Trojaner-Board - TR/TDss.adcr

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - TR/TDss.adcr (https://www.trojaner-board.de/73237-tr-tdss-adcr.html)

1.) Deinstalliere (falls möglich):

Fixwareout
Hotspot Shield 1.15
McAfee SecurityCenter (nie mehr als ein Antivirenprogramm einsetzen)
Spybot
SuperAntiSpyware

2.) How to uninstall or reinstall supported McAfee consumer products using the McAfee Consumer Products Removal tool (MCPR.exe)

3.) Scripten mit Combofix

Öffne den Editor (Start => Zubehör => Editor ) kopiere nun folgenden Text in das weiße Feld:

Code:

KILLALL::
 

Driver::

SASDIFSV

SASKUTIL

HssSrv

HssDrv

SASENUM

HssTrayService

mfehidk

MPFP

mfeavfk

mfebopk

mfesmfk

mbr

mferkdk

HotspotShieldService

mcmscsvc

McNASvc

McShield

MpfService

McSysmon

McProxy

HssTrayService

McODS
 

Registry::

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"mcagent_exe"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"=-

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=-

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MpfService]

[-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]

"EnableFirewall"=-

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{52556ED8-B928-40F7-B76D-C68EA6A214AC}"=-

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]

"EnableFirewall"=-

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]

"EnableFirewall"=-
 

Folder::

C:\ProgramData\Lavasoft

c:\programdata\SUPERAntiSpyware.com

c:\program files\SUPERAntiSpyware

c:\users\PDvaS\AppData\Roaming\SUPERAntiSpyware.com

c:\program files\Common Files\Wise Installation Wizard

c:\program files\Spybot - Search & Destroy

c:\programdata\Spybot - Search & Destroy

C:\fixwareout

C:\rsit

c:\program files\Hotspot Shield

c:\users\PDvaS\AppData\Roaming\Mozilla\Firefox\Profiles\wpnn7fzd.default\extensions\moveplayer@movenetworks.com

c:\program files\McAfee

c:\program files\McAfee.com

c:\program files\Common Files\McAfee

c:\programdata\McAfee
 

File::

c:\windows\Tasks\McQcTask.job

c:\windows\Tasks\McDefragTask.job

c:\windows\system32\perfc007.dat

c:\windows\system32\perfh007.dat

c:\windows\system32\drivers\Mpfp.sys

c:\users\PDvaS\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL

C:\aaw7boot.cmd

c:\users\PDvaS\AppData\Roaming\Mozilla\Firefox\Profiles\wpnn7fzd.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000006.dll
 

SysRst::

Speichere diese Datei nun auf dem Desktop unter -> cfscript.txt

Nun die Datei cfscript.txt mit der rechten Maustaste auf das Sysmbol von Combofix ziehen!

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

Danach das Combofix nochmal ausführen, das System neu starten und das Log von Combofix posten

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann.

ciao, andreas

Code:

ComboFix 09-05-23.01 - PDvaS 23.05.2009 20:25.3 - NTFSx86

Microsoft® Windows Vista™ Home Premium   6.0.6001.1.1252.49.1031.18.3294.2298 [GMT 2:00]

ausgeführt von:: c:\users\PDvaS\Desktop\ComboFix.exe

Benutzte Befehlsschalter :: c:\users\PDvaS\Desktop\cfscript.txt

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
 

FILE ::

C:\aaw7boot.cmd

c:\users\PDvaS\AppData\Roaming\Mozilla\Firefox\Profiles\wpnn7fzd.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000006.dll

c:\users\PDvaS\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL

c:\windows\system32\drivers\Mpfp.sys

c:\windows\system32\perfc007.dat

c:\windows\system32\perfh007.dat

c:\windows\Tasks\McDefragTask.job

c:\windows\Tasks\McQcTask.job

.
 

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.
 

C:\aaw7boot.cmd

c:\programdata\Lavasoft

c:\programdata\Spybot - Search & Destroy

c:\programdata\Spybot - Search & Destroy\Configuration.ini

c:\programdata\Spybot - Search & Destroy\Logs\Checks.090518-2149.log

c:\programdata\Spybot - Search & Destroy\Logs\Checks.090518-2208.txt

c:\programdata\Spybot - Search & Destroy\Logs\Fixes.090519-0428.txt

c:\programdata\Spybot - Search & Destroy\Logs\Resident.log

c:\programdata\Spybot - Search & Destroy\ProcCache.sbc

c:\programdata\SUPERAntiSpyware.com

C:\rsit

c:\rsit\info.txt

c:\rsit\log.txt

c:\users\PDvaS\AppData\Roaming\Mozilla\Firefox\Profiles\wpnn7fzd.default\extensions\moveplayer@movenetworks.com

c:\users\PDvaS\AppData\Roaming\Mozilla\Firefox\Profiles\wpnn7fzd.default\extensions\moveplayer@movenetworks.com\chrome.manifest

c:\users\PDvaS\AppData\Roaming\Mozilla\Firefox\Profiles\wpnn7fzd.default\extensions\moveplayer@movenetworks.com\components\nsIMNQMP.xpt

c:\users\PDvaS\AppData\Roaming\Mozilla\Firefox\Profiles\wpnn7fzd.default\extensions\moveplayer@movenetworks.com\install.rdf

c:\users\PDvaS\AppData\Roaming\Mozilla\Firefox\Profiles\wpnn7fzd.default\extensions\moveplayer@movenetworks.com\META-INF\manifest.mf

c:\users\PDvaS\AppData\Roaming\Mozilla\Firefox\Profiles\wpnn7fzd.default\extensions\moveplayer@movenetworks.com\META-INF\zigbert.rsa

c:\users\PDvaS\AppData\Roaming\Mozilla\Firefox\Profiles\wpnn7fzd.default\extensions\moveplayer@movenetworks.com\META-INF\zigbert.sf

c:\users\PDvaS\AppData\Roaming\Mozilla\Firefox\Profiles\wpnn7fzd.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000006.dll

c:\users\PDvaS\AppData\Roaming\SUPERAntiSpyware.com

c:\windows\system32\perfc007.dat

c:\windows\system32\perfh007.dat
 

.

(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))

.
 

-------\Legacy_MBR

-------\Legacy_MPFP

-------\Legacy_SASDIFSV

-------\Legacy_SASENUM

-------\Legacy_SASKUTIL

-------\Service_HssTrayService

-------\Service_mbr
 
 

(((((((((((((((((((((((   Dateien erstellt von 2009-04-23 bis 2009-05-23  ))))))))))))))))))))))))))))))

.
 

2009-05-23 18:28 . 2009-05-23 18:30        --------        d-----w        c:\users\PDvaS\AppData\Local\temp

2009-05-21 14:15 . 2009-05-06 09:06        4784464        ----a-w        c:\programdata\Microsoft\Windows Defender\Definition Updates\{AB279D11-682B-4925-9232-08CCAE23C2A4}\mpengine.dll

2009-05-18 19:48 . 2009-04-06 13:32        38496        ----a-w        c:\windows\system32\drivers\mbamswissarmy.sys

2009-05-18 19:47 . 2009-05-18 19:47        2967799        ----a-w        c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

2009-05-17 11:51 . 2009-05-17 11:51        --------        d-----w        c:\users\PDvaS\AppData\Roaming\Malwarebytes

2009-05-17 11:51 . 2009-05-17 11:51        --------        d-----w        c:\programdata\Malwarebytes

2009-05-17 11:51 . 2009-04-06 13:32        15504        ----a-w        c:\windows\system32\drivers\mbam.sys

2009-05-17 11:51 . 2009-05-19 09:33        --------        d-----w        c:\program files\Malwarebytes' Anti-Malware

2009-05-17 11:21 . 2009-05-17 17:56        --------        d-----w        c:\program files\trend micro

2009-05-05 11:42 . 2009-05-05 11:42        604416        ----a-w        c:\windows\system32\TUProgSt.exe

2009-05-05 11:42 . 2009-03-20 14:01        17152        ----a-w        c:\windows\system32\authuitu.dll

2009-05-05 11:42 . 2009-03-20 14:01        28416        ----a-w        c:\windows\system32\uxtuneup.dll

2009-05-05 11:42 . 2009-05-05 11:42        360704        ----a-w        c:\windows\system32\TuneUpDefragService.exe

2009-05-04 10:44 . 2009-05-04 10:44        --------        d-----w        c:\users\PDvaS\AppData\Roaming\vlc

2009-04-29 17:43 . 2009-04-29 17:43        680        ----a-w        c:\users\PDvaS\AppData\Local\d3d9caps.dat
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-05-23 18:29 . 2008-09-02 03:43        12        ----a-w        c:\windows\bthservsdp.dat

2009-05-19 18:20 . 2009-04-23 10:53        --------        d-----w        c:\program files\Tsunami-Filter-Pack

2009-05-18 17:04 . 2009-02-26 14:47        --------        d-----w        c:\program files\CCleaner

2009-05-13 20:26 . 2006-11-02 11:18        --------        d-----w        c:\program files\Windows Mail

2009-05-05 11:42 . 2009-02-26 14:58        --------        d-----w        c:\program files\TuneUp Utilities 2009

2009-04-27 16:25 . 2009-03-19 11:44        96104        ----a-w        c:\windows\system32\drivers\avipbb.sys

2009-04-27 16:25 . 2009-03-19 11:44        55640        ----a-w        c:\windows\system32\drivers\avgntflt.sys

2009-04-23 11:05 . 2009-04-23 11:05        --------        d-----w        c:\program files\VistaCodecPack

2009-04-23 11:04 . 2009-04-23 11:04        --------        d-----w        c:\programdata\VistaCodecs

2009-04-23 10:54 . 2009-04-23 10:54        --------        d-----w        c:\program files\VirtualDub

2009-04-23 10:54 . 2009-04-23 10:54        --------        d-----w        c:\program files\Avisynth

2009-04-23 10:53 . 2008-09-01 11:46        --------        d--h--w        c:\program files\InstallShield Installation Information

2009-04-17 11:27 . 2009-03-09 20:38        --------        d-----w        c:\program files\Common Files\AVSMedia

2009-04-17 11:27 . 2009-03-09 20:37        --------        d-----w        c:\program files\AVS4YOU

2009-04-06 01:18 . 2009-04-06 01:18        84480        ----a-w        c:\windows\system32\ff_vfw.dll

2009-04-04 08:44 . 2009-03-01 17:21        --------        d-----w        c:\program files\Free FLV Converter

2009-03-30 17:27 . 2009-03-01 17:57        --------        d-----w        c:\program files\Java

2009-03-29 23:57 . 2009-03-29 23:57        62149        ----a-w        c:\windows\system32\pthreadGC2.dll

2009-03-28 10:17 . 2009-02-26 10:53        126312        ----a-w        c:\users\PDvaS\AppData\Local\GDIPFONTCACHEV1.DAT

2009-03-28 10:17 . 2009-03-28 10:17        --------        d-----w        c:\users\PDvaS\AppData\Roaming\Corel

2009-03-28 10:14 . 2009-03-28 10:14        --------        d-----w        c:\program files\Common Files\Corel

2009-03-28 10:14 . 2008-09-01 11:50        --------        d-----w        c:\program files\Common Files\InstallShield

2009-03-28 10:13 . 2009-03-28 10:13        --------        d-----w        c:\program files\Corel

2009-03-27 20:29 . 2009-03-27 20:28        --------        d-----w        c:\program files\Microsoft Picture It! 10

2009-03-27 18:36 . 2009-03-01 17:21        290816        ----a-w        c:\windows\system32\TubeFinder.exe

2009-03-25 11:57 . 2009-03-25 11:10        --------        d-----w        c:\program files\EA Sports

2009-03-25 11:20 . 2009-03-25 11:20        --------        d-----w        c:\users\PDvaS\AppData\Roaming\Leadertech

2009-03-17 06:44 . 2009-03-15 09:09        343        ----a-w        c:\windows\system32\dmlg.dat

2009-03-17 03:38 . 2009-04-17 09:40        13824        ----a-w        c:\windows\system32\apilogen.dll

2009-03-17 03:38 . 2009-04-17 09:40        24064        ----a-w        c:\windows\system32\amxread.dll

2009-03-14 13:48 . 2009-03-14 13:48        2892        ----a-w        c:\windows\system32\audcon.sys

2009-03-12 21:51 . 2009-03-12 21:51        1080648        ----a-w        c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

2009-03-09 03:19 . 2009-03-01 17:57        410984        ----a-w        c:\windows\system32\deploytk.dll

2009-03-03 04:46 . 2009-04-17 09:41        3599328        ----a-w        c:\windows\system32\ntkrnlpa.exe

2009-03-03 04:46 . 2009-04-17 09:41        3547632        ----a-w        c:\windows\system32\ntoskrnl.exe

2009-03-03 04:40 . 2009-04-17 09:40        827392        ----a-w        c:\windows\system32\wininet.dll

2009-03-03 04:39 . 2009-04-17 09:41        183296        ----a-w        c:\windows\system32\sdohlp.dll

2009-03-03 04:39 . 2009-04-17 09:41        551424        ----a-w        c:\windows\system32\rpcss.dll

2009-03-03 04:39 . 2009-04-17 09:41        26112        ----a-w        c:\windows\system32\printfilterpipelineprxy.dll

2009-03-03 04:37 . 2009-04-17 09:40        78336        ----a-w        c:\windows\system32\ieencode.dll

2009-03-03 04:37 . 2009-04-17 09:41        98304        ----a-w        c:\windows\system32\iasrecst.dll

2009-03-03 04:37 . 2009-04-17 09:41        54784        ----a-w        c:\windows\system32\iasads.dll

2009-03-03 04:37 . 2009-04-17 09:41        44032        ----a-w        c:\windows\system32\iasdatastore.dll

2009-03-03 03:04 . 2009-04-17 09:41        666624        ----a-w        c:\windows\system32\printfilterpipelinesvc.exe

2009-03-03 02:38 . 2009-04-17 09:41        17408        ----a-w        c:\windows\system32\iashost.exe

2009-03-03 02:28 . 2009-04-17 09:40        26624        ----a-w        c:\windows\system32\ieUnatt.exe

2009-02-26 11:30 . 2009-02-26 11:30        0        ----a-w        c:\windows\nsreg.dat

.
 

(((((((((((((((((((((((((((((   SnapShot@2009-05-23_10.44.23   )))))))))))))))))))))))))))))))))))))))))

.

+ 2008-01-21 01:58 . 2009-05-23 18:20        44258              c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin

+ 2006-11-02 13:05 . 2009-05-23 18:20        80512              c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin

+ 2009-02-26 10:52 . 2009-05-23 18:20        10774              c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3603111667-3364242315-3715489446-1003_UserData.bin

- 2009-02-26 10:48 . 2009-05-23 10:40        32768              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

+ 2009-02-26 10:48 . 2009-05-23 18:06        32768              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

- 2009-02-26 10:48 . 2009-05-23 10:40        49152              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

+ 2009-02-26 10:48 . 2009-05-23 18:06        49152              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

+ 2009-02-26 10:48 . 2009-05-23 18:06        32768              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

- 2009-02-26 10:48 . 2009-05-23 10:40        32768              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

- 2006-11-02 10:33 . 2009-05-23 10:35        633886              c:\windows\System32\perfh009.dat

+ 2006-11-02 10:33 . 2009-05-23 18:24        633886              c:\windows\System32\perfh009.dat

+ 2006-11-02 10:33 . 2009-05-23 18:24        118772              c:\windows\System32\perfc009.dat

- 2006-11-02 10:33 . 2009-05-23 10:35        118772              c:\windows\System32\perfc009.dat

+ 2009-05-23 18:15 . 2009-05-23 18:15        262144              c:\windows\System32\config\TxR\NTUSER.DAT

+ 2009-05-23 18:15 . 2009-05-23 18:15        262144              c:\windows\System32\config\RegBack\NTUSER.DAT

+ 2009-05-23 18:15 . 2009-05-23 18:15        262144              c:\windows\System32\config\Journal\NTUSER.DAT

.

(((((((((((((((((((((((((((((((((((((((   System Restore   )))))))))))))))))))))))))))))))))))))))))))))))))))

.
 

c:\windiag\CheckALS.exe

13.05.2008 02:57 135168 \RP70\A0072035.exe
 

c:\windiag\record.exe

21.07.2008 02:43 102400 \RP70\A0072026.exe

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-10-26 1029416]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-07-08 6273568]
 

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-2-12 723496]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{1633AF2B-9328-4160-8B66-6430B6F351D3}"= c:\program files\CyberLink\PowerDVD\PowerDVD.EXE:CyberLink PowerDVD

"{0A0F4E71-824D-498C-BE09-43EF25998BAB}"= c:\program files\CyberLink\PowerDirector\PDR.EXE:CyberLink PowerDirector

"{A8774147-24CC-4B83-A493-BD4DFF50E236}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]

"c:\\Program Files\\FlashGet Network\\FlashGet universal\\FlashGet.exe"= c:\program files\FlashGet Network\FlashGet universal\FlashGet.exe:*:Enabled:Flashget2

"c:\\Program Files\\FlashGet Network\\FlashGet universal\\LiveUpdate.exe"= c:\program files\FlashGet Network\FlashGet universal\LiveUpdate.exe:*:Enabled:FGLiveUpdate

"c:\\Program Files\\FlashGet Network\\FlashGet universal\\LiveUpdateEx.exe"= c:\program files\FlashGet Network\FlashGet universal\LiveUpdateEx.exe:*:Enabled:FGLiveUpdateEx
 

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [19.03.2009 13:44 108289]

R2 KMDFMEMIO;SAMSUNG Kernel Driver;c:\windows\System32\drivers\KMDFMEMIO.sys [01.09.2008 14:07 13312]

R2 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [14.04.2006 03:07 28933976]

R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\System32\TUProgSt.exe [05.05.2009 13:42 604416]

R3 usbfilter;AMD USB Filter Driver;c:\windows\System32\drivers\usbfilter.sys [01.09.2008 13:46 22072]

R3 VMC302;Vimicro Camera Service VMC302;c:\windows\System32\drivers\vmc302.sys [01.09.2008 13:57 241664]

S3 SynasUSB;SynasUSB;c:\windows\System32\drivers\synasUSB.sys [14.03.2009 15:47 18432]

S3 TASCAM_US122144;TASCAM USB 2.0 Audio Device driver;c:\windows\System32\drivers\tascusb2.sys [14.03.2009 15:35 360448]

S3 TASCAM_US122L_MIDI;TASCAM US-122L WDM MIDI Device;c:\windows\System32\drivers\tscusb2m.sys [14.03.2009 15:35 18944]

S3 TASCAM_US122L_WDM;TASCAM US-122L WDM;c:\windows\System32\drivers\tscusb2a.sys [14.03.2009 15:35 33792]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bthsvcs        REG_MULTI_SZ           BthServ
 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs

UxTuneUp
 

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

"c:\program files\Common Files\LightScribe\LSRunOnce.exe"

.

Inhalt des "geplante Tasks" Ordners
 

2009-05-23 c:\windows\Tasks\1-Klick-Wartung.job

- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-03-20 14:17]
 

2009-05-23 c:\windows\Tasks\User_Feed_Synchronization-{8B38A101-D0BE-48FB-8E37-07E5DBD9AED5}.job

- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.jappy.de/

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

FF - ProfilePath - c:\users\PDvaS\AppData\Roaming\Mozilla\Firefox\Profiles\wpnn7fzd.default\

FF - prefs.js: browser.startup.homepage - w**.google.de

FF - prefs.js: network.proxy.type - 2

FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

FF - plugin: c:\program files\VistaCodecPack\rm\browser\plugins\nppl3260.dll

FF - plugin: c:\program files\VistaCodecPack\rm\browser\plugins\nprpjplug.dll
 

---- FIREFOX Richtlinien ----

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: nglayout.initialpaint.delay - 600

FF - user.js: content.notify.interval - 600000

FF - user.js: content.max.tokenizing.time - 1800000

FF - user.js: content.switch.threshold - 600000

.
 

**************************************************************************
 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-05-23 20:30

Windows 6.0.6001 Service Pack 1 NTFS
 

Scanne versteckte Prozesse... 
 

Scanne versteckte Autostarteinträge... 
 

Scanne versteckte Dateien... 
 

Scan erfolgreich abgeschlossen

versteckte Dateien: 0
 

**************************************************************************

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
 

- - - - - - - > 'Explorer.exe'(3380)

c:\windows\system32\btmmhook.dll

c:\windows\system32\btncopy.dll

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\windows\System32\Ati2evxx.exe

c:\windows\System32\audiodg.exe

c:\windows\System32\Ati2evxx.exe

c:\windows\System32\wlanext.exe

c:\program files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\program files\Common Files\LightScribe\LSSrvc.exe

c:\program files\CyberLink\Shared Files\RichVideo.exe

c:\windows\servicing\TrustedInstaller.exe

c:\windows\System32\conime.exe

c:\windows\ehome\ehmsas.exe

c:\program files\Synaptics\SynTP\SynTPHelper.exe

c:\windows\System32\wbem\WMIADAP.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2009-05-23 20:35 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2009-05-23 18:35

ComboFix2.txt  2009-05-23 10:45
 

Vor Suchlauf: 20 Verzeichnis(se), 96.765.689.856 Bytes frei

Nach Suchlauf: 19 Verzeichnis(se), 96.410.869.760 Bytes frei
 

249        --- E O F ---        2009-05-21 14:10

Ist es mir eigentlich gestattet, einige der Programme, die ich grade deinstalliert habe, wieder zu installieren? Weil ich SuperAntiSpyware für ziemlich nützlich empfunden habe.

Mfg PDvaS

Zitat:

Weil ich SuperAntiSpyware für ziemlich nützlich empfunden habe.

Kannst du natürlich machen, aber erst wenn wir fertig sind. Bei SuperAntiSpyware empfehle ich dir, den Wächter zu deaktivieren, der verursacht Probleme, ansonsten ist nichts gegen das Programm einzuwenden, ausser das es sämtliche Logs versaut.

1.) Start => Ausführen => combofix /u => OK

2.) GMER - Rootkit Detection

http://pic.leech.it/i/ab0bc/635985fgmer60.jpg

Lade Trallala von file-upload.net
Klick auf Download (rechts in der Mitte) und speichere es auf den Desktop
Doppelklick auf Trallala.exe
Drücke Scan, Der Vorgang kann je nach System 3 - 10min dauern
nach Beendigung des Scan, drücke "Copy"
nun kannst Du das Ergebnis hier einfügen. Sollte das Log zu lang sein, dann lade es bei einem Filehoster wie z.B. Materialordner hoch und poste den Link.
Sollte Gmer sagen "Gmer hasen´t found any System Modifikation", so hat Gmer keine Einträge gefunden.

3.) Kaspersky - Onlinescanner

Dieser Scanner entfernt die Funde nicht, gibt aber einen guten Überblick über die vorhandene Malware.

---> hier herunterladen => Kaspersky Lab: Anti-Virus, Internet Security, Mobile Security & Antiviren-Software und Services für Unternehmen
=> Hinweise zu älteren Versionen beachten!
=> Voraussetzung: Internet Explorer 6.0 oder höher
=> die nötigen ActiveX-Steuerelemente installieren => Update der Signaturen => Weiter
=> Scan-Einstellungen => Standard wählen => OK => Link "Arbeitsplatz" anklicken
=> Scan beginnt automatisch => Untersuchung wurde abgeschlossen => Protokoll speichern als
=> Dateityp auf .txt umstellen => auf dem Desktop als Kaspersky.txt speichern => Log hier posten
=> Deinstallation => Systemsteuerung => Software => Kaspersky Online Scanner entfernen

ciao, andreas

Code:

GMER 1.0.15.14966 - h**p://www.gmer.net

Rootkit scan 2009-05-23 22:13:21

Windows 6.0.6001 Service Pack 1
 
 

---- System - GMER 1.0.15 ----
 

SSDT            9A8C2F7C                                                                                            ZwCreateThread

SSDT            9A8C2F68                                                                                            ZwOpenProcess

SSDT            9A8C2F6D                                                                                            ZwOpenThread

SSDT            9A8C2F77                                                                                            ZwTerminateProcess
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text           ntkrnlpa.exe!KeSetTimerEx + 454                                                                     81EF5A18 4 Bytes  [7C, 2F, 8C, 9A]

.text           ntkrnlpa.exe!KeSetTimerEx + 624                                                                     81EF5BE8 4 Bytes  [68, 2F, 8C, 9A]

.text           ntkrnlpa.exe!KeSetTimerEx + 640                                                                     81EF5C04 4 Bytes  [6D, 2F, 8C, 9A]

.text           ntkrnlpa.exe!KeSetTimerEx + 854                                                                     81EF5E18 4 Bytes  [77, 2F, 8C, 9A]
 

---- User IAT/EAT - GMER 1.0.15 ----
 

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown]                [74A77BA4] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage]                 [74AB98C5] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI]             [74A7D3C8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode]       [74A6F527] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup]                 [74A77599] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC]              [74A6E43D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM]  [74AAB33D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream]     [74A7D68A] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight]             [74A7012E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth]              [74A70095] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage]               [74A671F3] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM]       [74AFD802] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile]          [74A975E1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics]             [74A6DAE1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree]                       [74A6668F] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc]                      [74A666BA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode]         [74A71E45] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
 

---- Devices - GMER 1.0.15 ----
 

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                             Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                             Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
 

---- Registry - GMER 1.0.15 ----
 

Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\002119301b8d                         

Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\002119301b8e                         

Reg             HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\002119301b8d                             

Reg             HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\002119301b8e                             
 

---- Files - GMER 1.0.15 ----
 

File            C:\Windows\System32\LogFiles\HTTPERR\httperr1.log                                                   (size mismatch) 1324/993 bytes

File            C:\Windows\System32\spool\SpoolerETW.etl                                                            (size mismatch) 4096/0 bytes
 

---- EOF - GMER 1.0.15 ----

Kaspersky log:

Datei Upload, Bilder hochladen, Datei Hosting auf Materialordner.de

Mfg PDvaS

Wie geht es dem Rechner? Noch irgendwelche Auffälligkeiten?

ciao, andreas

Den Rechner geht es eigentlich ziemlich gut. Auffäligkeiten gibt es auch nich mehr. War mit nur nich sicher ob das Problem auch wirklich komplett behoben ist und der Trojaner endgültig von meinem Rechner ist.

Mfg PDvaS

Dann bist du entlassen. :)

ciao, andreas

:lach::lach::lach:na super das freut mich.

Dann nochmal ein großes Dankeschön, an alle dir mir geholfen haben.

:dankeschoen: