Trojaner-Board
Seite 2 von 4 1 2 34
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Virus, den ich nicht finde. (https://www.trojaner-board.de/79572-virus-finde.html)

crippcid 20.11.2009 19:33
Jap. Dann hat das so gepasst, hab ich auf jeden Fall vorher ausgeführt

Angel21 20.11.2009 19:52
Hast du in C:\ die sys Datei drinne?

crippcid 20.11.2009 19:54
Die was hab ich in C:\ ? Du weisst doch vllt. noch vom letzten mal, dass ich mich nicht soooo top auskenne :P

Angel21 20.11.2009 19:57
Zitat:
C:\ViPrt.sys
Schau ma nach, ob Du dies findest unter C was in der Box vorhanden ist.

crippcid 20.11.2009 19:58
Ja genau. gefunden.

Angel21 20.11.2009 20:07
Da du Vista User bist: CCleaner und Combofix per Rechtsklick -> "Ausführen Als Administrator" starten.


ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Lade dir das Tool hier herunter auf den Desktop -> KLICK
Wichtig! Bitte die combofix.exe per Rechtsklick, "Ziel speichern unter" unter smss.exe abspeichern!
Besonders hartnäckige Malware erkennt eine combofix.exe und würde sich vor ihr gezielt verstecken!

Das Programm jedoch noch nicht starten sondern zuerst folgendes tun:
  • Schliesse alle Anwendungen und Programme, vor allem deine Antiviren-Software und andere Hintergrundwächter, sowie deinen Internetbrowser.
    Vermeide es auch explizit während das Combofix läuft die Maus und Tastatur zu benutzen.
  • Starte nun die in smss.exe umbenannte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen und lass dein System durchsuchen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte abkopieren und in deinen Beitrag einfügen. Das log findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.
Hinweis: Combofix verhindert die Autostart Funktion aller CD / DVD und USB - Laufwerken um so eine Verbeitung einzudämmen. Wenn es hierdurch zu Problemen kommt, diese im Thread posten.

Poste alle Logfiles bitte mit Codetags umschlossen (#-Button) also so:

HTML-Code:
[code] Hier das Logfile rein! [/code]

crippcid 20.11.2009 20:37
Code:
ComboFix 09-11-20.01 - PingChanGeR 20.11.2009 20:24.1.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6002.2.1252.49.1031.18.2046.1071 [GMT 1:00]
ausgeführt von:: c:\users\PingChanGeR\Desktop\ComboFix.exe
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
SP: AntiVir Desktop *enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
SP: Windows-Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2152478756-3922319563-605102323-500
c:\$recycle.bin\S-1-5-21-3063004517-2785690171-23646899-500
c:\windows\system32\drivers\pciide.sys

Infizierte Kopie von c:\windows\System32\drivers\ViPrt.sys wurde gefunden und desinfiziert
Kopie von - Kitty ate it :p wurde wiederhergestellt
.
(((((((((((((((((((((((  Dateien erstellt von 2009-10-20 bis 2009-11-20  ))))))))))))))))))))))))))))))
.

2009-11-20 19:13 . 2009-11-20 19:13        --------        d-----w-        c:\program files\CCleaner
2009-11-20 18:22 . 2007-03-26 13:26        52224        ----a-w-        C:\ViPrt.sys
2009-11-20 17:03 . 2009-11-20 17:03        --------        d-----w-        c:\program files\Razer
2009-11-20 17:03 . 2009-11-20 17:03        --------        d-----w-        c:\users\PingChanGeR\AppData\Roaming\InstallShield
2009-11-20 15:50 . 2009-11-20 15:50        4096        d-----w-        c:\program files\ICQ6Toolbar
2009-11-20 15:50 . 2009-11-20 15:50        --------        d-----w-        c:\programdata\ICQ
2009-11-19 18:42 . 2009-11-19 18:42        --------        d-----w-        c:\users\PingChanGeR\AppData\Roaming\Malwarebytes
2009-11-19 18:41 . 2009-09-10 13:54        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-19 18:41 . 2009-11-19 18:41        --------        d-----w-        c:\programdata\Malwarebytes
2009-11-19 18:41 . 2009-09-10 13:53        19160        ----a-w-        c:\windows\system32\drivers\mbam.sys
2009-11-19 18:41 . 2009-11-19 18:42        4096        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2009-11-19 17:54 . 2009-11-19 17:54        --------        d-----w-        c:\program files\Trend Micro
2009-11-17 23:22 . 2009-11-17 23:22        --------        d-----w-        c:\program files\Windows Portable Devices
2009-11-17 19:02 . 2009-10-01 01:02        30208        ----a-w-        c:\windows\system32\WPDShextAutoplay.exe
2009-11-17 19:02 . 2009-10-01 01:02        31232        ----a-w-        c:\windows\system32\BthMtpContextHandler.dll
2009-11-17 19:02 . 2009-10-01 01:01        81920        ----a-w-        c:\windows\system32\wpdbusenum.dll
2009-11-17 19:02 . 2009-10-01 01:01        60928        ----a-w-        c:\windows\system32\PortableDeviceConnectApi.dll
2009-11-17 19:02 . 2009-10-01 01:02        2537472        ----a-w-        c:\windows\system32\wpdshext.dll
2009-11-17 19:02 . 2009-10-01 01:02        334848        ----a-w-        c:\windows\system32\PortableDeviceApi.dll
2009-11-17 19:02 . 2009-10-01 01:02        87552        ----a-w-        c:\windows\system32\WPDShServiceObj.dll
2009-11-17 19:02 . 2009-10-01 01:01        546816        ----a-w-        c:\windows\system32\wpd_ci.dll
2009-11-17 19:02 . 2009-10-01 01:01        160256        ----a-w-        c:\windows\system32\PortableDeviceTypes.dll
2009-11-17 19:02 . 2009-10-01 01:01        350208        ----a-w-        c:\windows\system32\WPDSp.dll
2009-11-17 19:02 . 2009-10-01 01:01        196608        ----a-w-        c:\windows\system32\PortableDeviceWMDRM.dll
2009-11-17 19:02 . 2009-10-01 01:01        100864        ----a-w-        c:\windows\system32\PortableDeviceClassExtension.dll
2009-11-17 19:01 . 2009-10-08 21:08        555520        ----a-w-        c:\windows\system32\UIAutomationCore.dll
2009-11-17 19:01 . 2009-10-08 21:08        234496        ----a-w-        c:\windows\system32\oleacc.dll
2009-11-17 19:01 . 2009-10-08 21:07        4096        ----a-w-        c:\windows\system32\oleaccrc.dll
2009-11-11 12:16 . 2009-08-14 13:27        2036736        ----a-w-        c:\windows\system32\win32k.sys
2009-11-11 12:16 . 2009-08-10 12:35        355328        ----a-w-        c:\windows\system32\WSDApi.dll
2009-11-06 21:22 . 2009-11-14 06:34        4096        d-----w-        c:\users\PingChanGeR\AppData\Local\WarRockDF
2009-11-06 20:38 . 2009-11-06 20:38        --------        d-----w-        c:\users\PingChanGeR\Program Files
2009-11-06 20:12 . 2009-11-06 20:12        --------        d-----w-        c:\users\PingChanGeR\AppData\Local\DNA
2009-11-06 20:12 . 2009-11-20 19:23        4096        d-----w-        c:\users\PingChanGeR\AppData\Roaming\DNA
2009-11-06 20:12 . 2009-11-06 20:12        --------        d-----w-        c:\program files\DNA
2009-11-06 20:12 . 2009-11-18 11:58        --------        d-----w-        c:\program files\GamersFirst
2009-11-04 15:59 . 2009-10-30 13:34        29512        ----a-w-        c:\windows\system32\TURegOpt.exe
2009-11-04 15:59 . 2009-10-30 13:27        21320        ----a-w-        c:\windows\system32\authuitu.dll
2009-11-04 15:59 . 2009-10-30 13:27        30024        ----a-w-        c:\windows\system32\uxtuneup.dll
2009-11-04 15:58 . 2009-11-04 15:58        --------        d-----w-        c:\users\PingChanGeR\AppData\Roaming\TuneUp Software
2009-11-04 15:58 . 2009-11-04 15:59        49152        d-----w-        c:\program files\TuneUp Utilities 2010
2009-11-04 15:58 . 2009-11-04 15:58        --------        d-----w-        c:\programdata\TuneUp Software
2009-11-04 15:57 . 2009-11-04 15:57        --------        d-sh--w-        c:\programdata\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2009-11-03 15:12 . 2009-11-03 23:39        --------        d-----w-        c:\users\PingChanGeR\AppData\Roaming\Xfire
2009-11-03 15:12 . 2009-11-03 15:14        4096        d-----w-        c:\programdata\Xfire
2009-11-03 15:12 . 2009-11-03 15:12        8192        d-----w-        c:\program files\Xfire
2009-10-28 12:20 . 2009-09-10 14:58        310784        ----a-w-        c:\windows\system32\unregmp2.exe
2009-10-28 12:20 . 2009-09-10 14:59        8147456        ----a-w-        c:\windows\system32\wmploc.DLL
2009-10-21 19:42 . 2009-11-02 21:13        --------        d-----w-        c:\program files\Common Files\Steam
2009-10-21 19:42 . 2009-11-06 00:57        8192        d-----w-        c:\program files\Steam

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-20 19:30 . 2006-11-02 15:33        618204        ----a-w-        c:\windows\system32\perfh007.dat
2009-11-20 19:30 . 2006-11-02 15:33        122442        ----a-w-        c:\windows\system32\perfc007.dat
2009-11-20 18:24 . 2009-09-15 18:17        4096        d-----w-        c:\users\PingChanGeR\AppData\Roaming\Skype
2009-11-20 18:12 . 2009-09-15 18:18        4096        d-----w-        c:\users\PingChanGeR\AppData\Roaming\skypePM
2009-11-20 17:03 . 2007-10-16 20:42        4096        d--h--w-        c:\program files\InstallShield Installation Information
2009-11-17 23:22 . 2006-11-02 10:25        665600        ----a-w-        c:\windows\inf\drvindex.dat
2009-11-17 23:22 . 2009-11-17 23:22        0        ---ha-w-        c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2009-11-12 16:48 . 2006-11-02 11:18        4096        d-----w-        c:\program files\Windows Mail
2009-11-09 17:11 . 2009-09-30 12:10        --------        d-----w-        c:\program files\Java
2009-11-04 15:59 . 2006-11-02 12:37        4096        d-----w-        c:\program files\Windows Sidebar
2009-11-02 19:42 . 2009-10-02 23:56        195456        ------w-        c:\windows\system32\MpSigStub.exe
2009-10-17 00:26 . 2009-09-21 13:37        4096        d-----w-        c:\users\PingChanGeR\AppData\Roaming\Winamp
2009-10-15 00:01 . 2009-10-15 00:01        41872        ----a-w-        c:\windows\system32\xfcodec.dll
2009-10-13 11:48 . 2009-09-16 13:51        4096        d-----w-        c:\users\PingChanGeR\AppData\Roaming\teamspeak2
2009-10-11 13:49 . 2009-10-11 13:49        --------        d-----w-        c:\programdata\Blizzard Entertainment
2009-10-11 03:17 . 2009-09-30 12:10        411368        ----a-w-        c:\windows\system32\deploytk.dll
2009-10-08 12:19 . 2009-10-08 12:19        --------        d-----w-        c:\programdata\WindowsSearch
2009-10-07 14:09 . 2009-09-30 14:28        1        ----a-w-        c:\users\PingChanGeR\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-10-04 16:01 . 2009-10-04 16:01        --------        d-----w-        c:\program files\Electronic Arts
2009-10-02 15:42 . 2009-10-02 15:42        --------        d-----w-        c:\users\PingChanGeR\AppData\Roaming\gtk-2.0
2009-10-02 15:39 . 2009-10-02 15:39        --------        d-----w-        c:\program files\GIMP-2.0
2009-10-01 03:22 . 2009-09-15 19:30        4096        d-----w-        c:\program files\Common Files\Blizzard Entertainment
2009-09-30 19:30 . 2009-09-15 17:22        66904        ----a-w-        c:\users\PingChanGeR\AppData\Local\GDIPFONTCACHEV1.DAT
2009-09-30 14:27 . 2009-09-30 14:27        --------        d-----w-        c:\users\PingChanGeR\AppData\Roaming\OpenOffice.org
2009-09-30 12:14 . 2009-09-30 12:14        7424000        ----a-r-        c:\users\PingChanGeR\AppData\Roaming\Microsoft\Installer\{99E862CC-6F69-4D39-99AA-DBF71BF3B585}\soffice.exe
2009-09-30 12:12 . 2009-09-30 12:12        --------        d-----w-        c:\program files\JRE
2009-09-30 12:12 . 2009-09-30 12:11        4096        d-----w-        c:\program files\OpenOffice.org 3
2009-09-27 20:04 . 2009-09-27 20:04        --------        d-----w-        c:\program files\Microsoft
2009-09-27 20:03 . 2009-09-27 20:03        --------        d-----w-        c:\program files\Windows Live
2009-09-27 20:03 . 2009-09-27 20:03        --------        d-----w-        c:\program files\Windows Live SkyDrive
2009-09-27 20:01 . 2009-09-27 20:01        --------        d-----w-        c:\program files\Common Files\Windows Live
2009-09-26 19:52 . 2009-09-17 15:44        4096        d-----w-        c:\program files\Winamp
2009-09-26 19:52 . 2009-09-26 19:52        4096        d-----w-        c:\program files\SHOUTcast Radio Toolbar
2009-09-26 19:52 . 2009-09-26 19:52        --------        d-----w-        c:\programdata\SHOUTcast Radio Toolbar
2009-09-25 23:38 . 2009-09-20 16:49        4096        d-----w-        c:\users\PingChanGeR\AppData\Roaming\Hamachi
2009-09-25 02:10 . 2009-11-17 19:03        974848        ----a-w-        c:\windows\system32\WindowsCodecs.dll
2009-09-25 02:07 . 2009-11-17 19:03        189440        ----a-w-        c:\windows\system32\WindowsCodecsExt.dll
2009-09-25 02:04 . 2009-11-17 19:03        321024        ----a-w-        c:\windows\system32\PhotoMetadataHandler.dll
2009-09-25 01:49 . 2009-11-17 19:03        1554432        ----a-w-        c:\windows\system32\xpsservices.dll
2009-09-25 01:48 . 2009-11-17 19:03        351232        ----a-w-        c:\windows\system32\XpsPrint.dll
2009-09-25 01:38 . 2009-11-17 19:03        847360        ----a-w-        c:\windows\system32\OpcServices.dll
2009-09-25 01:36 . 2009-11-17 19:03        280064        ----a-w-        c:\windows\system32\XpsGdiConverter.dll
2009-09-25 01:35 . 2009-11-17 19:03        135680        ----a-w-        c:\windows\system32\XpsRasterService.dll
2009-09-25 01:33 . 2009-11-17 19:03        195584        ----a-w-        c:\windows\system32\dxdiagn.dll
2009-09-25 01:33 . 2009-11-17 19:03        829440        ----a-w-        c:\windows\system32\d3d10warp.dll
2009-09-25 01:33 . 2009-11-17 19:03        369664        ----a-w-        c:\windows\system32\WMPhoto.dll
2009-09-25 01:32 . 2009-11-17 19:03        252928        ----a-w-        c:\windows\system32\dxdiag.exe
2009-09-25 01:31 . 2009-11-17 19:03        519680        ----a-w-        c:\windows\system32\d3d11.dll
2009-09-25 01:31 . 2009-11-17 19:03        486912        ----a-w-        c:\windows\system32\d3d10level9.dll
2009-09-25 01:31 . 2009-11-17 19:03        161280        ----a-w-        c:\windows\system32\d3d10_1.dll
2009-09-25 01:31 . 2009-11-17 19:03        218112        ----a-w-        c:\windows\system32\d3d10_1core.dll
2009-09-25 01:31 . 2009-11-17 19:03        1030144        ----a-w-        c:\windows\system32\d3d10.dll
2009-09-25 01:31 . 2009-11-17 19:03        828928        ----a-w-        c:\windows\system32\d2d1.dll
2009-09-25 01:30 . 2009-11-17 19:03        481792        ----a-w-        c:\windows\system32\dxgi.dll
2009-09-25 01:30 . 2009-11-17 19:03        190464        ----a-w-        c:\windows\system32\d3d10core.dll
2009-09-25 01:27 . 2009-11-17 19:03        634880        ----a-w-        c:\windows\system32\drivers\dxgkrnl.sys
2009-09-25 01:27 . 2009-11-17 19:03        37888        ----a-w-        c:\windows\system32\cdd.dll
2009-09-25 01:27 . 2009-11-17 19:03        793088        ----a-w-        c:\windows\system32\FntCache.dll
2009-09-25 01:27 . 2009-11-17 19:03        1064448        ----a-w-        c:\windows\system32\DWrite.dll
2009-09-24 22:54 . 2009-11-17 19:03        258048        ----a-w-        c:\windows\system32\winspool.drv
2009-09-24 22:54 . 2009-11-17 19:03        667648        ----a-w-        c:\windows\system32\printfilterpipelinesvc.exe
2009-09-24 22:54 . 2009-11-17 19:03        26112        ----a-w-        c:\windows\system32\printfilterpipelineprxy.dll
2009-09-23 16:40 . 2009-09-23 16:40        4096        d-----w-        c:\programdata\EPSON
2009-09-23 16:35 . 2009-09-23 16:35        --------        d-----w-        c:\program files\epson
2009-09-23 15:42 . 2009-09-23 15:40        12288        d-----w-        c:\program files\ICQ6.5
2009-09-23 15:42 . 2009-09-15 18:49        --------        d-----w-        c:\users\PingChanGeR\AppData\Roaming\ICQ
2009-09-22 20:19 . 2009-09-15 17:54        --------        d-----w-        c:\users\PingChanGeR\AppData\Roaming\TeamViewer
2009-09-20 16:49 . 2009-09-20 16:49        25280        ----a-w-        c:\windows\system32\drivers\hamachi.sys
2009-09-16 16:59 . 2009-09-16 16:59        0        ----a-w-        c:\windows\ativpsrm.bin
2009-09-16 15:42 . 2009-09-16 15:42        9158        ----a-r-        c:\users\PingChanGeR\AppData\Roaming\Microsoft\Installer\{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}\ARPPRODUCTICON.exe
2009-09-16 15:41 . 2009-09-16 15:41        10134        ----a-r-        c:\users\PingChanGeR\AppData\Roaming\Microsoft\Installer\{88976C62-2B62-FFA0-52CF-272094FD5A9C}\ARPPRODUCTICON.exe
2009-09-16 15:15 . 2009-09-15 17:22        680        ----a-w-        c:\users\PingChanGeR\AppData\Local\d3d9caps.dat
2009-09-16 12:14 . 2006-11-02 10:32        101888        ----a-w-        c:\windows\system32\ifxcardm.dll
2009-09-16 12:14 . 2006-11-02 10:32        82432        ----a-w-        c:\windows\system32\axaltocm.dll
2009-09-16 11:31 . 2009-09-16 11:31        6656        ----a-w-        c:\windows\system32\kbd106n.dll
2009-09-16 11:27 . 2009-09-16 11:27        72704        ----a-w-        c:\windows\system32\admparse.dll
2009-09-16 11:27 . 2009-09-16 11:27        48128        ----a-w-        c:\windows\system32\mshtmler.dll
2009-09-15 19:03 . 2009-09-15 19:03        2048        ----a-w-        c:\windows\system32\tzres.dll
2009-09-15 19:02 . 2009-09-15 19:02        61440        ----a-w-        c:\windows\system32\winipsec.dll
2009-09-15 19:02 . 2009-09-15 19:02        272896        ----a-w-        c:\windows\system32\polstore.dll
2009-09-15 18:59 . 2009-09-15 18:59        9728        ----a-w-        c:\windows\system32\TCPSVCS.EXE
2009-09-15 18:59 . 2009-09-15 18:59        8704        ----a-w-        c:\windows\system32\HOSTNAME.EXE
2009-09-15 18:59 . 2009-09-15 18:59        17920        ----a-w-        c:\windows\system32\netevent.dll
2009-09-15 18:59 . 2009-09-15 18:59        11264        ----a-w-        c:\windows\system32\MRINFO.EXE
2009-09-15 18:59 . 2009-09-15 18:59        904776        ----a-w-        c:\windows\system32\drivers\tcpip.sys
2009-09-15 18:59 . 2009-09-15 18:59        27136        ----a-w-        c:\windows\system32\NETSTAT.EXE
2009-09-15 18:59 . 2009-09-15 18:59        19968        ----a-w-        c:\windows\system32\ARP.EXE
2009-09-15 18:59 . 2009-09-15 18:59        17920        ----a-w-        c:\windows\system32\ROUTE.EXE
2009-09-15 18:59 . 2009-09-15 18:59        105984        ----a-w-        c:\windows\system32\netiohlp.dll
2009-09-15 18:59 . 2009-09-15 18:59        10240        ----a-w-        c:\windows\system32\finger.exe
2009-09-15 18:59 . 2009-09-15 18:59        30720        ----a-w-        c:\windows\system32\drivers\tcpipreg.sys
2009-09-15 18:57 . 2009-09-15 18:57        127488        ----a-w-        c:\windows\system32\L2SecHC.dll
2009-09-15 18:57 . 2009-09-15 18:57        68096        ----a-w-        c:\windows\system32\wlanhlp.dll
2009-09-15 18:57 . 2009-09-15 18:57        65024        ----a-w-        c:\windows\system32\wlanapi.dll
2009-09-15 18:57 . 2009-09-15 18:57        513536        ----a-w-        c:\windows\system32\wlansvc.dll
2009-09-15 18:57 . 2009-09-15 18:57        302592        ----a-w-        c:\windows\system32\wlansec.dll
2009-09-15 18:57 . 2009-09-15 18:57        293376        ----a-w-        c:\windows\system32\wlanmsm.dll
2009-09-15 18:57 . 2009-09-15 18:57        15181        ----a-w-        c:\windows\system32\gatherWirelessInfo.vbs
2009-09-15 18:55 . 2009-09-15 18:55        72704        ----a-w-        c:\windows\system32\fontsub.dll
2009-09-15 18:55 . 2009-09-15 18:55        34304        ----a-w-        c:\windows\system32\atmlib.dll
2009-05-13 21:55 . 2009-05-13 21:55        1044480        ----a-w-        c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-13 21:55 . 2009-05-13 21:55        200704        ----a-w-        c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{14f0d511-36a2-41ca-ae01-ba4f87282c97}"= "c:\program files\SHOUTcast Radio Toolbar\shoutcasttb.dll" [2008-09-17 1275176]

[HKEY_CLASSES_ROOT\clsid\{14f0d511-36a2-41ca-ae01-ba4f87282c97}]
[HKEY_CLASSES_ROOT\SHOUTcastTb.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{8613efdf-b530-4b1d-b970-b09f99977813}]
[HKEY_CLASSES_ROOT\SHOUTcastTb.AOLTBSearch]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-18 202240]
"BitTorrent DNA"="c:\users\PingChanGeR\Program Files\DNA\btdna.exe" [2009-11-06 323392]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-18 1008184]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-06-01 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-01 8429568]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-06-01 81920]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-02-26 153136]
"recinfo793"="c:\recinfo\RecInfo.exe" [2007-09-14 2768896]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2006-11-03 319488]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-07-16 61440]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-07-01 37888]
"DeathAdder"="c:\program files\Razer\DeathAdder\razerhid.exe" [2007-09-07 159744]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):1b,c5,ff,f3,cd,36,ca,01

R0 ViBus;ViBus;c:\windows\System32\drivers\ViBus.sys [16.10.2007 21:38 16896]
R0 ViPrt;VIA SATA IDE Device Driver;c:\windows\System32\drivers\ViPrt.sys [16.10.2007 21:38 52224]
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [15.09.2009 18:34 108289]
R2 TeamViewer4;TeamViewer 4;c:\program files\TeamViewer\Version4\TeamViewer_Service.exe [24.08.2009 15:51 185640]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [30.10.2009 14:31 1021256]
R3 DAdderFltr;DeathAdder Mouse;c:\windows\System32\drivers\dadder.sys [15.09.2009 18:49 22784]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [14.10.2009 07:24 10064]
S3 CM1063264;C-Media CM106 Like Sound UDAX Interface;c:\windows\System32\drivers\CM106.sys [17.09.2009 16:57 1307136]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [16.10.2007 21:48 1527900]
S3 FontCache;Windows-Dienst für Schriftartencache;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [16.09.2009 12:52 21504]
S3 PAC207;SoC PC-Camera;c:\windows\System32\drivers\PFC027.SYS [05.12.2006 10:34 507136]
S3 UPnPService;UPnPService;c:\program files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe [16.10.2007 21:49 544768]
S3 USBMULCD;USB Multi-Channel Audio Device Interface;c:\windows\System32\drivers\CM106.sys [17.09.2009 16:57 1307136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation        REG_MULTI_SZ          FontCache

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://start.icq.com/skins/
IE: &SHOUTcast Search - c:\programdata\SHOUTcast Radio Toolbar\ieToolbar\resources\en-US\local\search.html
DPF: {3188FB46-456D-4C07-8A11-F5F3BBBA8AF2} - hxxp://www.seetoo.com/downloadAddon.php?platform=Win32&browser=ie&ref=justintv&c=c1fd32f2323559bc3&browserVersion=7.0
FF - ProfilePath - c:\users\PingChanGeR\AppData\Roaming\Mozilla\Firefox\Profiles\gsd41ghb.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50-ff-shoutcast-chromesbox-en-us&query=
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - www.google.de
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=skin&q=
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - component: c:\users\PingChanGeR\AppData\Roaming\Mozilla\Firefox\Profiles\gsd41ghb.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
FF - component: c:\users\PingChanGeR\AppData\Roaming\Mozilla\Firefox\Profiles\gsd41ghb.default\extensions\{12e4c684-c03e-4e4d-85bc-0c065e7a9489}\components\WinampPlayer.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\users\PingChanGeR\AppData\Roaming\Mozilla\Firefox\Profiles\gsd41ghb.default\extensions\seetooaddon@seetoo.com\plugins\npSeeTooAddon.dll
FF - plugin: c:\users\PingChanGeR\Program Files\DNA\plugins\npbtdna.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX Richtlinien ----

FF - user.js: browser.sessionstore.resume_from_crash - false
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

HKLM-Run-Cm106Sound - cm106.cpl



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-20 20:33
Windows 6.0.6002 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
Zeit der Fertigstellung: 2009-11-20 20:35
ComboFix-quarantined-files.txt  2009-11-20 19:35

Vor Suchlauf: 17 Verzeichnis(se), 113.032.888.320 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 112.995.151.872 Bytes frei

- - End Of File - - AE55A549FA2E816ED7D70EABC97D7001

Angel21 20.11.2009 20:47
Neues Gmer Log bitte erstellen.

crippcid 20.11.2009 20:58
Also.. ich habs 2x probiert. beim 1. Versuch hat sich das Programm aufgehängt und Bluescreen. Beim 2. Mal konnte ich mir merken wo, weil's beim 1. mal das selbe war.

Code:
C:\harddisk\VolumeShadowCopy1
Das dürft die stelle gewesen sein. bin mir nicht sicher wegen groß- und kleinschreibung.

Angel21 20.11.2009 21:31
Rootkitscan mit RootRepeal
  • Gehe hierhin, scrolle runter und downloade RootRepeal.zip.
  • Entpacke die Datei auf Deinen Desktop.
  • Doppelklicke die RootRepeal.exe, um den Scanner zu starten.
  • Klicke auf den Reiter Report und dann auf den Button Scan.
  • Mache einen Haken bei den folgenden Elementen und klicke Ok.
    .
    Drivers
    Files
    Processes
    SSDT
    Stealth Objects
    Hidden Services
    .
  • Im Anschluss wirst Du gefragt, welche Laufwerke gescannt werden sollen.
  • Wähle C:\ und klicke wieder Ok.
  • Der Suchlauf beginnt automatisch, es wird eine Weile dauern, bitte Geduld.
  • Wenn der Suchlauf beendet ist, klicke auf Save Report.
  • Speichere das Logfile als RootRepeal.txt auf dem Desktop.
  • Kopiere den Inhalt hier in den Thread.

crippcid 20.11.2009 21:45
Der Log:

Code:
ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time:                2009/11/20 21:34
Program Version:                Version 1.3.5.0
Windows Version:                Windows Vista SP2
==================================================

Drivers
-------------------
Name: dump_ViPrt.sys
Image Path: C:\Windows\System32\Drivers\dump_ViPrt.sys
Address: 0x8C5BE000        Size: 65536        File Visible: No        Signed: -
Status: -

Name: fxlyiaob.sys
Image Path: C:\Users\PINGCH~1\AppData\Local\Temp\fxlyiaob.sys
Address: 0x977A6000        Size: 91008        File Visible: No        Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\Windows\system32\drivers\rootrepeal.sys
Address: 0x977BD000        Size: 49152        File Visible: No        Signed: -
Status: -

Hidden/Locked Files
-------------------
Path: C:\Documents and Settings
Status: Locked to the Windows API!

Path: C:\hiberfil.sys
Status: Locked to the Windows API!

Path: C:\ProgramData\Application Data
Status: Locked to the Windows API!

Path: C:\ProgramData\Desktop
Status: Locked to the Windows API!

Path: C:\ProgramData\Documents
Status: Locked to the Windows API!

Path: C:\ProgramData\Favorites
Status: Locked to the Windows API!

Path: C:\ProgramData\Start Menu
Status: Locked to the Windows API!

Path: C:\ProgramData\Templates
Status: Locked to the Windows API!

Path: C:\System Volume Information\{06c263e8-d602-11de-9079-0019dbf9b2a5}{3808876b-c176-4e48-b7ae-04046e6cc752}
Status: Locked to the Windows API!

Path: C:\System Volume Information\{11212179-ca8a-11de-bea0-0019dbf9b2a5}{3808876b-c176-4e48-b7ae-04046e6cc752}
Status: Locked to the Windows API!

Path: C:\System Volume Information\{13d1aec3-d549-11de-9d1b-0019dbf9b2a5}{3808876b-c176-4e48-b7ae-04046e6cc752}
Status: Locked to the Windows API!

Path: C:\System Volume Information\{1e228749-d50e-11de-8fc2-0019dbf9b2a5}{3808876b-c176-4e48-b7ae-04046e6cc752}
Status: Locked to the Windows API!

Path: C:\System Volume Information\{20e974c2-d374-11de-abaa-0019dbf9b2a5}{3808876b-c176-4e48-b7ae-04046e6cc752}
Status: Locked to the Windows API!

Path: C:\System Volume Information\{213cc886-cebb-11de-bfbd-0019dbf9b2a5}{3808876b-c176-4e48-b7ae-04046e6cc752}
Status: Locked to the Windows API!

Path: C:\System Volume Information\{28a74ec2-cb14-11de-8912-0019dbf9b2a5}{3808876b-c176-4e48-b7ae-04046e6cc752}
Status: Locked to the Windows API!

Path: C:\System Volume Information\{2bb0d9d7-d5f6-11de-ba02-0019dbf9b2a5}{3808876b-c176-4e48-b7ae-04046e6cc752}
Status: Locked to the Windows API!

Path: C:\System Volume Information\{3808876b-c176-4e48-b7ae-04046e6cc752}
Status: Locked to the Windows API!

Path: C:\System Volume Information\{976ea9d1-d50f-11de-b203-0019dbf9b2a5}{3808876b-c176-4e48-b7ae-04046e6cc752}
Status: Locked to the Windows API!

Path: C:\System Volume Information\{bfa278e8-d504-11de-9c18-0019dbf9b2a5}{3808876b-c176-4e48-b7ae-04046e6cc752}
Status: Locked to the Windows API!

Path: C:\System Volume Information\{cc8e0142-d5ce-11de-b0c4-0019dbf9b2a5}{3808876b-c176-4e48-b7ae-04046e6cc752}
Status: Locked to the Windows API!

Path: C:\System Volume Information\{cc8e0146-d5ce-11de-b0c4-0019dbf9b2a5}{3808876b-c176-4e48-b7ae-04046e6cc752}
Status: Locked to the Windows API!

Path: C:\System Volume Information\{cc8e014a-d5ce-11de-b0c4-0019dbf9b2a5}{3808876b-c176-4e48-b7ae-04046e6cc752}
Status: Locked to the Windows API!

Path: C:\System Volume Information\{e17c2868-d5f6-11de-9946-0019dbf9b2a5}{3808876b-c176-4e48-b7ae-04046e6cc752}
Status: Locked to the Windows API!

Path: C:\System Volume Information\{e2ac8842-c965-11de-94ac-0019dbf9b2a5}{3808876b-c176-4e48-b7ae-04046e6cc752}
Status: Locked to the Windows API!

Path: C:\System Volume Information\{e589fbc2-cdf1-11de-bd93-0019dbf9b2a5}{3808876b-c176-4e48-b7ae-04046e6cc752}
Status: Locked to the Windows API!

Path: C:\System Volume Information\{ff223949-cd46-11de-8b48-0019dbf9b2a5}{3808876b-c176-4e48-b7ae-04046e6cc752}
Status: Locked to the Windows API!

Path: C:\System Volume Information\{382896cc-cb18-11de-aa51-0019dbf9b2a5}{3808876b-c176-4e48-b7ae-04046e6cc752}
Status: Locked to the Windows API!

Path: C:\System Volume Information\{4d4080d3-d056-11de-b7c4-0019dbf9b2a5}{3808876b-c176-4e48-b7ae-04046e6cc752}
Status: Locked to the Windows API!

Path: C:\System Volume Information\{59e312d1-d38f-11de-9de5-0019dbf9b2a5}{3808876b-c176-4e48-b7ae-04046e6cc752}
Status: Locked to the Windows API!

Path: C:\System Volume Information\{5c1e2950-cfab-11de-af74-0019dbf9b2a5}{3808876b-c176-4e48-b7ae-04046e6cc752}
Status: Locked to the Windows API!

Path: C:\System Volume Information\{645c9d0a-d142-11de-95a6-0019dbf9b2a5}{3808876b-c176-4e48-b7ae-04046e6cc752}
Status: Locked to the Windows API!

Path: C:\System Volume Information\{7299e978-cc5e-11de-88d6-0019dbf9b2a5}{3808876b-c176-4e48-b7ae-04046e6cc752}
Status: Locked to the Windows API!

Path: C:\System Volume Information\{86102542-cf84-11de-8845-0019dbf9b2a5}{3808876b-c176-4e48-b7ae-04046e6cc752}
Status: Locked to the Windows API!

Path: C:\Users\All Users
Status: Locked to the Windows API!

Path: C:\Users\Default User
Status: Locked to the Windows API!

Path: C:\Users\Default\Application Data
Status: Locked to the Windows API!

Path: C:\Users\Default\Cookies
Status: Locked to the Windows API!

Path: C:\Users\Default\Local Settings
Status: Locked to the Windows API!

Path: C:\Users\Default\My Documents
Status: Locked to the Windows API!

Path: C:\Users\Default\NetHood
Status: Locked to the Windows API!

Path: C:\Users\Default\PrintHood
Status: Locked to the Windows API!

Path: C:\Users\Default\Recent
Status: Locked to the Windows API!

Path: C:\Users\Default\SendTo
Status: Locked to the Windows API!

Path: C:\Users\Default\Start Menu
Status: Locked to the Windows API!

Path: C:\Users\Default\Templates
Status: Locked to the Windows API!

Path: C:\Users\Default\Documents\My Music
Status: Locked to the Windows API!

Path: C:\Users\Default\Documents\My Pictures
Status: Locked to the Windows API!

Path: C:\Users\Default\Documents\My Videos
Status: Locked to the Windows API!

Path: C:\Users\PingChanGeR\Downloads\PIEPC-~1.AVI:Zone.Identifier
Status: Visible to the Windows API, but not on disk.

Path: C:\Users\PingChanGeR\Downloads\Step Up.avi:Zone.Identifier
Status: Visible to the Windows API, but not on disk.

Path: C:\Users\Public\Documents\My Music
Status: Locked to the Windows API!

Path: C:\Users\Public\Documents\My Pictures
Status: Locked to the Windows API!

Path: C:\Users\Public\Documents\My Videos
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.21022.8_none_bcb86ed6ac711f91.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_da4695fc507e16e1.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_9.0.21022.8_none_ecdf8c290e547f39.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_818f59bf601aa775.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_none_81c25f21d3d46d84.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_microsoft.msxml2_6bd6b9abf345378f_4.20.9870.0_none_b7e00e6c7b30b69b.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.4148_none_f0efb442f8a0f46c.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.42_none_dc990e4797f81af1.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_policy.4.20.microsoft.msxml2_6bd6b9abf345378f_4.20.9870.0_none_a6dea5dc0ea08098.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_microsoft.msxml2r_6bd6b9abf345378f_4.1.1.0_none_365945b9da656e4d.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.21022.8_none_60a5df56e60dc5df.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.42_none_54c11df268b7c6d9.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.42_none_db5f52fb98cb24ad.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.42_none_5c4003bc63e949f6.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.openmp_1fc8b3b9a1e18e3b_8.0.50727.42_none_7658964504b9f3b6.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.4053_none_d1c738ec43578ea1.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_7dd1e0ebd6590e0b.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_e163563597edeada.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_8550c6b5d18a9128.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.42_none_58b19c2866332652.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.42_none_58843c41d2730d3f.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.42_none_0e9c2a8d74fd3ce6.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_policy.4.1.microsoft.msxml2r_6bd6b9abf345378f_4.1.1.0_none_8b7b15c031cda6db.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.4053_none_4ddfc6cd11929a02.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_dcc7eae99ad0d9cf.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.42_none_d6c3e7af9bae13a2.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.openmp_1fc8b3b9a1e18e3b_9.0.21022.8_none_7ab8cc63a6e4c2a3.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_microsoft.msxml2_6bd6b9abf345378f_4.20.9849.0_none_b7e911727b2899b7.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_10b2f55f9bffb8f8.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_9193a620671dde41.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_8.0.50727.42_none_45e008191e507087.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_none_e29d1181971ae11e.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.4148_none_51ca66a2bbe76806.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Catalogs\x86_policy.4.20.microsoft.msxml2_6bd6b9abf345378f_4.20.9849.0_none_a6e7a8e20e9863b4.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Manifests\a2f948df89c5a4090fb47a74b09ed39300f3a2d09a1cd13212bee8c7ee928959.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Manifests\9f4b272407008a230979f286064e895aa72cac13cd57d536a67ea34c9dd91a2c.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\Manifests\f3c343567eb07e928a24a5c8b8bf732a5523d0acd4762015ba309f48255a5baf.cat
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\x86_microsoft-windows-p..ting-spooler-client_31bf3856ad364e35_6.0.6002.18005_none_95196f2b15cf9bd2\$$DeleteMe.winspool.drv.01ca67dcdffc299e.0006
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\x86_microsoft-windows-oleacc_31bf3856ad364e35_6.0.6001.18000_none_6a84bdce2263bb83\$$DeleteMe.oleacc.dll.01ca67dcdd0d24e0.0000
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\x86_microsoft-windows-s..ent-sku-homepremium_31bf3856ad364e35_6.0.6002.18005_none_3d90d406f6a60fcd\SEC543~1.XRM
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\x86_microsoft-windows-s..ent-sku-homepremium_31bf3856ad364e35_6.0.6002.18005_none_3d90d406f6a60fcd\SE0F57~1.XRM
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\x86_microsoft-windows-s..ent-sku-homepremium_31bf3856ad364e35_6.0.6002.18005_none_3d90d406f6a60fcd\SE7561~1.XRM
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\x86_microsoft-windows-s..ent-sku-homepremium_31bf3856ad364e35_6.0.6002.18005_none_3d90d406f6a60fcd\SE4BA2~1.XRM
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\x86_microsoft-windows-s..ent-sku-homepremium_31bf3856ad364e35_6.0.6002.18005_none_3d90d406f6a60fcd\SE5F3C~1.XRM
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\x86_microsoft-windows-s..ent-sku-homepremium_31bf3856ad364e35_6.0.6002.18005_none_3d90d406f6a60fcd\SE5FBC~1.XRM
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\x86_microsoft-windows-s..ent-sku-homepremium_31bf3856ad364e35_6.0.6002.18005_none_3d90d406f6a60fcd\SE6DB5~1.XRM
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\x86_microsoft-windows-s..ent-sku-homepremium_31bf3856ad364e35_6.0.6002.18005_none_3d90d406f6a60fcd\SEC6C7~1.XRM
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\x86_microsoft-windows-s..ent-sku-homepremium_31bf3856ad364e35_6.0.6002.18005_none_3d90d406f6a60fcd\SE9AEB~1.XRM
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\x86_microsoft-windows-s..ent-sku-homepremium_31bf3856ad364e35_6.0.6002.18005_none_3d90d406f6a60fcd\SE4F78~1.XRM
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\x86_microsoft-windows-s..ent-sku-homepremium_31bf3856ad364e35_6.0.6002.18005_none_3d90d406f6a60fcd\SE427A~1.XRM
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\x86_microsoft-windows-s..ent-sku-homepremium_31bf3856ad364e35_6.0.6002.18005_none_3d90d406f6a60fcd\SE9942~1.XRM
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\x86_microsoft-windows-s..ent-sku-homepremium_31bf3856ad364e35_6.0.6002.18005_none_3d90d406f6a60fcd\SE3B5D~1.XRM
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\x86_microsoft-windows-s..ent-sku-homepremium_31bf3856ad364e35_6.0.6002.18005_none_3d90d406f6a60fcd\SE54EE~1.XRM
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\x86_microsoft-windows-s..ent-sku-homepremium_31bf3856ad364e35_6.0.6002.18005_none_3d90d406f6a60fcd\SE5DF7~1.XRM
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\x86_microsoft-windows-s..ent-sku-homepremium_31bf3856ad364e35_6.0.6002.18005_none_3d90d406f6a60fcd\SE1FB8~1.XRM
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\x86_policy.1.2.microsof..op.security.azroles_31bf3856ad364e35_6.0.6000.16386_none_ea83414c2e75b887\Microsoft.Interop.Security.AzRoles.config
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\x86_microsoft-windows-wpd-busenumservice_31bf3856ad364e35_6.0.6001.18000_none_77fe3055cc02641a\$$DeleteMe.wpdbusenum.dll.01ca67dcdee5367c.0002
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\x86_presentationcore_31bf3856ad364e35_6.0.6002.18005_none_ae1c8b4b8d1614c8\PRESEN~1.CON
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\x86_microsoft-windows-oleaccrc_31bf3856ad364e35_6.0.6000.16386_none_76f32d528a780cf2\$$DeleteMe.oleaccrc.dll.01ca67dcdd0f873a.0001
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\x86_microsoft-windows-wpd-portabledeviceapi_31bf3856ad364e35_6.0.6002.18005_none_4cec3f51e92bbb79\$$DeleteMe.PortableDeviceApi.dll.01ca67dcdf3b0b24.0005
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\x86_microsoft-windows-wpd-portabledeviceapi_31bf3856ad364e35_6.0.6002.18005_none_4cec3f51e92bbb79\$$DeleteMe.PortableDeviceClassExtension.dll.01ca67dcdf2333a0.0004
Status: Locked to the Windows API!

Path: C:\Windows\winsxs\x86_microsoft-windows-wpd-portabledeviceapi_31bf3856ad364e35_6.0.6002.18005_none_4cec3f51e92bbb79\$$DeleteMe.PortableDeviceTypes.dll.01ca67dcdf19aa38.0003
Status: Locked to the Windows API!

Path: C:\Users\Default\AppData\Local\Application Data
Status: Locked to the Windows API!

Path: C:\Users\Default\AppData\Local\History
Status: Locked to the Windows API!

Path: C:\Users\Default\AppData\Local\Temporary Internet Files
Status: Locked to the Windows API!

Path: C:\Users\PingChanGeR\AppData\Local\temp\flaF77D.tmp
Status: Invisible to the Windows API!

Path: C:\Users\PingChanGeR\AppData\Local\temp\fla2C10.tmp
Status: Visible to the Windows API, but not on disk.

Path: C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.0.6000.16386__31bf3856ad364e35\Microsoft.Interop.Security.AzRoles.config
Status: Locked to the Windows API!

Path: C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PRESEN~1.CON
Status: Locked to the Windows API!

Path: C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PRESEN~1.CON
Status: Locked to the Windows API!

Path: C:\Windows\System32\licensing\skus\Security-Licensing-SLC-Component-SKU-HomePremium\SEC543~1.XRM
Status: Locked to the Windows API!

Path: C:\Windows\System32\licensing\skus\Security-Licensing-SLC-Component-SKU-HomePremium\SE0F57~1.XRM
Status: Locked to the Windows API!

Path: C:\Windows\System32\licensing\skus\Security-Licensing-SLC-Component-SKU-HomePremium\SE7561~1.XRM
Status: Locked to the Windows API!

Path: C:\Windows\System32\licensing\skus\Security-Licensing-SLC-Component-SKU-HomePremium\SE427A~1.XRM
Status: Locked to the Windows API!

Path: C:\Windows\System32\licensing\skus\Security-Licensing-SLC-Component-SKU-HomePremium\SE3B5D~1.XRM
Status: Locked to the Windows API!

Path: C:\Windows\System32\licensing\skus\Security-Licensing-SLC-Component-SKU-HomePremium\SE54EE~1.XRM
Status: Locked to the Windows API!

Path: C:\Windows\System32\licensing\skus\Security-Licensing-SLC-Component-SKU-HomePremium\SE1FB8~1.XRM
Status: Locked to the Windows API!

Path: C:\Windows\System32\licensing\skus\Security-Licensing-SLC-Component-SKU-HomePremium\SE9942~1.XRM
Status: Locked to the Windows API!

Path: C:\Windows\System32\licensing\skus\Security-Licensing-SLC-Component-SKU-HomePremium\SE4BA2~1.XRM
Status: Locked to the Windows API!

Path: C:\Windows\System32\licensing\skus\Security-Licensing-SLC-Component-SKU-HomePremium\SE5F3C~1.XRM
Status: Locked to the Windows API!

Path: C:\Windows\System32\licensing\skus\Security-Licensing-SLC-Component-SKU-HomePremium\SECURI~4.XRM
Status: Locked to the Windows API!

Path: C:\Windows\System32\licensing\skus\Security-Licensing-SLC-Component-SKU-HomePremium\SE5FBC~1.XRM
Status: Locked to the Windows API!

Path: C:\Windows\System32\licensing\skus\Security-Licensing-SLC-Component-SKU-HomePremium\SE5DF7~1.XRM
Status: Locked to the Windows API!

Path: C:\Windows\System32\licensing\skus\Security-Licensing-SLC-Component-SKU-HomePremium\SE6DB5~1.XRM
Status: Locked to the Windows API!

Path: C:\Windows\System32\licensing\skus\Security-Licensing-SLC-Component-SKU-HomePremium\SEC6C7~1.XRM
Status: Locked to the Windows API!

Path: C:\Windows\System32\licensing\skus\Security-Licensing-SLC-Component-SKU-HomePremium\SECURI~2.XRM
Status: Locked to the Windows API!

Path: C:\Windows\System32\licensing\skus\Security-Licensing-SLC-Component-SKU-HomePremium\SE9AEB~1.XRM
Status: Locked to the Windows API!

Path: C:\Windows\System32\licensing\skus\Security-Licensing-SLC-Component-SKU-HomePremium\SE4F78~1.XRM
Status: Locked to the Windows API!

Path: c:\users\pingchanger\appdata\local\microsoft\windows live contacts\{466d247d-9c8d-4f2f-84c6-5e9ed0ff887c}\dbstore\tempedb.edb
Status: Allocation size mismatch (API: 262144, Raw: 131072)

Path: c:\users\pingchanger\appdata\local\microsoft\windows live contacts\{8fd3ab33-13b2-4431-8a4a-ad25e05bd524}\dbstore\tempedb.edb
Status: Allocation size mismatch (API: 262144, Raw: 131072)

Path: c:\users\pingchanger\appdata\local\mozilla\firefox\profiles\gsd41ghb.default\cache\_cache_001_
Status: Allocation size mismatch (API: 1310720, Raw: 1179648)

Path: c:\users\pingchanger\appdata\local\mozilla\firefox\profiles\gsd41ghb.default\cache\_cache_002_
Status: Allocation size mismatch (API: 1310720, Raw: 1245184)

Path: c:\users\pingchanger\appdata\local\mozilla\firefox\profiles\gsd41ghb.default\cache\_cache_003_
Status: Allocation size mismatch (API: 2359296, Raw: 2228224)

Processes
-------------------
Path: System
PID: 4        Status: Locked to the Windows API!

Path: C:\Windows\System32\audiodg.exe
PID: 1096        Status: Locked to the Windows API!

SSDT
-------------------
#: 078        Function Name: NtCreateThread
Status: Hooked by "<unknown>" at address 0x966cdd74

#: 194        Function Name: NtOpenProcess
Status: Hooked by "<unknown>" at address 0x966cdd60

#: 201        Function Name: NtOpenThread
Status: Hooked by "<unknown>" at address 0x966cdd65

#: 334        Function Name: NtTerminateProcess
Status: Hooked by "<unknown>" at address 0x966cdd6f

Stealth Objects
-------------------
Object: Hidden Module [Name: msgsres.dll]
Process: msnmsgr.exe (PID: 3352)        Address: 0x62e30000        Size: 11403264

Object: Hidden Module [Name: msgslang.14.0.8089.0726.dll]
Process: msnmsgr.exe (PID: 3352)        Address: 0x66840000        Size: 372736

Object: Hidden Module [Name: msgrvsta.thm]
Process: msnmsgr.exe (PID: 3352)        Address: 0x70600000        Size: 20480

==EOF==

Angel21 20.11.2009 22:18
Starte nochmal Superantispyware und lass es Durchlaufen, Log hier her.

Malwarebytes bitte auch nochmal starten, durchsuchen lassen, Log hier her.

Zwischenfrage: wie geht es zur Zeit deinem PC?

Bin ab Morgen wieder da.

crippcid 21.11.2009 09:51
Ahm :) Wie es meinem PC geht? Du moment.. ich muss ihn erstmal fragen..
ne.. ähm.. läuft ganz normal wie immer UUUUUUND der Virus poppt nimmer auf :)

Angel21 21.11.2009 09:53
Trotzdem noch einige arbeitsanweisungen durchführen ;)

crippcid 21.11.2009 09:54
Joa :) Weiss ich ja noch vom letzten mal :D


Alle Zeitangaben in WEZ +1. Es ist jetzt 03:33 Uhr.
Seite 2 von 4 1 2 34
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19