunch - ok
13:50:24.0453 3424        Dhcp            (c29a1c9b75ba38fa37f8c44405dec360) E:\WINDOWS\System32\dhcpcsvc.dll
13:50:24.0609 3424        Dhcp - ok
13:50:24.0656 3424        Disk            (044452051f3e02e7963599fc8f4f3e25) E:\WINDOWS\system32\DRIVERS\disk.sys
13:50:24.0796 3424        Disk - ok
13:50:24.0796 3424        dmadmin - ok
13:50:24.0890 3424        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) E:\WINDOWS\system32\drivers\dmboot.sys
13:50:25.0078 3424        dmboot - ok
13:50:25.0109 3424        dmio            (53720ab12b48719d00e327da470a619a) E:\WINDOWS\system32\drivers\dmio.sys
13:50:25.0281 3424        dmio - ok
13:50:25.0312 3424        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) E:\WINDOWS\system32\drivers\dmload.sys
13:50:25.0468 3424        dmload - ok
13:50:25.0531 3424        dmserver        (25c83ffbba13b554eb6d59a9b2e2ee78) E:\WINDOWS\System32\dmserver.dll
13:50:25.0703 3424        dmserver - ok
13:50:25.0734 3424        DMusic          (8a208dfcf89792a484e76c40e5f50b45) E:\WINDOWS\system32\drivers\DMusic.sys
13:50:25.0875 3424        DMusic - ok
13:50:25.0953 3424        Dnscache        (407f3227ac618fd1ca54b335b083de07) E:\WINDOWS\System32\dnsrslvr.dll
13:50:26.0046 3424        Dnscache - ok
13:50:26.0078 3424        Dot3svc        (676e36c4ff5bcea1900f44182b9723e6) E:\WINDOWS\System32\dot3svc.dll
13:50:26.0171 3424        Dot3svc - ok
13:50:26.0187 3424        dpti2o - ok
13:50:26.0218 3424        drmkaud        (8f5fcff8e8848afac920905fbd9d33c8) E:\WINDOWS\system32\drivers\drmkaud.sys
13:50:26.0312 3424        drmkaud - ok
13:50:26.0343 3424        EapHost        (4e4f2fddab0a0736d7671134dcce91fb) E:\WINDOWS\System32\eapsvc.dll
13:50:26.0453 3424        EapHost - ok
13:50:26.0500 3424        ERSvc          (877c18558d70587aa7823a1a308ac96b) E:\WINDOWS\System32\ersvc.dll
13:50:26.0703 3424        ERSvc - ok
13:50:26.0765 3424        Eventlog        (a3edbe9053889fb24ab22492472b39dc) E:\WINDOWS\system32\services.exe
13:50:26.0796 3424        Eventlog - ok
13:50:26.0828 3424        EventSystem    (af4f6b5739d18ca7972ab53e091cbc74) E:\WINDOWS\system32\es.dll
13:50:26.0906 3424        EventSystem - ok
13:50:27.0015 3424        EvtEng          (4432179a475deeb0eb0f1bee11831a89) E:\Programme\Intel\Wireless\Bin\EvtEng.exe
13:50:27.0062 3424        EvtEng ( UnsignedFile.Multi.Generic ) - warning
13:50:27.0062 3424        EvtEng - detected UnsignedFile.Multi.Generic (1)
13:50:27.0093 3424        Fastfat        (38d332a6d56af32635675f132548343e) E:\WINDOWS\system32\drivers\Fastfat.sys
13:50:27.0203 3424        Fastfat - ok
13:50:27.0250 3424        FastUserSwitchingCompatibility (2db7d303c36ddd055215052f118e8e75) E:\WINDOWS\System32\shsvcs.dll
13:50:27.0312 3424        FastUserSwitchingCompatibility - ok
13:50:27.0343 3424        Fdc            (92cdd60b6730b9f50f6a1a0c1f8cdc81) E:\WINDOWS\system32\drivers\Fdc.sys
13:50:27.0531 3424        Fdc - ok
13:50:27.0593 3424        FingerprintServer (0ca05359810e0ce08f1dd19b07f7b29c) E:\WINDOWS\system32\FpLogonServ.exe
13:50:27.0609 3424        FingerprintServer ( UnsignedFile.Multi.Generic ) - warning
13:50:27.0609 3424        FingerprintServer - detected UnsignedFile.Multi.Generic (1)
13:50:27.0609 3424        Fips            (b0678a548587c5f1967b0d70bacad6c1) E:\WINDOWS\system32\drivers\Fips.sys
13:50:27.0703 3424        Fips - ok
13:50:27.0734 3424        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) E:\WINDOWS\system32\drivers\Flpydisk.sys
13:50:27.0812 3424        Flpydisk - ok
13:50:27.0843 3424        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) E:\WINDOWS\system32\drivers\fltmgr.sys
13:50:27.0953 3424        FltMgr - ok
13:50:28.0046 3424        FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) e:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
13:50:28.0062 3424        FontCache3.0.0.0 - ok
13:50:28.0093 3424        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) E:\WINDOWS\system32\drivers\Fs_Rec.sys
13:50:28.0203 3424        Fs_Rec - ok
13:50:28.0234 3424        Ftdisk          (8f1955ce42e1484714b542f341647778) E:\WINDOWS\system32\DRIVERS\ftdisk.sys
13:50:28.0359 3424        Ftdisk - ok
13:50:28.0390 3424        GEARAspiWDM    (8182ff89c65e4d38b2de4bb0fb18564e) E:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
13:50:28.0406 3424        GEARAspiWDM - ok
13:50:28.0421 3424        Gpc            (0a02c63c8b144bd8c86b103dee7c86a2) E:\WINDOWS\system32\DRIVERS\msgpc.sys
13:50:28.0562 3424        Gpc - ok
13:50:28.0703 3424        gupdate        (8f0de4fef8201e306f9938b0905ac96a) E:\Programme\Google\Update\GoogleUpdate.exe
13:50:28.0718 3424        gupdate - ok
13:50:28.0718 3424        gupdatem        (8f0de4fef8201e306f9938b0905ac96a) E:\Programme\Google\Update\GoogleUpdate.exe
13:50:28.0734 3424        gupdatem - ok
13:50:28.0781 3424        gusvc          (cc839e8d766cc31a7710c9f38cf3e375) E:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
13:50:28.0812 3424        gusvc - ok
13:50:28.0843 3424        HDAudBus        (573c7d0a32852b48f3058cfd8026f511) E:\WINDOWS\system32\DRIVERS\HDAudBus.sys
13:50:28.0984 3424        HDAudBus - ok
13:50:29.0078 3424        helpsvc        (cb66bf85bf599befd6c6a57c2e20357f) E:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
13:50:29.0250 3424        helpsvc - ok
13:50:29.0265 3424        heypjtw - ok
13:50:29.0265 3424        HidServ - ok
13:50:29.0312 3424        hkmsvc          (ed29f14101523a6e0e808107405d452c) E:\WINDOWS\System32\kmsvc.dll
13:50:29.0453 3424        hkmsvc - ok
13:50:29.0468 3424        hpn - ok
13:50:29.0546 3424        HTTP            (f80a415ef82cd06ffaf0d971528ead38) E:\WINDOWS\system32\Drivers\HTTP.sys
13:50:29.0609 3424        HTTP - ok
13:50:29.0640 3424        HTTPFilter      (9e4adb854cebcfb81a4b36718feecd16) E:\WINDOWS\System32\w3ssl.dll
13:50:29.0796 3424        HTTPFilter - ok
13:50:29.0859 3424        hwdatacard      (8adf5ef39e896a65beded878494ee2b6) E:\WINDOWS\system32\DRIVERS\ewusbmdm.sys
13:50:29.0937 3424        hwdatacard - ok
13:50:29.0953 3424        i2omgmt - ok
13:50:29.0953 3424        i2omp - ok
13:50:30.0000 3424        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) E:\WINDOWS\system32\DRIVERS\i8042prt.sys
13:50:30.0187 3424        i8042prt - ok
13:50:30.0328 3424        idsvc          (c01ac32dc5c03076cfb852cb5da5229c) e:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
13:50:30.0406 3424        idsvc - ok
13:50:30.0546 3424        iGateway        (404544c1b48aac95a839f5d48cf82ba6) E:\Programme\CA\SharedComponents\iTechnology\igateway.exe
13:50:30.0578 3424        iGateway ( UnsignedFile.Multi.Generic ) - warning
13:50:30.0578 3424        iGateway - detected UnsignedFile.Multi.Generic (1)
13:50:30.0609 3424        Imapi          (083a052659f5310dd8b6a6cb05edcf8e) E:\WINDOWS\system32\DRIVERS\imapi.sys
13:50:30.0718 3424        Imapi - ok
13:50:30.0750 3424        ImapiService    (d4b413aa210c21e46aedd2ba5b68d38e) E:\WINDOWS\system32\imapi.exe
13:50:30.0906 3424        ImapiService - ok
13:50:30.0921 3424        ini910u - ok
13:50:31.0046 3424        InoRPC          (4f7d1520bbe672fd9364a9f6f1def47c) C:\Programme\CA\eTrust Antivirus\InoRpc.exe
13:50:31.0078 3424        InoRPC ( UnsignedFile.Multi.Generic ) - warning
13:50:31.0078 3424        InoRPC - detected UnsignedFile.Multi.Generic (1)
13:50:31.0109 3424        InoRT          (a08267418c7fd4cc79cbe392373209db) C:\Programme\CA\eTrust Antivirus\InoRT.exe
13:50:31.0140 3424        InoRT ( UnsignedFile.Multi.Generic ) - warning
13:50:31.0140 3424        InoRT - detected UnsignedFile.Multi.Generic (1)
13:50:31.0187 3424        InoTask        (289d11b07c61f1e8f65312081b26ac6b) C:\Programme\CA\eTrust Antivirus\InoTask.exe
13:50:31.0203 3424        InoTask - ok
13:50:31.0234 3424        INO_FLPY        (4eb3cd8cd2210807ada276542eb99b06) E:\WINDOWS\system32\Drivers\ino_flpy.sys
13:50:31.0234 3424        INO_FLPY - ok
13:50:31.0250 3424        INO_FLTR        (ebfb9e788557aded04aef87247ae56dd) E:\WINDOWS\system32\Drivers\ino_fltr.sys
13:50:31.0265 3424        INO_FLTR - ok
13:50:31.0531 3424        IntcAzAudAddService (b29781b9a90cd55fc5d859c0b1c243bc) E:\WINDOWS\system32\drivers\RtkHDAud.sys
13:50:31.0906 3424        IntcAzAudAddService - ok
13:50:32.0000 3424        IntelIde - ok
13:50:32.0046 3424        intelppm        (4c7d2750158ed6e7ad642d97bffae351) E:\WINDOWS\system32\DRIVERS\intelppm.sys
13:50:32.0250 3424        intelppm - ok
13:50:32.0265 3424        Ip6Fw          (3bb22519a194418d5fec05d800a19ad0) E:\WINDOWS\system32\drivers\ip6fw.sys
13:50:32.0359 3424        Ip6Fw - ok
13:50:32.0375 3424        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) E:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
13:50:32.0484 3424        IpFilterDriver - ok
13:50:32.0515 3424        IpInIp          (b87ab476dcf76e72010632b5550955f5) E:\WINDOWS\system32\DRIVERS\ipinip.sys
13:50:32.0609 3424        IpInIp - ok
13:50:32.0640 3424        IpNat          (cc748ea12c6effde940ee98098bf96bb) E:\WINDOWS\system32\DRIVERS\ipnat.sys
13:50:32.0750 3424        IpNat - ok
13:50:32.0859 3424        iPod Service    (57edb35ea2feca88f8b17c0c095c9a56) E:\Programme\iPod\bin\iPodService.exe
13:50:32.0921 3424        iPod Service - ok
13:50:32.0968 3424        IPSec          (23c74d75e36e7158768dd63d92789a91) E:\WINDOWS\system32\DRIVERS\ipsec.sys
13:50:33.0078 3424        IPSec - ok
13:50:33.0109 3424        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) E:\WINDOWS\system32\DRIVERS\irenum.sys
13:50:33.0187 3424        IRENUM - ok
13:50:33.0218 3424        isapnp          (6dfb88f64135c525433e87648bda30de) E:\WINDOWS\system32\DRIVERS\isapnp.sys
13:50:33.0296 3424        isapnp - ok
13:50:33.0421 3424        ITMRTSVC        (b81e9de3f8b1d95f961660b4e548d081) E:\Programme\CA\SharedComponents\PPRealtime\bin\ITMRTSVC.exe
13:50:33.0453 3424        ITMRTSVC - ok
13:50:33.0468 3424        Kbdclass        (1704d8c4c8807b889e43c649b478a452) E:\WINDOWS\system32\DRIVERS\kbdclass.sys
13:50:33.0578 3424        Kbdclass - ok
13:50:33.0609 3424        kmixer          (692bcf44383d056aed41b045a323d378) E:\WINDOWS\system32\drivers\kmixer.sys
13:50:33.0687 3424        kmixer - ok
13:50:33.0734 3424        KSecDD          (b467646c54cc746128904e1654c750c1) E:\WINDOWS\system32\drivers\KSecDD.sys
13:50:33.0828 3424        KSecDD - ok
13:50:33.0859 3424        lanmanserver    (2bbdcb79900990f0716dfcb714e72de7) E:\WINDOWS\System32\srvsvc.dll
13:50:33.0953 3424        lanmanserver - ok
13:50:34.0000 3424        lanmanworkstation (1869b14b06b44b44af70548e1ea3303f) E:\WINDOWS\System32\wkssvc.dll
13:50:34.0062 3424        lanmanworkstation - ok
13:50:34.0078 3424        lbrtfdc - ok
13:50:34.0125 3424        LmHosts        (636714b7d43c8d0c80449123fd266920) E:\WINDOWS\System32\lmhsvc.dll
13:50:34.0312 3424        LmHosts - ok
13:50:34.0406 3424        LogWatch        (850a7a21661b97583914a430e9c2daea) E:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe
13:50:34.0421 3424        LogWatch ( UnsignedFile.Multi.Generic ) - warning
13:50:34.0421 3424        LogWatch - detected UnsignedFile.Multi.Generic (1)
13:50:34.0468 3424        MBAMProtector  (fb097bbc1a18f044bd17bd2fccf97865) E:\WINDOWS\system32\drivers\mbam.sys
13:50:34.0468 3424        MBAMProtector - ok
13:50:34.0593 3424        MBAMService    (ba400ed640bca1eae5c727ae17c10207) E:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
13:50:34.0640 3424        MBAMService - ok
13:50:34.0671 3424        Messenger      (b7550a7107281d170ce85524b1488c98) E:\WINDOWS\System32\msgsvc.dll
13:50:34.0781 3424        Messenger - ok
13:50:34.0812 3424        mnmdd          (4ae068242760a1fb6e1a44bf4e16afa6) E:\WINDOWS\system32\drivers\mnmdd.sys
13:50:34.0968 3424        mnmdd - ok
13:50:35.0031 3424        mnmsrvc        (c2f1d365fd96791b037ee504868065d3) E:\WINDOWS\system32\mnmsrvc.exe
13:50:35.0187 3424        mnmsrvc - ok
13:50:35.0187 3424        Modem          (6fb74ebd4ec57a6f1781de3852cc3362) E:\WINDOWS\system32\drivers\Modem.sys
13:50:35.0390 3424        Modem - ok
13:50:35.0421 3424        Mouclass        (b24ce8005deab254c0251e15cb71d802) E:\WINDOWS\system32\DRIVERS\mouclass.sys
13:50:35.0578 3424        Mouclass - ok
13:50:35.0625 3424        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) E:\WINDOWS\system32\drivers\MountMgr.sys
13:50:35.0781 3424        MountMgr - ok
13:50:35.0781 3424        mraid35x - ok
13:50:35.0796 3424        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) E:\WINDOWS\system32\DRIVERS\mrxdav.sys
13:50:35.0984 3424        MRxDAV - ok
13:50:36.0078 3424        MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) E:\WINDOWS\system32\DRIVERS\mrxsmb.sys
13:50:36.0187 3424        MRxSmb - ok
13:50:36.0234 3424        MSDTC          (35a031af38c55f92d28aa03ee9f12cc9) E:\WINDOWS\system32\msdtc.exe
13:50:36.0390 3424        MSDTC - ok
13:50:36.0468 3424        Msfs            (c941ea2454ba8350021d774daf0f1027) E:\WINDOWS\system32\drivers\Msfs.sys
13:50:36.0656 3424        Msfs - ok
13:50:36.0671 3424        MSIServer - ok
13:50:36.0718 3424        MSKSSRV        (d1575e71568f4d9e14ca56b7b0453bf1) E:\WINDOWS\system32\drivers\MSKSSRV.sys
13:50:36.0812 3424        MSKSSRV - ok
13:50:36.0828 3424        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) E:\WINDOWS\system32\drivers\MSPCLOCK.sys
13:50:36.0921 3424        MSPCLOCK - ok
13:50:36.0937 3424        MSPQM          (bad59648ba099da4a17680b39730cb3d) E:\WINDOWS\system32\drivers\MSPQM.sys
13:50:37.0031 3424        MSPQM - ok
13:50:37.0062 3424        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) E:\WINDOWS\system32\DRIVERS\mssmbios.sys
13:50:37.0140 3424        mssmbios - ok
13:50:37.0187 3424        Mup            (de6a75f5c270e756c5508d94b6cf68f5) E:\WINDOWS\system32\drivers\Mup.sys
13:50:37.0234 3424        Mup - ok
13:50:37.0281 3424        napagent        (46bb15ae2ac7d025d6d2567b876817bd) E:\WINDOWS\System32\qagentrt.dll
13:50:37.0390 3424        napagent - ok
13:50:37.0421 3424        NDIS            (1df7f42665c94b825322fae71721130d) E:\WINDOWS\system32\drivers\NDIS.sys
13:50:37.0531 3424        NDIS - ok
13:50:37.0578 3424        NdisTapi        (0109c4f3850dfbab279542515386ae22) E:\WINDOWS\system32\DRIVERS\ndistapi.sys
13:50:37.0625 3424        NdisTapi - ok
13:50:37.0656 3424        Ndisuio        (f927a4434c5028758a842943ef1a3849) E:\WINDOWS\system32\DRIVERS\ndisuio.sys
13:50:37.0765 3424        Ndisuio - ok
13:50:37.0828 3424        NdisWan        (edc1531a49c80614b2cfda43ca8659ab) E:\WINDOWS\system32\DRIVERS\ndiswan.sys
13:50:37.0984 3424        NdisWan - ok
13:50:38.0046 3424        NDProxy        (9282bd12dfb069d3889eb3fcc1000a9b) E:\WINDOWS\system32\drivers\NDProxy.sys
13:50:38.0109 3424        NDProxy - ok
13:50:38.0125 3424        NetBIOS        (5d81cf9a2f1a3a756b66cf684911cdf0) E:\WINDOWS\system32\DRIVERS\netbios.sys
13:50:38.0328 3424        NetBIOS - ok
13:50:38.0390 3424        NetBT          (74b2b2f5bea5e9a3dc021d685551bd3d) E:\WINDOWS\system32\DRIVERS\netbt.sys
13:50:38.0500 3424        NetBT - ok
13:50:38.0531 3424        NetDDE          (8ace4251bffd09ce75679fe940e996cc) E:\WINDOWS\system32\netdde.exe
13:50:38.0640 3424        NetDDE - ok
13:50:38.0656 3424        NetDDEdsdm      (8ace4251bffd09ce75679fe940e996cc) E:\WINDOWS\system32\netdde.exe
13:50:38.0734 3424        NetDDEdsdm - ok
13:50:38.0796 3424        Netlogon        (afb8261b56cba0d86aeb6df682af9785) E:\WINDOWS\system32\lsass.exe
13:50:38.0890 3424        Netlogon - ok
13:50:38.0921 3424        Netman          (e6d88f1f6745bf00b57e7855a2ab696c) E:\WINDOWS\System32\netman.dll
13:50:39.0062 3424        Netman - ok
13:50:39.0156 3424        NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) e:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
13:50:39.0171 3424        NetTcpPortSharing - ok
13:50:39.0281 3424        NETw3x32        (f43da6b7e26fff9ac4d3210f2f9b5d8c) E:\WINDOWS\system32\DRIVERS\NETw3x32.sys
13:50:39.0671 3424        NETw3x32 - ok
13:50:39.0765 3424        NIC1394        (e9e47cfb2d461fa0fc75b7a74c6383ea) E:\WINDOWS\system32\DRIVERS\nic1394.sys
13:50:39.0968 3424        NIC1394 - ok
13:50:40.0046 3424        Nla            (f1b67b6b0751ae0e6e964b02821206a3) E:\WINDOWS\System32\mswsock.dll
13:50:40.0093 3424        Nla - ok
13:50:40.0109 3424        Npfs            (3182d64ae053d6fb034f44b6def8034a) E:\WINDOWS\system32\drivers\Npfs.sys
13:50:40.0203 3424        Npfs - ok
13:50:40.0265 3424        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) E:\WINDOWS\system32\drivers\Ntfs.sys
13:50:40.0390 3424        Ntfs - ok
13:50:40.0421 3424        NtLmSsp        (afb8261b56cba0d86aeb6df682af9785) E:\WINDOWS\system32\lsass.exe
13:50:40.0500 3424        NtLmSsp - ok
13:50:40.0546 3424        NtmsSvc        (56af4064996fa5bac9c449b1514b4770) E:\WINDOWS\system32\ntmssvc.dll
13:50:40.0687 3424        NtmsSvc - ok
13:50:40.0750 3424        Null            (73c1e1f395918bc2c6dd67af7591a3ad) E:\WINDOWS\system32\drivers\Null.sys
13:50:40.0859 3424        Null - ok
13:50:41.0109 3424        nv              (f47a14b78a1ce58d5ff992f4e4de1374) E:\WINDOWS\system32\DRIVERS\nv4_mini.sys
13:50:41.0437 3424        nv - ok
13:50:41.0593 3424        NVSvc          (15a88de3c21bd1396281f353aeddceb1) E:\WINDOWS\system32\nvsvc32.exe
13:50:41.0625 3424        NVSvc - ok
13:50:41.0656 3424        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) E:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
13:50:41.0843 3424        NwlnkFlt - ok
13:50:41.0890 3424        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) E:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
13:50:42.0000 3424        NwlnkFwd - ok
13:50:42.0031 3424        ohci1394        (ca33832df41afb202ee7aeb05145922f) E:\WINDOWS\system32\DRIVERS\ohci1394.sys
13:50:42.0125 3424        ohci1394 - ok
13:50:42.0156 3424        Parport        (f84785660305b9b903fb3bca8ba29837) E:\WINDOWS\system32\drivers\Parport.sys
13:50:42.0265 3424        Parport - ok
13:50:42.0265 3424        PartMgr        (beb3ba25197665d82ec7065b724171c6) E:\WINDOWS\system32\drivers\PartMgr.sys
13:50:42.0343 3424        PartMgr - ok
13:50:42.0390 3424        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) E:\WINDOWS\system32\drivers\ParVdm.sys
13:50:42.0484 3424        ParVdm - ok
13:50:42.0484 3424        PCI            (387e8dedc343aa2d1efbc30580273acd) E:\WINDOWS\system32\DRIVERS\pci.sys
13:50:42.0593 3424        PCI - ok
13:50:42.0609 3424        PCIDump - ok
13:50:42.0609 3424        PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) E:\WINDOWS\system32\DRIVERS\pciide.sys
13:50:42.0718 3424        PCIIde - ok
13:50:42.0765 3424        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) E:\WINDOWS\system32\drivers\Pcmcia.sys
13:50:42.0859 3424        Pcmcia - ok
13:50:42.0875 3424        PDCOMP - ok
13:50:42.0875 3424        PDFRAME - ok
13:50:42.0875 3424        PDRELI - ok
13:50:42.0890 3424        PDRFRAME - ok
13:50:42.0890 3424        perc2 - ok
13:50:42.0906 3424        perc2hib - ok
13:50:42.0968 3424        PlugPlay        (a3edbe9053889fb24ab22492472b39dc) E:\WINDOWS\system32\services.exe
13:50:42.0984 3424        PlugPlay - ok
13:50:43.0015 3424        PolicyAgent    (afb8261b56cba0d86aeb6df682af9785) E:\WINDOWS\system32\lsass.exe
13:50:43.0093 3424        PolicyAgent - ok
13:50:43.0140 3424        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) E:\WINDOWS\system32\DRIVERS\raspptp.sys
13:50:43.0250 3424        PptpMiniport - ok
13:50:43.0250 3424        ProtectedStorage (afb8261b56cba0d86aeb6df682af9785) E:\WINDOWS\system32\lsass.exe
13:50:43.0359 3424        ProtectedStorage - ok
13:50:43.0359 3424        PSched          (09298ec810b07e5d582cb3a3f9255424) E:\WINDOWS\system32\DRIVERS\psched.sys
13:50:43.0484 3424        PSched - ok
13:50:43.0515 3424        Ptilink        (80d317bd1c3dbc5d4fe7b1678c60cadd) E:\WINDOWS\system32\DRIVERS\ptilink.sys
13:50:43.0640 3424        Ptilink - ok
13:50:43.0640 3424        ql1080 - ok
13:50:43.0656 3424        Ql10wnt - ok
13:50:43.0656 3424        ql12160 - ok
13:50:43.0671 3424        ql1240 - ok
13:50:43.0671 3424        ql1280 - ok
13:50:43.0718 3424        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) E:\WINDOWS\system32\DRIVERS\rasacd.sys
13:50:43.0843 3424        RasAcd - ok
13:50:43.0890 3424        RasAuto        (f5ba6caccdb66c8f048e867563203246) E:\WINDOWS\System32\rasauto.dll
13:50:44.0000 3424        RasAuto - ok
13:50:44.0031 3424        Rasl2tp        (11b4a627bc9614b885c4969bfa5ff8a6) E:\WINDOWS\system32\DRIVERS\rasl2tp.sys
13:50:44.0156 3424        Rasl2tp - ok
13:50:44.0265 3424        RasMan          (f9a7b66ea345726edb5862a46b1eccd5) E:\WINDOWS\System32\rasmans.dll
13:50:44.0390 3424        RasMan - ok
13:50:44.0390 3424        RasPppoe        (5bc962f2654137c9909c3d4603587dee) E:\WINDOWS\system32\DRIVERS\raspppoe.sys
13:50:44.0500 3424        RasPppoe - ok
13:50:44.0531 3424        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) E:\WINDOWS\system32\DRIVERS\raspti.sys
13:50:44.0625 3424        Raspti - ok
13:50:44.0640 3424        Rdbss          (7ad224ad1a1437fe28d89cf22b17780a) E:\WINDOWS\system32\DRIVERS\rdbss.sys
13:50:44.0765 3424        Rdbss - ok
13:50:44.0781 3424        RDPCDD          (4912d5b403614ce99c28420f75353332) E:\WINDOWS\system32\DRIVERS\RDPCDD.sys
13:50:44.0875 3424        RDPCDD - ok
13:50:44.0921 3424        rdpdr          (15cabd0f7c00c47c70124907916af3f1) E:\WINDOWS\system32\DRIVERS\rdpdr.sys
13:50:45.0031 3424        rdpdr - ok
13:50:45.0062 3424        RDPWD          (6589db6e5969f8eee594cf71171c5028) E:\WINDOWS\system32\drivers\RDPWD.sys
13:50:45.0125 3424        RDPWD - ok
13:50:45.0171 3424        RDSessMgr      (263af18af0f3db99f574c95f284ccec9) E:\WINDOWS\system32\sessmgr.exe
13:50:45.0265 3424        RDSessMgr - ok
13:50:45.0296 3424        redbook        (ed761d453856f795a7fe056e42c36365) E:\WINDOWS\system32\DRIVERS\redbook.sys
13:50:45.0390 3424        redbook - ok
13:50:45.0515 3424        RegSrvc        (38e771154092ed59bf1149e24e2a7dc3) E:\Programme\Intel\Wireless\Bin\RegSrvc.exe
13:50:45.0562 3424        RegSrvc ( UnsignedFile.Multi.Generic ) - warning
13:50:45.0562 3424        RegSrvc - detected UnsignedFile.Multi.Generic (1)
13:50:45.0593 3424        RemoteAccess    (0e97ec96d6942ceec2d188cc2eb69a01) E:\WINDOWS\System32\mprdim.dll
13:50:45.0765 3424        RemoteAccess - ok
13:50:45.0828 3424        RemoteRegistry  (e4cd1f3d84e1c2ca0b8cf7501e201593) E:\WINDOWS\system32\regsvc.dll
13:50:45.0937 3424        RemoteRegistry - ok
13:50:45.0968 3424        rimmptsk        (355aac141b214bef1dbc1483afd9bd50) E:\WINDOWS\system32\DRIVERS\rimmptsk.sys
13:50:45.0984 3424        rimmptsk - ok
13:50:46.0000 3424        rimsptsk        (a4216c71dd4f60b26418ccfd99cd0815) E:\WINDOWS\system32\DRIVERS\rimsptsk.sys
13:50:46.0015 3424        rimsptsk - ok
13:50:46.0031 3424        rismxdp        (c663af77e2f4eabf8eb08b388d2f1f36) E:\WINDOWS\system32\DRIVERS\rixdptsk.sys
13:50:46.0046 3424        rismxdp - ok
13:50:46.0078 3424        RpcLocator      (2a02e21867497df20b8fc95631395169) E:\WINDOWS\system32\locator.exe
13:50:46.0187 3424        RpcLocator - ok
13:50:46.0234 3424        RpcSs          (3127afbf2c1ed0ab14a1bbb7aaecb85b) E:\WINDOWS\system32\rpcss.dll
13:50:46.0250 3424        RpcSs - ok
13:50:46.0296 3424        RSVP            (4bdd71b4b521521499dfd14735c4f398) E:\WINDOWS\system32\rsvp.exe
13:50:46.0453 3424        RSVP - ok
13:50:46.0562 3424        S24EventMonitor (a6b39f6b755f118927ce7d17fb8fc1e2) E:\Programme\Intel\Wireless\Bin\S24EvMon.exe
13:50:46.0625 3424        S24EventMonitor ( UnsignedFile.Multi.Generic ) - warning
13:50:46.0625 3424        S24EventMonitor - detected UnsignedFile.Multi.Generic (1)
13:50:46.0656 3424        s24trans        (decee0d67d032b57c1f5ef649a67a967) E:\WINDOWS\system32\DRIVERS\s24trans.sys
13:50:46.0656 3424        s24trans ( UnsignedFile.Multi.Generic ) - warning
13:50:46.0656 3424        s24trans - detected UnsignedFile.Multi.Generic (1)
13:50:46.0703 3424        SamSs          (afb8261b56cba0d86aeb6df682af9785) E:\WINDOWS\system32\lsass.exe
13:50:46.0812 3424        SamSs - ok
13:50:46.0890 3424        SCardSvr        (dcec079fad95d36c8dd5cb6d779dfe32) E:\WINDOWS\System32\SCardSvr.exe
13:50:47.0046 3424        SCardSvr - ok
13:50:47.0125 3424        Schedule        (a050194a44d7fa8d7186ed2f4e8367ae) E:\WINDOWS\system32\schedsvc.dll
13:50:47.0281 3424        Schedule - ok
13:50:47.0312 3424        sdbus          (8d04819a3ce51b9eb47e5689b44d43c4) E:\WINDOWS\system32\DRIVERS\sdbus.sys
13:50:47.0484 3424        sdbus - ok
13:50:47.0609 3424        SeaPort        (271077b91d7ad1b616f8afdfe8e3f981) E:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
13:50:47.0656 3424        SeaPort - ok
13:50:47.0687 3424        Secdrv          (90a3935d05b494a5a39d37e71f09a677) E:\WINDOWS\system32\DRIVERS\secdrv.sys
13:50:47.0843 3424        Secdrv - ok
13:50:47.0890 3424        seclogon        (bee4cfd1d48c23b44cf4b974b0b79b2b) E:\WINDOWS\System32\seclogon.dll
13:50:48.0062 3424        seclogon - ok
13:50:48.0078 3424        SENS            (2aac9b6ed9eddffb721d6452e34d67e3) E:\WINDOWS\system32\sens.dll
13:50:48.0281 3424        SENS - ok
13:50:48.0296 3424        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) E:\WINDOWS\system32\drivers\Serial.sys
13:50:48.0406 3424        Serial - ok
13:50:48.0484 3424        sesvc          (4c99e251d89c95dcaaa26f9243747c99) E:\Programme\ShadowExplorer\sesvc.exe
13:50:48.0500 3424        sesvc ( UnsignedFile.Multi.Generic ) - warning
13:50:48.0500 3424        sesvc - detected UnsignedFile.Multi.Generic (1)
13:50:48.0515 3424        Sfloppy        (8e6b8c671615d126fdc553d1e2de5562) E:\WINDOWS\system32\DRIVERS\sfloppy.sys
13:50:48.0609 3424        Sfloppy - ok
13:50:48.0656 3424        SharedAccess    (cad058d5f8b889a87ca3eb3cf624dcef) E:\WINDOWS\System32\ipnathlp.dll
13:50:48.0781 3424        SharedAccess - ok
13:50:48.0812 3424        ShellHWDetection (2db7d303c36ddd055215052f118e8e75) E:\WINDOWS\System32\shsvcs.dll
13:50:48.0828 3424        ShellHWDetection - ok
13:50:48.0828 3424        Simbad - ok
13:50:48.0828 3424        Sparrow - ok
13:50:48.0843 3424        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) E:\WINDOWS\system32\drivers\splitter.sys
13:50:48.0953 3424        splitter - ok
13:50:48.0984 3424        Spooler        (60784f891563fb1b767f70117fc2428f) E:\WINDOWS\system32\spoolsv.exe
13:50:49.0031 3424        Spooler - ok
13:50:49.0078 3424        sr              (50fa898f8c032796d3b1b9951bb5a90f) E:\WINDOWS\system32\DRIVERS\sr.sys
13:50:49.0203 3424        sr - ok
13:50:49.0281 3424        srservice      (fe77a85495065f3ad59c5c65b6c54182) E:\WINDOWS\system32\srsvc.dll
13:50:49.0421 3424        srservice - ok
13:50:49.0500 3424        Srv            (47ddfc2f003f7f9f0592c6874962a2e7) E:\WINDOWS\system32\DRIVERS\srv.sys
13:50:49.0562 3424        Srv - ok
13:50:49.0625 3424        SSDPSRV        (4df5b05dfaec29e13e1ed6f6ee12c500) E:\WINDOWS\System32\ssdpsrv.dll
13:50:49.0796 3424        SSDPSRV - ok
13:50:49.0859 3424        stisvc          (bc2c5985611c5356b24aeb370953ded9) E:\WINDOWS\system32\wiaservc.dll
13:50:50.0078 3424        stisvc - ok
13:50:50.0109 3424        swenum          (3941d127aef12e93addf6fe6ee027e0f) E:\WINDOWS\system32\DRIVERS\swenum.sys
13:50:50.0296 3424        swenum - ok
13:50:50.0343 3424        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) E:\WINDOWS\system32\drivers\swmidi.sys
13:50:50.0421 3424        swmidi - ok
13:50:50.0437 3424        SwPrv - ok
13:50:50.0437 3424        symc810 - ok
13:50:50.0453 3424        symc8xx - ok
13:50:50.0453 3424        sym_hi - ok
13:50:50.0453 3424        sym_u3 - ok
13:50:50.0500 3424        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) E:\WINDOWS\system32\drivers\sysaudio.sys
13:50:50.0609 3424        sysaudio - ok
13:50:50.0640 3424        SysmonLog      (2903fffa2523926d6219428040dce6b9) E:\WINDOWS\system32\smlogsvc.exe
13:50:50.0734 3424        SysmonLog - ok
13:50:50.0781 3424        TapiSrv        (05903cac4b98908d55ea5774775b382e) E:\WINDOWS\System32\tapisrv.dll
13:50:50.0890 3424        TapiSrv - ok
13:50:50.0937 3424        Tcpip          (9aefa14bd6b182d61e3119fa5f436d3d) E:\WINDOWS\system32\DRIVERS\tcpip.sys
13:50:51.0000 3424        Tcpip - ok
13:50:51.0031 3424        TDPIPE          (6471a66807f5e104e4885f5b67349397) E:\WINDOWS\system32\drivers\TDPIPE.sys
13:50:51.0156 3424        TDPIPE - ok
13:50:51.0218 3424        TDTCP          (c56b6d0402371cf3700eb322ef3aaf61) E:\WINDOWS\system32\drivers\TDTCP.sys
13:50:51.0359 3424        TDTCP - ok
13:50:51.0437 3424        TermDD          (88155247177638048422893737429d9e) E:\WINDOWS\system32\DRIVERS\termdd.sys
13:50:51.0578 3424        TermDD - ok
13:50:51.0656 3424        TermService    (b7de02c863d8f5a005a7bf375375a6a4) E:\WINDOWS\System32\termsrv.dll
13:50:51.0843 3424        TermService - ok
13:50:51.0890 3424        Themes          (2db7d303c36ddd055215052f118e8e75) E:\WINDOWS\System32\shsvcs.dll
13:50:51.0906 3424        Themes - ok
13:50:51.0953 3424        TlntSvr        (03681a1ce77f51586903869a5ab1deab) E:\WINDOWS\system32\tlntsvr.exe
13:50:52.0109 3424        TlntSvr - ok
13:50:52.0109 3424        TosIde - ok
13:50:52.0203 3424        TrkWks          (626504572b175867f30f3215c04b3e2f) E:\WINDOWS\system32\trkwks.dll
13:50:52.0375 3424        TrkWks - ok
13:50:52.0421 3424        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) E:\WINDOWS\system32\drivers\Udfs.sys
13:50:52.0578 3424        Udfs - ok
13:50:52.0593 3424        ultra - ok
13:50:52.0671 3424        Update          (402ddc88356b1bac0ee3dd1580c76a31) E:\WINDOWS\system32\DRIVERS\update.sys
13:50:52.0859 3424        Update - ok
13:50:52.0921 3424        upnphost        (1dfd8975d8c89214b98d9387c1125b49) E:\WINDOWS\System32\upnphost.dll
13:50:53.0109 3424        upnphost - ok
13:50:53.0156 3424        UPS            (9b11e6118958e63e1fef129466e2bda7) E:\WINDOWS\System32\ups.exe
13:50:53.0343 3424        UPS - ok
13:50:53.0406 3424        USBAAPL        (eafe1e00739afe6c51487a050e772e17) E:\WINDOWS\system32\Drivers\usbaapl.sys
13:50:53.0453 3424        USBAAPL - ok
13:50:53.0484 3424        usbccgp        (173f317ce0db8e21322e71b7e60a27e8) E:\WINDOWS\system32\DRIVERS\usbccgp.sys
13:50:53.0562 3424        usbccgp - ok
13:50:53.0593 3424        usbehci        (65dcf09d0e37d4c6b11b5b0b76d470a7) E:\WINDOWS\system32\DRIVERS\usbehci.sys
13:50:53.0703 3424        usbehci - ok
13:50:53.0734 3424        usbhub          (1ab3cdde553b6e064d2e754efe20285c) E:\WINDOWS\system32\DRIVERS\usbhub.sys
13:50:53.0828 3424        usbhub - ok
13:50:53.0859 3424        usbscan        (a0b8cf9deb1184fbdd20784a58fa75d4) E:\WINDOWS\system32\DRIVERS\usbscan.sys
13:50:53.0984 3424        usbscan - ok
13:50:54.0000 3424        USBSTOR        (a32426d9b14a089eaa1d922e0c5801a9) E:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
13:50:54.0125 3424        USBSTOR - ok
13:50:54.0156 3424        usbuhci        (26496f9dee2d787fc3e61ad54821ffe6) E:\WINDOWS\system32\DRIVERS\usbuhci.sys
13:50:54.0250 3424        usbuhci - ok
13:50:54.0281 3424        VgaSave        (0d3a8fafceacd8b7625cd549757a7df1) E:\WINDOWS\System32\drivers\vga.sys
13:50:54.0390 3424        VgaSave - ok
13:50:54.0390 3424        ViaIde - ok
13:50:54.0453 3424        VolSnap        (a5a712f4e880874a477af790b5186e1d) E:\WINDOWS\system32\drivers\VolSnap.sys
13:50:54.0578 3424        VolSnap - ok
13:50:54.0609 3424        VSS            (68f106273be29e7b7ef8266977268e78) E:\WINDOWS\System32\vssvc.exe
13:50:54.0750 3424        VSS - ok
13:50:54.0781 3424        W32Time        (7b353059e665f8b7ad2bbeaef597cf45) E:\WINDOWS\system32\w32time.dll
13:50:54.0890 3424        W32Time - ok
13:50:54.0921 3424        Wanarp          (e20b95baedb550f32dd489265c1da1f6) E:\WINDOWS\system32\DRIVERS\wanarp.sys
13:50:55.0046 3424        Wanarp - ok
13:50:55.0046 3424        WDICA - ok
13:50:55.0093 3424        wdmaud          (6768acf64b18196494413695f0c3a00f) E:\WINDOWS\system32\drivers\wdmaud.sys
13:50:55.0250 3424        wdmaud - ok
13:50:55.0281 3424        WebClient      (81727c9873e3905a2ffc1ebd07265002) E:\WINDOWS\System32\webclnt.dll
13:50:55.0406 3424        WebClient - ok
13:50:55.0531 3424        winmgmt        (6f3f3973d97714cc5f906a19fe883729) E:\WINDOWS\system32\wbem\WMIsvc.dll
13:50:55.0671 3424        winmgmt - ok
13:50:55.0687 3424        wltrysvc - ok
13:50:55.0765 3424        WmdmPmSN        (c51b4a5c05a5475708e3c81c7765b71d) E:\WINDOWS\system32\MsPMSNSv.dll
13:50:55.0812 3424        WmdmPmSN - ok
13:50:55.0890 3424        Wmi            (ffa4d901d46d07a5bab2d8307fbb51a6) E:\WINDOWS\System32\advapi32.dll
13:50:55.0937 3424        Wmi - ok
13:50:55.0984 3424        WmiAcpi        (c42584fd66ce9e17403aebca199f7bdb) E:\WINDOWS\system32\DRIVERS\wmiacpi.sys
13:50:56.0156 3424        WmiAcpi - ok
13:50:56.0218 3424        WmiApSrv        (93908111ba57a6e60ec2fa2de202105c) E:\WINDOWS\system32\wbem\wmiapsrv.exe
13:50:56.0312 3424        WmiApSrv - ok
13:50:56.0453 3424        WMPNetworkSvc  (bf05650bb7df5e9ebdd25974e22403bb) E:\Programme\Windows Media Player\WMPNetwk.exe
13:50:56.0515 3424        WMPNetworkSvc - ok
13:50:56.0562 3424        wscsvc          (300b3e84faf1a5c1f791c159ba28035d) E:\WINDOWS\system32\wscsvc.dll
13:50:56.0640 3424        wscsvc - ok
13:50:56.0671 3424        wuauserv        (7b4fe05202aa6bf9f4dfd0e6a0d8a085) E:\WINDOWS\system32\wuauserv.dll
13:50:56.0812 3424        wuauserv - ok
13:50:56.0890 3424        WudfPf          (f15feafffbb3644ccc80c5da584e6311) E:\WINDOWS\system32\DRIVERS\WudfPf.sys
13:50:56.0921 3424        WudfPf - ok
13:50:56.0921 3424        WudfRd          (28b524262bce6de1f7ef9f510ba3985b) E:\WINDOWS\system32\DRIVERS\wudfrd.sys
13:50:56.0937 3424        WudfRd - ok
13:50:56.0953 3424        WudfSvc        (05231c04253c5bc30b26cbaae680ed89) E:\WINDOWS\System32\WUDFSvc.dll
13:50:56.0984 3424        WudfSvc - ok
13:50:57.0031 3424        WZCSVC          (c4f109c005f6725162d2d12ca751e4a7) E:\WINDOWS\System32\wzcsvc.dll
13:50:57.0187 3424        WZCSVC - ok
13:50:57.0265 3424        xmlprov        (0ada34871a2e1cd2caafed1237a47750) E:\WINDOWS\System32\xmlprov.dll
13:50:57.0406 3424        xmlprov - ok
13:50:57.0453 3424        MBR (0x1B8)    (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk0\DR0
13:50:58.0062 3424        \Device\Harddisk0\DR0 - ok
13:50:58.0062 3424        Boot (0x1200)  (1a11ef720f30c16be4abe60703aede4c) \Device\Harddisk0\DR0\Partition0
13:50:58.0062 3424        \Device\Harddisk0\DR0\Partition0 - ok
13:50:58.0109 3424        Boot (0x1200)  (484763ebf28d927bc8437af11627cf11) \Device\Harddisk0\DR0\Partition1
13:50:58.0109 3424        \Device\Harddisk0\DR0\Partition1 - ok
13:50:58.0109 3424        ============================================================
13:50:58.0109 3424        Scan finished
13:50:58.0109 3424        ============================================================
13:50:58.0218 3420        Detected object count: 13
13:50:58.0218 3420        Actual detected object count: 13
13:52:21.0906 3420        AegisP ( UnsignedFile.Multi.Generic ) - skipped by user
13:52:21.0906 3420        AegisP ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:52:21.0906 3420        CA_LIC_CLNT ( UnsignedFile.Multi.Generic ) - skipped by user
13:52:21.0906 3420        CA_LIC_CLNT ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:52:21.0921 3420        CA_LIC_SRVR ( UnsignedFile.Multi.Generic ) - skipped by user
13:52:21.0921 3420        CA_LIC_SRVR ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:52:21.0921 3420        EvtEng ( UnsignedFile.Multi.Generic ) - skipped by user
13:52:21.0921 3420        EvtEng ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:52:21.0921 3420        FingerprintServer ( UnsignedFile.Multi.Generic ) - skipped by user
13:52:21.0921 3420        FingerprintServer ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:52:21.0921 3420        iGateway ( UnsignedFile.Multi.Generic ) - skipped by user
13:52:21.0921 3420        iGateway ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:52:21.0921 3420        InoRPC ( UnsignedFile.Multi.Generic ) - skipped by user
13:52:21.0921 3420        InoRPC ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:52:21.0937 3420        InoRT ( UnsignedFile.Multi.Generic ) - skipped by user
13:52:21.0937 3420        InoRT ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:52:21.0937 3420        LogWatch ( UnsignedFile.Multi.Generic ) - skipped by user
13:52:21.0937 3420        LogWatch ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:52:21.0937 3420        RegSrvc ( UnsignedFile.Multi.Generic ) - skipped by user
13:52:21.0937 3420        RegSrvc ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:52:21.0937 3420        S24EventMonitor ( UnsignedFile.Multi.Generic ) - skipped by user
13:52:21.0937 3420        S24EventMonitor ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:52:21.0937 3420        s24trans ( UnsignedFile.Multi.Generic ) - skipped by user
13:52:21.0937 3420        s24trans ( UnsignedFile.Multi.Generic ) - User select action: Skip
13:52:21.0953 3420        sesvc ( UnsignedFile.Multi.Generic ) - skipped by user
13:52:21.0953 3420        sesvc ( UnsignedFile.Multi.Generic ) - User select action: Skip

cosinus 26.06.2012 13:40
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Totalbird 26.06.2012 15:27
Hallo Arne,

Combofix LOgfile anbei.

Combofix Logfile:
Code:
ComboFix 12-06-26.01 - Saskia 26.06.2012  17:11:46.1.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.2046.1350 [GMT 2:00]
ausgeführt von:: e:\dokumente und einstellungen\Saskia\Desktop\ComboFix.exe
AV: eTrust ITM *Disabled/Updated* {33EA71EA-56CF-40B5-A06B-BD3A27397C44}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
e:\dokumente und einstellungen\Saskia\Anwendungsdaten\PriceGong
e:\dokumente und einstellungen\Saskia\Anwendungsdaten\PriceGong\Data\alpeaDXsTlpealxVtU
e:\dokumente und einstellungen\Saskia\Anwendungsdaten\PriceGong\Data\AnyojLqEAnyEALq
e:\dokumente und einstellungen\Saskia\Anwendungsdaten\PriceGong\Data\DTyLOuVdsployvOrxds
e:\dokumente und einstellungen\Saskia\Anwendungsdaten\PriceGong\Data\EALqojLqoAnyEEAnqojnq
e:\dokumente und einstellungen\Saskia\Anwendungsdaten\PriceGong\Data\eJjqGgefAaNgEfJTsnD
e:\dokumente und einstellungen\Saskia\Anwendungsdaten\PriceGong\Data\ftUGVsUGnyojnqEALqEjn
e:\dokumente und einstellungen\Saskia\Anwendungsdaten\PriceGong\Data\jarnEVJTsLDQvjtrldyp
e:\dokumente und einstellungen\Saskia\Anwendungsdaten\PriceGong\Data\jLqoAnyEAnqojLvNQ
e:\dokumente und einstellungen\Saskia\Anwendungsdaten\PriceGong\Data\ofJTpGEsJAsNDUf
e:\dokumente und einstellungen\Saskia\Anwendungsdaten\PriceGong\Data\ojnyojLqEAnfsdxfsU
e:\dokumente und einstellungen\Saskia\Anwendungsdaten\PriceGong\Data\pnErvUsplELAuN
e:\dokumente und einstellungen\Saskia\Anwendungsdaten\PriceGong\Data\qEALqojnyojLqEuOvrQg
e:\dokumente und einstellungen\Saskia\Anwendungsdaten\PriceGong\Data\rQgvruOJNQOOvrQOJNu
e:\dokumente und einstellungen\Saskia\Anwendungsdaten\PriceGong\Data\tdGfsUGVtdxVtdOJrQg
e:\dokumente und einstellungen\Saskia\Anwendungsdaten\PriceGong\Data\teDUqXnJGleJjtNldqA
e:\dokumente und einstellungen\Saskia\Anwendungsdaten\PriceGong\Data\TNLUuXGoelQyxgsVjsXA
e:\dokumente und einstellungen\Saskia\Anwendungsdaten\PriceGong\Data\TsnjQrxUsDaqLguV
e:\dokumente und einstellungen\Saskia\Anwendungsdaten\PriceGong\Data\tXloqvgtGdepjoNJQfG
e:\dokumente und einstellungen\Saskia\Anwendungsdaten\PriceGong\Data\UGVtdxfsdxVtUAnyEjnyE
e:\dokumente und einstellungen\Saskia\Anwendungsdaten\PriceGong\Data\VDaqLONvdsployA
e:\dokumente und einstellungen\Saskia\Anwendungsdaten\PriceGong\Data\vrQgvrQOJNuOJnyE
e:\dokumente und einstellungen\Saskia\Anwendungsdaten\PriceGong\Data\VsUGVsdxftsalpeT
e:\dokumente und einstellungen\Saskia\Anwendungsdaten\PriceGong\Data\VtdxftdGVsUGDpsal
e:\dokumente und einstellungen\Saskia\Anwendungsdaten\PriceGong\Data\XeTDXsalpeaDXeugvrQOv
e:\dokumente und einstellungen\Saskia\Anwendungsdaten\PriceGong\Data\xfsUGJNQgvruOJNQ
e:\dokumente und einstellungen\Saskia\Anwendungsdaten\PriceGong\Data\yEALqEALyojnqouO
e:\dokumente und einstellungen\Saskia\Anwendungsdaten\PriceGong\Data\yJONxdepjorguVGDEqJ
e:\dokumente und einstellungen\Saskia\Anwendungsdaten\PriceGong\Data\yojnqoALqEjnyoTl
e:\windows\EventSystem.log
e:\windows\system32\dllcache\dlimport.exe
e:\windows\system32\dllcache\wmpvis.dll
e:\windows\system32\SET11D.tmp
e:\windows\system32\SET121.tmp
e:\windows\system32\SET129.tmp
e:\windows\system32\winsh324
e:\windows\system32\winsh325
.
Infizierte Kopie von e:\windows\system32\autochk.exe wurde gefunden und desinfiziert
Kopie von - e:\windows\ServicePackFiles\i386\autochk.exe wurde wiederhergestellt
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-05-26 bis 2012-06-26  ))))))))))))))))))))))))))))))
.
.
2012-06-21 13:59 . 2012-05-11 14:40        521728        -c----w-        e:\windows\system32\dllcache\jsdbgui.dll
2012-06-21 10:58 . 2012-06-21 11:01        --------        d-----w-        E:\Reparatur
2012-06-21 10:38 . 2008-04-14 02:22        26624        ----a-w-        e:\dokumente und einstellungen\LocalService\Anwendungsdaten\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2012-06-21 10:32 . 2012-06-21 10:32        --------        d-----w-        e:\dokumente und einstellungen\Saskia\Anwendungsdaten\www.shadowexplorer.com
2012-06-21 10:32 . 2012-06-21 10:32        --------        d-----w-        e:\programme\ShadowExplorer
2012-06-20 17:19 . 2011-07-13 02:55        2237440        ----a-r-        E:\OTLPE.exe
2012-06-20 17:19 . 2012-06-20 17:19        --------        d-----w-        E:\_OTL
2012-06-20 14:44 . 2012-06-20 14:44        --------        d-----w-        e:\programme\ESET
2012-06-20 14:30 . 2012-06-20 14:30        --------        d-----w-        E:\found.000
2012-06-02 08:34 . 2012-06-26 15:17        17408        ----a-w-        e:\windows\system32\rpcnetp.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-26 11:59 . 2010-08-26 08:57        44544        ----a-w-        e:\windows\system32\agremove.exe
2012-06-02 13:19 . 2009-08-06 17:24        18456        ----a-w-        e:\windows\system32\wuaueng.dll.mui
2012-06-02 13:19 . 2009-08-06 17:24        15896        ----a-w-        e:\windows\system32\wuapi.dll.mui
2012-06-02 13:19 . 2009-02-16 15:23        329240        ----a-w-        e:\windows\system32\wucltui.dll
2012-06-02 13:19 . 2009-02-16 15:23        210968        ----a-w-        e:\windows\system32\wuweb.dll
2012-06-02 13:19 . 2009-02-16 15:23        219160        ----a-w-        e:\windows\system32\wuaucpl.cpl
2012-06-02 13:19 . 2009-08-06 17:24        15896        ----a-w-        e:\windows\system32\wuaucpl.cpl.mui
2012-06-02 13:19 . 2009-02-16 15:23        53784        ----a-w-        e:\windows\system32\wuauclt.exe
2012-06-02 13:19 . 2004-08-04 12:00        97304        ----a-w-        e:\windows\system32\cdm.dll
2012-06-02 13:19 . 2009-08-06 17:24        23576        ----a-w-        e:\windows\system32\wucltui.dll.mui
2012-06-02 13:19 . 2009-02-16 15:23        577048        ----a-w-        e:\windows\system32\wuapi.dll
2012-06-02 13:19 . 2009-02-16 15:23        1933848        ----a-w-        e:\windows\system32\wuaueng.dll
2012-05-31 13:22 . 2004-08-04 12:00        604160        ----a-w-        e:\windows\system32\crypt32.dll
2012-05-16 15:07 . 2004-08-04 12:00        916992        ----a-w-        e:\windows\system32\wininet.dll
2012-05-15 13:56 . 2004-08-04 12:00        1863296        ----a-w-        e:\windows\system32\win32k.sys
2012-05-11 14:40 . 2004-08-04 12:00        43520        ----a-w-        e:\windows\system32\licmgr10.dll
2012-05-11 14:40 . 2004-08-04 12:00        1469440        ----a-w-        e:\windows\system32\inetcpl.cpl
2012-05-11 11:38 . 2004-08-04 12:00        385024        ----a-w-        e:\windows\system32\html.iec
2012-05-05 03:14 . 2004-08-04 12:00        2150912        ----a-w-        e:\windows\system32\ntoskrnl.exe
2012-05-05 03:14 . 2004-08-04 00:50        2029056        ----a-w-        e:\windows\system32\ntkrnlpa.exe
2012-05-02 13:46 . 2009-02-16 15:21        139656        ----a-w-        e:\windows\system32\drivers\rdpwd.sys
2012-04-04 13:56 . 2011-04-18 20:03        22344        ----a-w-        e:\windows\system32\drivers\mbam.sys
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2011-01-17 14:54        175912        ----a-w-        e:\programme\ConduitEngine\prxConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "e:\programme\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="e:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-09-30 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FingerPrintSoftware"="e:\programme\Lenovo Fingerprint Software\fpapp.exe \s" [X]
"Realtime Monitor"="c:\programme\CA\eTrust Antivirus\realmon.exe" [2008-02-08 407368]
"RTHDCPL"="RTHDCPL.EXE" [2007-01-30 16116224]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"AzMixerSel"="e:\programme\Realtek\InstallShield\AzMixerSel.exe" [2006-01-25 53248]
"NvCplDaemon"="e:\windows\system32\NvCpl.dll" [2007-03-21 7585792]
"nwiz"="nwiz.exe" [2007-03-21 1622016]
"Broadcom Wireless Manager UI"="e:\windows\system32\WLTRAY.exe" [2006-10-12 1282048]
"AGRSMMSG"="AGRSMMSG.exe" [2006-08-30 89542]
"QuickTime Task"="e:\programme\QuickTime\qttask.exe" [2010-08-10 421888]
"Adobe Reader Speed Launcher"="e:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-03 37296]
"Adobe ARM"="e:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"APSDaemon"="e:\programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
"iTunesHelper"="e:\programme\iTunes\iTunesHelper.exe" [2012-03-27 421736]
"ConnectionCenter"="e:\programme\Citrix\ICA Client\concentr.exe" [2009-09-12 103768]
"Malwarebytes' Anti-Malware"="e:\programme\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="e:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
e:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\
Microsoft Office.lnk - e:\programme\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ATFUS]
2007-02-27 16:26        131072        ----a-w-        e:\windows\system32\FpWinlogonNp.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"e:\\Programme\\Windows Live\\Messenger\\wlcsdk.exe"=
"e:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=
"e:\\Programme\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Programme\\CA\\eTrust Antivirus\\InoRpc.exe"=
"c:\\Programme\\CA\\eTrust Antivirus\\Realmon.exe"=
"c:\\Programme\\CA\\eTrust Antivirus\\Shellscn.exe"=
"e:\\Programme\\Gemeinsame Dateien\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"e:\\Programme\\Bonjour\\mDNSResponder.exe"=
"e:\\Programme\\iTunes\\iTunes.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
R1 ctxusbm;Citrix USB Monitor Driver;e:\windows\system32\drivers\ctxusbm.sys [08.09.2009 18:13 65584]
R2 FingerprintServer;Fingerprint Server;e:\windows\system32\FpLogonServ.exe [19.01.2007 16:16 61440]
R2 LogWatch;Event Log Watch;e:\programme\CA\SharedComponents\CA_LIC\LogWatNT.exe [20.09.2002 18:29 53248]
R2 MBAMService;MBAMService;e:\programme\Malwarebytes' Anti-Malware\mbamservice.exe [18.04.2011 22:03 654408]
R2 sesvc;ShadowExplorer Service;e:\programme\ShadowExplorer\sesvc.exe [21.06.2012 12:32 9216]
R3 MBAMProtector;MBAMProtector;e:\windows\system32\drivers\mbam.sys [18.04.2011 22:03 22344]
RUnknown rpcnetp;rpcnetp; [x]
S0 heypjtw;heypjtw;e:\windows\system32\drivers\tocul.sys --> e:\windows\system32\drivers\tocul.sys [?]
S2 gupdate;Google Update Service (gupdate);e:\programme\Google\Update\GoogleUpdate.exe [30.01.2010 21:32 135664]
S3 CA_LIC_CLNT;CA License Client;e:\programme\CA\SharedComponents\CA_LIC\lic98rmt.exe [20.09.2002 18:27 77824]
S3 CA_LIC_SRVR;CA License Server;e:\programme\CA\SharedComponents\CA_LIC\lic98rmtd.exe [20.09.2002 18:41 77824]
S3 gupdatem;Google Update-Dienst (gupdatem);e:\programme\Google\Update\GoogleUpdate.exe [30.01.2010 21:32 135664]
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - RPCNETP
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2012-04-01 e:\windows\Tasks\AppleSoftwareUpdate.job
- e:\programme\Apple Software Update\SoftwareUpdate.exe [2011-06-01 15:57]
.
2012-06-26 e:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- e:\programme\Google\Update\GoogleUpdate.exe [2010-01-30 19:32]
.
2012-06-26 e:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- e:\programme\Google\Update\GoogleUpdate.exe [2010-01-30 19:32]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uInternet Settings,ProxyOverride = *.local
IE: Nach Microsoft &Excel exportieren - e:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
Trusted Zone: unielektro.de\access
TCP: DhcpNameServer = 10.129.32.1 10.111.81.129
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{00000000-6E41-4FD3-8538-502F5495E5FC} - e:\programme\Ask.com\GenericAskToolbar.dll
URLSearchHooks-{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - e:\programme\softonic-de3\prxtbsof0.dll
URLSearchHooks-{f4e6547e-325b-403c-a3bb-ad29ed37a92f} - e:\programme\SearchElf_1.2\tbSea0.dll
BHO-{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - e:\programme\softonic-de3\prxtbsof0.dll
BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - e:\programme\Ask.com\GenericAskToolbar.dll
BHO-{f4e6547e-325b-403c-a3bb-ad29ed37a92f} - e:\programme\SearchElf_1.2\tbSea0.dll
Toolbar-{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - e:\programme\softonic-de3\prxtbsof0.dll
Toolbar-{f4e6547e-325b-403c-a3bb-ad29ed37a92f} - e:\programme\SearchElf_1.2\tbSea0.dll
Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - e:\programme\Ask.com\GenericAskToolbar.dll
WebBrowser-{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - e:\programme\softonic-de3\prxtbsof0.dll
WebBrowser-{F4E6547E-325B-403C-A3BB-AD29ED37A92F} - e:\programme\SearchElf_1.2\tbSea0.dll
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - e:\programme\Ask.com\GenericAskToolbar.dll
AddRemove-Broadcom 802.11b Network Adapter - e:\programme\Broadcom\Broadcom 802.11 Network Adapter\bcmwlu00.exe
AddRemove-CitrixOnlinePluginPackWeb - e:\dokumente und einstellungen\All Users\Anwendungsdaten\Citrix\Citrix Online Plug-in - Web\TrolleyExpress.exe
AddRemove-conduitEngine - e:\programme\ConduitEngine\ConduitEngineUninstall.exe
AddRemove-SearchElf_1.2 Toolbar - e:\progra~1\SEARCH~1.2\UNWISE.EXE
AddRemove-softonic-de3 Toolbar - e:\programme\softonic-de3\uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-06-26 17:18
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(960)
e:\windows\system32\FpWinLogonNp.dll
e:\programme\Lenovo Fingerprint Software\ATCSSINT.dll
e:\programme\Lenovo Fingerprint Software\SharedResources.dll
e:\programme\Lenovo Fingerprint Software\FPResource.dll
e:\programme\CA\SharedComponents\PPRealtime\bin\CACheck.dll
e:\programme\CA\SharedComponents\PPRealtime\bin\CAHook.dll
e:\programme\CA\SharedComponents\PPRealtime\bin\CAServer.dll
.
- - - - - - - > 'explorer.exe'(2536)
e:\programme\CA\SharedComponents\PPRealtime\bin\CACheck.dll
e:\programme\CA\SharedComponents\PPRealtime\bin\CAHook.dll
e:\programme\CA\SharedComponents\PPRealtime\bin\CAServer.dll
e:\windows\system32\webcheck.dll
e:\windows\system32\WPDShServiceObj.dll
e:\windows\system32\PortableDeviceTypes.dll
e:\windows\system32\PortableDeviceApi.dll
e:\windows\system32\xpsp3res.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
e:\programme\Intel\Wireless\Bin\EvtEng.exe
e:\programme\Intel\Wireless\Bin\S24EvMon.exe
e:\windows\System32\WLTRYSVC.EXE
e:\windows\System32\bcmwltry.exe
e:\programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
e:\programme\Bonjour\mDNSResponder.exe
e:\programme\CA\SharedComponents\iTechnology\igateway.exe
e:\programme\CA\SharedComponents\PPRealtime\bin\ITMRTSVC.exe
e:\windows\system32\nvsvc32.exe
e:\programme\Intel\Wireless\Bin\RegSrvc.exe
e:\windows\System32\rpcnetp.exe
e:\programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
e:\windows\RTHDCPL.EXE
e:\windows\AGRSMMSG.exe
e:\programme\Citrix\ICA Client\wfcrun32.exe
e:\programme\iPod\bin\iPodService.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-06-26  17:22:16 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-06-26 15:22
.
Vor Suchlauf: 8 Verzeichnis(se), 114.616.094.720 Bytes frei
Nach Suchlauf: 10 Verzeichnis(se), 115.362.717.696 Bytes frei
.
WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 2A3F341DBA3B55289674CD777C9AA34E
--- --- ---


Gruss T.

cosinus 26.06.2012 17:29
Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:
File::
e:\windows\system32\drivers\tocul.sys

Driver::
heypjtw
3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Totalbird 27.06.2012 13:48
Hallo Arne,

anbei das Log nach dem CF Scripten.Combofix Logfile:
Code:
ComboFix 12-06-26.02 - Saskia 27.06.2012  15:29:14.2.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.2046.1375 [GMT 2:00]
ausgeführt von:: e:\dokumente und einstellungen\Saskia\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: e:\dokumente und einstellungen\Saskia\Desktop\CFScript.txt
AV: eTrust ITM *Disabled/Updated* {33EA71EA-56CF-40B5-A06B-BD3A27397C44}
.
FILE ::
"e:\windows\system32\drivers\tocul.sys"
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
(((((((((((((((((((((((((((((((((((((((  Treiber/Dienste  )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_heypjtw
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-05-27 bis 2012-06-27  ))))))))))))))))))))))))))))))
.
.
2012-06-26 15:17 . 2012-06-27 13:35        17408        ----a-w-        e:\windows\system32\rpcnetp.exe
2012-06-21 13:59 . 2012-05-11 14:40        521728        -c----w-        e:\windows\system32\dllcache\jsdbgui.dll
2012-06-21 10:58 . 2012-06-21 11:01        --------        d-----w-        E:\Reparatur
2012-06-21 10:38 . 2008-04-14 02:22        26624        ----a-w-        e:\dokumente und einstellungen\LocalService\Anwendungsdaten\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2012-06-21 10:32 . 2012-06-21 10:32        --------        d-----w-        e:\dokumente und einstellungen\Saskia\Anwendungsdaten\www.shadowexplorer.com
2012-06-21 10:32 . 2012-06-21 10:32        --------        d-----w-        e:\programme\ShadowExplorer
2012-06-20 17:19 . 2011-07-13 02:55        2237440        ----a-r-        E:\OTLPE.exe
2012-06-20 17:19 . 2012-06-20 17:19        --------        d-----w-        E:\_OTL
2012-06-20 14:44 . 2012-06-20 14:44        --------        d-----w-        e:\programme\ESET
2012-06-20 14:30 . 2012-06-20 14:30        --------        d-----w-        E:\found.000
2012-06-02 08:34 . 2012-06-27 13:35        17408        ----a-w-        e:\windows\system32\rpcnetp.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-26 11:59 . 2010-08-26 08:57        44544        ----a-w-        e:\windows\system32\agremove.exe
2012-06-02 13:19 . 2009-08-06 17:24        18456        ----a-w-        e:\windows\system32\wuaueng.dll.mui
2012-06-02 13:19 . 2009-08-06 17:24        15896        ----a-w-        e:\windows\system32\wuapi.dll.mui
2012-06-02 13:19 . 2009-02-16 15:23        329240        ----a-w-        e:\windows\system32\wucltui.dll
2012-06-02 13:19 . 2009-02-16 15:23        210968        ----a-w-        e:\windows\system32\wuweb.dll
2012-06-02 13:19 . 2009-02-16 15:23        219160        ----a-w-        e:\windows\system32\wuaucpl.cpl
2012-06-02 13:19 . 2009-08-06 17:24        15896        ----a-w-        e:\windows\system32\wuaucpl.cpl.mui
2012-06-02 13:19 . 2009-02-16 15:23        53784        ----a-w-        e:\windows\system32\wuauclt.exe
2012-06-02 13:19 . 2004-08-04 12:00        97304        ----a-w-        e:\windows\system32\cdm.dll
2012-06-02 13:19 . 2009-08-06 17:24        23576        ----a-w-        e:\windows\system32\wucltui.dll.mui
2012-06-02 13:19 . 2009-02-16 15:23        577048        ----a-w-        e:\windows\system32\wuapi.dll
2012-06-02 13:19 . 2009-02-16 15:23        1933848        ----a-w-        e:\windows\system32\wuaueng.dll
2012-05-31 13:22 . 2004-08-04 12:00        604160        ----a-w-        e:\windows\system32\crypt32.dll
2012-05-16 15:07 . 2004-08-04 12:00        916992        ----a-w-        e:\windows\system32\wininet.dll
2012-05-15 13:56 . 2004-08-04 12:00        1863296        ----a-w-        e:\windows\system32\win32k.sys
2012-05-11 14:40 . 2004-08-04 12:00        43520        ----a-w-        e:\windows\system32\licmgr10.dll
2012-05-11 14:40 . 2004-08-04 12:00        1469440        ----a-w-        e:\windows\system32\inetcpl.cpl
2012-05-11 11:38 . 2004-08-04 12:00        385024        ----a-w-        e:\windows\system32\html.iec
2012-05-05 03:14 . 2004-08-04 12:00        2150912        ----a-w-        e:\windows\system32\ntoskrnl.exe
2012-05-05 03:14 . 2004-08-04 00:50        2029056        ----a-w-        e:\windows\system32\ntkrnlpa.exe
2012-05-02 13:46 . 2009-02-16 15:21        139656        ----a-w-        e:\windows\system32\drivers\rdpwd.sys
2012-04-04 13:56 . 2011-04-18 20:03        22344        ----a-w-        e:\windows\system32\drivers\mbam.sys
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2011-01-17 14:54        175912        ----a-w-        e:\programme\ConduitEngine\prxConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "e:\programme\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="e:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-09-30 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FingerPrintSoftware"="e:\programme\Lenovo Fingerprint Software\fpapp.exe \s" [X]
"Realtime Monitor"="c:\programme\CA\eTrust Antivirus\realmon.exe" [2008-02-08 407368]
"RTHDCPL"="RTHDCPL.EXE" [2007-01-30 16116224]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"AzMixerSel"="e:\programme\Realtek\InstallShield\AzMixerSel.exe" [2006-01-25 53248]
"NvCplDaemon"="e:\windows\system32\NvCpl.dll" [2007-03-21 7585792]
"nwiz"="nwiz.exe" [2007-03-21 1622016]
"Broadcom Wireless Manager UI"="e:\windows\system32\WLTRAY.exe" [2006-10-12 1282048]
"AGRSMMSG"="AGRSMMSG.exe" [2006-08-30 89542]
"QuickTime Task"="e:\programme\QuickTime\qttask.exe" [2010-08-10 421888]
"Adobe Reader Speed Launcher"="e:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-03 37296]
"Adobe ARM"="e:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
"APSDaemon"="e:\programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
"iTunesHelper"="e:\programme\iTunes\iTunesHelper.exe" [2012-03-27 421736]
"ConnectionCenter"="e:\programme\Citrix\ICA Client\concentr.exe" [2009-09-12 103768]
"Malwarebytes' Anti-Malware"="e:\programme\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="e:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
e:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\
Microsoft Office.lnk - e:\programme\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ATFUS]
2007-02-27 16:26        131072        ----a-w-        e:\windows\system32\FpWinlogonNp.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"e:\\Programme\\Windows Live\\Messenger\\wlcsdk.exe"=
"e:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=
"e:\\Programme\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Programme\\CA\\eTrust Antivirus\\InoRpc.exe"=
"c:\\Programme\\CA\\eTrust Antivirus\\Realmon.exe"=
"c:\\Programme\\CA\\eTrust Antivirus\\Shellscn.exe"=
"e:\\Programme\\Gemeinsame Dateien\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"e:\\Programme\\Bonjour\\mDNSResponder.exe"=
"e:\\Programme\\iTunes\\iTunes.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
R1 ctxusbm;Citrix USB Monitor Driver;e:\windows\system32\drivers\ctxusbm.sys [08.09.2009 18:13 65584]
R2 FingerprintServer;Fingerprint Server;e:\windows\system32\FpLogonServ.exe [19.01.2007 16:16 61440]
R2 LogWatch;Event Log Watch;e:\programme\CA\SharedComponents\CA_LIC\LogWatNT.exe [20.09.2002 18:29 53248]
R2 MBAMService;MBAMService;e:\programme\Malwarebytes' Anti-Malware\mbamservice.exe [18.04.2011 22:03 654408]
R2 sesvc;ShadowExplorer Service;e:\programme\ShadowExplorer\sesvc.exe [21.06.2012 12:32 9216]
R3 MBAMProtector;MBAMProtector;e:\windows\system32\drivers\mbam.sys [18.04.2011 22:03 22344]
RUnknown rpcnetp;rpcnetp; [x]
S2 gupdate;Google Update Service (gupdate);e:\programme\Google\Update\GoogleUpdate.exe [30.01.2010 21:32 135664]
S3 CA_LIC_CLNT;CA License Client;e:\programme\CA\SharedComponents\CA_LIC\lic98rmt.exe [20.09.2002 18:27 77824]
S3 CA_LIC_SRVR;CA License Server;e:\programme\CA\SharedComponents\CA_LIC\lic98rmtd.exe [20.09.2002 18:41 77824]
S3 gupdatem;Google Update-Dienst (gupdatem);e:\programme\Google\Update\GoogleUpdate.exe [30.01.2010 21:32 135664]
.
Inhalt des "geplante Tasks" Ordners
.
2012-04-01 e:\windows\Tasks\AppleSoftwareUpdate.job
- e:\programme\Apple Software Update\SoftwareUpdate.exe [2011-06-01 15:57]
.
2012-06-27 e:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- e:\programme\Google\Update\GoogleUpdate.exe [2010-01-30 19:32]
.
2012-06-27 e:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- e:\programme\Google\Update\GoogleUpdate.exe [2010-01-30 19:32]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uInternet Settings,ProxyOverride = *.local
IE: Nach Microsoft &Excel exportieren - e:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
Trusted Zone: unielektro.de\access
TCP: DhcpNameServer = 10.129.32.1 10.111.81.129
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-06-27 15:37
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(968)
e:\windows\system32\FpWinLogonNp.dll
e:\programme\Lenovo Fingerprint Software\ATCSSINT.dll
e:\programme\Lenovo Fingerprint Software\SharedResources.dll
e:\programme\Lenovo Fingerprint Software\FPResource.dll
e:\programme\CA\SharedComponents\PPRealtime\bin\CACheck.dll
e:\programme\CA\SharedComponents\PPRealtime\bin\CAHook.dll
e:\programme\CA\SharedComponents\PPRealtime\bin\CAServer.dll
.
- - - - - - - > 'explorer.exe'(3684)
e:\programme\CA\SharedComponents\PPRealtime\bin\CACheck.dll
e:\programme\CA\SharedComponents\PPRealtime\bin\CAHook.dll
e:\programme\CA\SharedComponents\PPRealtime\bin\CAServer.dll
e:\windows\system32\webcheck.dll
e:\windows\system32\WPDShServiceObj.dll
e:\windows\system32\PortableDeviceTypes.dll
e:\windows\system32\PortableDeviceApi.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
e:\programme\Intel\Wireless\Bin\EvtEng.exe
e:\programme\Intel\Wireless\Bin\S24EvMon.exe
e:\windows\System32\WLTRYSVC.EXE
e:\windows\System32\bcmwltry.exe
e:\programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
e:\programme\Bonjour\mDNSResponder.exe
e:\programme\CA\SharedComponents\iTechnology\igateway.exe
e:\programme\CA\SharedComponents\PPRealtime\bin\ITMRTSVC.exe
e:\windows\system32\nvsvc32.exe
e:\programme\Intel\Wireless\Bin\RegSrvc.exe
e:\windows\System32\rpcnetp.exe
e:\programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
e:\programme\Internet Explorer\IEXPLORE.EXE
e:\windows\RTHDCPL.EXE
e:\windows\AGRSMMSG.exe
e:\programme\Citrix\ICA Client\wfcrun32.exe
e:\programme\iPod\bin\iPodService.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-06-27  14:39:54 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-06-27 13:39
ComboFix2.txt  2012-06-26 15:22
.
Vor Suchlauf: 9 Verzeichnis(se), 115.462.168.576 Bytes frei
Nach Suchlauf: 10 Verzeichnis(se), 115.381.829.632 Bytes frei
.
- - End Of File - - 428AD6904EDF7E1088E374383C01B3F7
--- --- ---

cosinus 28.06.2012 09:33
Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).



Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

Totalbird 29.06.2012 11:42
Hi Arne,


anbei die gewünschten Logs.

OSAM LOG

OSAM Logfile:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 12:16:53 on 29.06.2012

OS: Windows XP Professional Service Pack 3 (Build 2600)
Default Browser: Microsoft Corporation Internet Explorer 8.00.6001.18702

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Boot Execute]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager )-----
"BootExecute" - "Microsoft Corporation" - E:\WINDOWS\system32\autochk.exe  (Data mismatch, rootkit activity | File found, but it contains no detailed information)

[Common]
-----( %SystemRoot%\Tasks )-----
"AppleSoftwareUpdate.job" - "Apple Inc." - E:\Programme\Apple Software Update\SoftwareUpdate.exe
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - E:\Programme\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - E:\Programme\Google\Update\GoogleUpdate.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"BCMWLCPL.CPL" - "Broadcom Corporation" - E:\WINDOWS\system32\BCMWLCPL.CPL
"infocardcpl.cpl" - "Microsoft Corporation" - E:\WINDOWS\system32\infocardcpl.cpl
"nvtuicpl.cpl" - "NVIDIA Corporation" - E:\WINDOWS\system32\nvtuicpl.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"QuickTime" - "Apple Inc." - E:\Programme\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"AEGIS Protocol (IEEE 802.1x) v3.6.0.0" (AegisP) - "Meetinghouse Data Communications" - E:\WINDOWS\System32\DRIVERS\AegisP.sys
"catchme" (catchme) - ? - E:\ComboFix\catchme.sys  (File not found)
"Changer" (Changer) - ? - E:\WINDOWS\system32\drivers\Changer.sys  (File not found)
"i2omgmt" (i2omgmt) - ? - E:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)
"INO_FLPY" (INO_FLPY) - "Computer Associates" - E:\WINDOWS\System32\Drivers\ino_flpy.sys
"INO_FLTR" (INO_FLTR) - "Computer Associates" - E:\WINDOWS\system32\Drivers\ino_fltr.sys
"lbrtfdc" (lbrtfdc) - ? - E:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)
"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - E:\WINDOWS\system32\drivers\mbam.sys
"PCIDump" (PCIDump) - ? - E:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)
"PDCOMP" (PDCOMP) - ? - E:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)
"PDFRAME" (PDFRAME) - ? - E:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)
"PDRELI" (PDRELI) - ? - E:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)
"PDRFRAME" (PDRFRAME) - ? - E:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)
"pwldypoc" (pwldypoc) - ? - E:\DOKUME~1\Saskia\LOKALE~1\Temp\pwldypoc.sys  (Hidden registry entry, rootkit activity | File not found)
"WDICA" (WDICA) - ? - E:\WINDOWS\system32\drivers\WDICA.sys  (File not found)
"WLAN-Transport" (s24trans) - "Intel Corporation" - E:\WINDOWS\System32\DRIVERS\s24trans.sys

[Explorer]
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - e:\WINDOWS\system32\Rundll32.exe e:\WINDOWS\system32\mscories.dll,Install
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - E:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - E:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - E:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - E:\WINDOWS\system32\mscoree.dll
-----( HKLM\Software\Classes\Protocols\Handler )-----
{3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - E:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - E:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - E:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - E:\Programme\Windows Live\Mail\mailcomm.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - E:\Programme\7-Zip\7-zip.dll
{0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - E:\Programme\Windows Live\Mail\mailcomm.dll
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? -  (File not found | COM-object registry key not found)
{1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer" - "NVIDIA Corporation" - E:\WINDOWS\system32\nvshell.dll
{1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu" - "NVIDIA Corporation" - E:\WINDOWS\system32\nvshell.dll
{DCED20BE-3645-11D4-BC95-00C04F0E0588} "InoShell" - "CA" - C:\Programme\CA\eTrust Antivirus\InoShell.dll
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - E:\Programme\iTunes\iTunesMiniPlayer.dll
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -  (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - E:\Programme\Microsoft Office\Office10\msohev.dll
{1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu" - "NVIDIA Corporation" - E:\WINDOWS\system32\nvshell.dll
{0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - E:\Programme\Microsoft Office\Office10\OLKFSTUB.DLL
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - e:\WINDOWS\system32\dfshim.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -  (File not found | COM-object registry key not found)
{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - e:\WINDOWS\system32\dfshim.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - E:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - E:\Programme\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - E:\Programme\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - E:\Programme\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - E:\Programme\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - E:\Programme\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - E:\Programme\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - E:\Programme\Windows Live\Photo Gallery\PhotoViewerShim.dll
{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - E:\Programme\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - E:\Programme\Windows Live\Toolbar\wltcore.dll
<binary data> "Google Toolbar" - "Google Inc." - E:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{7530BFB8-7293-4D34-9923-61A11451AFC5} "OnlineScanner Control" - "ESET" - E:\PROGRA~1\ESET\ESETON~1\ONLINE~1.OCX / hxxp://download.eset.com/special/eos/OnlineScanner.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - E:\WINDOWS\system32\Macromed\Flash\Flash10l.ocx / hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
{17492023-C23A-453E-A040-C7C580BBF700} "Windows Genuine Advantage Validation Tool" - "Microsoft Corporation" - E:\WINDOWS\system32\LegitCheckControl.DLL / hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
{E2883E8F-472F-4FB0-9522-AC9BF37916A7} "{E2883E8F-472F-4FB0-9522-AC9BF37916A7}" - ? -  (File not found | COM-object registry key not found) / hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{5F7B1267-94A9-47F5-98DB-E99415F33AEC} "In Blog veröffentlichen" - "Microsoft Corporation" - E:\Programme\Windows Live\Writer\WriterBrowserExtension.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - E:\Programme\Windows Live\Toolbar\wltcore.dll
{30F9B915-B755-4826-820B-08FBA6BD249D} "Conduit Engine " - "Conduit Ltd." - E:\Programme\ConduitEngine\prxConduitEngine.dll
<binary data> "Google Toolbar" - "Google Inc." - E:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - E:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{30F9B915-B755-4826-820B-08FBA6BD249D} "Conduit Engine " - "Conduit Ltd." - E:\Programme\ConduitEngine\prxConduitEngine.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - E:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - E:\Programme\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll
{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} "Search Helper" - "Microsoft Corporation" - E:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - E:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} "Windows Live Toolbar Helper" - "Microsoft Corporation" - E:\Programme\Windows Live\Toolbar\wltcore.dll
{5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? -  (File not found | COM-object registry key not found)

[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - E:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini
"Microsoft Office.lnk" - "Microsoft Corporation" - E:\Programme\Microsoft Office\Office10\OSA.EXE  (Shortcut exists | File exists)
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - E:\Dokumente und Einstellungen\Saskia\Startmenü\Programme\Autostart\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"swg" - "Google Inc." - "E:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce )-----
"FlashPlayerUpdate" - "Adobe Systems, Inc." - E:\WINDOWS\system32\Macromed\Flash\FlashUtil10l_ActiveX.exe -update activex
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe ARM" - "Adobe Systems Incorporated" - "E:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "E:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"APSDaemon" - "Apple Inc." - "E:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe"
"AzMixerSel" - "Realtek Semiconductor Corp." - E:\Programme\Realtek\InstallShield\AzMixerSel.exe
"Broadcom Wireless Manager UI" - "Broadcom Corporation" - E:\WINDOWS\system32\WLTRAY.exe
"ConnectionCenter" - "Citrix Systems, Inc." - "E:\Programme\Citrix\ICA Client\concentr.exe" /startup
"FingerPrintSoftware" - "Authentec,Inc" - "E:\Programme\Lenovo Fingerprint Software\fpapp.exe" \s
"iTunesHelper" - "Apple Inc." - "E:\Programme\iTunes\iTunesHelper.exe"
"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "E:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
"nwiz" - "NVIDIA Corporation" - nwiz.exe /install
"QuickTime Task" - "Apple Inc." - "E:\Programme\QuickTime\qttask.exe" -atboottime
"Realtime Monitor" - "CA" - "C:\Programme\CA\eTrust Antivirus\realmon.exe" -s

[Network Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order )-----
"Broadcom 802.11 Network Adapter Logon Provider" - "Broadcom Corporation" - E:\WINDOWS\System32\BCMLogon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - E:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - E:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - E:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
"Automatic Updates" (wuauserv) - ? - C:\WINDOWS\system32\wuauserv.dll  (File not found)
"Broadcom Wireless LAN Tray Service" (wltrysvc) - ? - E:\WINDOWS\System32\WLTRYSVC.EXE  (File found, but it contains no detailed information)
"CA License Client" (CA_LIC_CLNT) - "Computer Associates" - E:\Programme\CA\SharedComponents\CA_LIC\lic98rmt.exe
"CA License Server" (CA_LIC_SRVR) - "Computer Associates" - E:\Programme\CA\SharedComponents\CA_LIC\lic98rmtd.exe
"CA Pest Patrol Realtime Protection Service" (ITMRTSVC) - "CA, Inc." - E:\Programme\CA\SharedComponents\PPRealtime\bin\ITMRTSVC.exe
"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - E:\Programme\Bonjour\mDNSResponder.exe
"eTrust ITM-Echtzeitdienst" (InoRT) - "CA" - C:\Programme\CA\eTrust Antivirus\InoRT.exe
"eTrust ITM-Jobdienst" (InoTask) - "CA" - C:\Programme\CA\eTrust Antivirus\InoTask.exe
"eTrust ITM-RPC-Dienst" (InoRPC) - "CA" - C:\Programme\CA\eTrust Antivirus\InoRpc.exe
"Event Log Watch" (LogWatch) - "Computer Associates" - E:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe
"Fingerprint Server" (FingerprintServer) - "AuthenTec,Inc" - E:\WINDOWS\system32\FpLogonServ.exe
"Google Software Updater" (gusvc) - "Google" - E:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - E:\Programme\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - E:\Programme\Google\Update\GoogleUpdate.exe
"Intel(R) PROSet/Wireless Event Log" (EvtEng) - "Intel Corporation" - E:\Programme\Intel\Wireless\Bin\EvtEng.exe
"Intel(R) PROSet/Wireless Registry Service" (RegSrvc) - "Intel Corporation" - E:\Programme\Intel\Wireless\Bin\RegSrvc.exe
"Intel(R) PROSet/Wireless Service" (S24EventMonitor) - "Intel Corporation " - E:\Programme\Intel\Wireless\Bin\S24EvMon.exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - E:\Programme\iPod\bin\iPodService.exe
"iTechnology iGateway 4.2" (iGateway) - "CA, Inc." - E:\Programme\CA\SharedComponents\iTechnology\igateway.exe
"MBAMService" (MBAMService) - "Malwarebytes Corporation" - E:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
"SeaPort" (SeaPort) - "Microsoft Corporation" - E:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
"ShadowExplorer Service" (sesvc) - "www.shadowexplorer.com" - E:\Programme\ShadowExplorer\sesvc.exe
"Windows CardSpace" (idsvc) - "Microsoft Corporation" - e:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - e:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll  (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"ATFUS" - "AuthenTec,Inc" - E:\WINDOWS\system32\FpWinLogonNp.dll
"WgaLogon" - "Microsoft Corporation" - E:\WINDOWS\system32\WgaLogon.dll

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - E:\Programme\Bonjour\mdnsNSP.dll

===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru


GMER kommt als Anhang , da zu gross

aswMBR läuft noch

Totalbird 29.06.2012 12:20
Hi Arne,

das fehlende aswMBR Log.

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-06-29 12:29:26
-----------------------------
12:29:26.843 OS Version: Windows 5.1.2600 Service Pack 3
12:29:26.843 Number of processors: 2 586 0xF0D
12:29:26.859 ComputerName: SASKIAS UserName: Saskia
12:29:27.453 Initialize success
12:36:02.828 AVAST engine defs: 12062901
12:37:49.640 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-e
12:37:49.640 Disk 0 Vendor: ST9250827AS 3.CMF Size: 238475MB BusType: 3
12:37:49.718 Disk 0 MBR read successfully
12:37:49.718 Disk 0 MBR scan
12:37:49.765 Disk 0 Windows XP default MBR code
12:37:49.781 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 99998 MB offset 63
12:37:49.781 Disk 0 Partition - 00 0F Extended LBA 138466 MB offset 204796620
12:37:49.812 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 138466 MB offset 204796683
12:37:49.875 Disk 0 scanning sectors +488376000
12:37:50.015 Disk 0 scanning E:\WINDOWS\system32\drivers
12:38:21.078 Service scanning
12:38:34.812 Modules scanning
12:39:16.687 Disk 0 trace - called modules:
12:39:16.750 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
12:39:16.750 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x89b69ab8]
12:39:16.750 3 CLASSPNP.SYS[f7657fd7] -> nt!IofCallDriver -> \Device\0000006f[0x89b719e8]
12:39:16.750 5 ACPI.sys[f75ad620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-e[0x89b93d98]
12:39:17.203 AVAST engine scan E:\WINDOWS
12:40:32.953 AVAST engine scan E:\WINDOWS\system32
12:47:06.203 AVAST engine scan E:\WINDOWS\system32\drivers
12:48:07.578 AVAST engine scan E:\Dokumente und Einstellungen\Saskia
12:58:01.250 AVAST engine scan E:\Dokumente und Einstellungen\All Users
12:59:51.953 Scan finished successfully
13:19:31.218 Disk 0 MBR has been saved successfully to "E:\Dokumente und Einstellungen\Saskia\Desktop\MBR.dat"
13:19:31.218 The log file has been saved successfully to "E:\Dokumente und Einstellungen\Saskia\Desktop\aswMBR.txt"


Alle Zeitangaben in WEZ +1. Es ist jetzt 23:19 Uhr.
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19