|
check mit hijackthis(logfile), habe ich ein schädliches programm auf meinem rechner? hi leute in letzter zeit öffnen sich etwa stündlich im internet explorer (obwohl ich firefox benutze ) ganz von alleine internetseiten, alles werbeseiten, die meisten unseriös. habe danach mal meinen pc mit hijackthis gescannt, hier der logfile: "HiJackthis Logfile: Code: Logfile of Trend Micro HijackThis v2.0.4" ist auf meinem pc irgendein schädliches programm, dass eventuell noch mehr schaden anrichten könnte? |
Zitat:
Ausserdem OTL Logs posten: http://www.trojaner-board.de/85104-o...-oldtimer.html *************************** |
hier der logfile von malwarebitys: Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Datenbank Version: 4275 Windows 5.1.2600 Service Pack 2 Internet Explorer 6.0.2900.2180 05.07.2010 02:46:27 mbam-log-2010-07-05 (02-46-27).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Durchsuchte Objekte: 240601 Laufzeit: 1 Stunde(n), 36 Minute(n), 59 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 3 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 4 Infizierte Dateien: 20 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\32 Vegas Casino (Adware.21Nova) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\WebMediaPlayer (Rogue.WebMedia) -> No action taken. Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: C:\Programme\WebMediaPlayer (Adware.EGDAccess) -> No action taken. C:\Programme\WebMediaPlayer\resources (Adware.EGDAccess) -> No action taken. C:\Programme\WebMediaPlayer\skins (Adware.EGDAccess) -> No action taken. C:\Programme\WebMediaPlayer\updates (Adware.EGDAccess) -> No action taken. Infizierte Dateien: C:\Poker\Poker at bet365\_SetupPoker_68e0.exe (Adware.Casino) -> No action taken. C:\System Volume Information\_restore{0373A44D-44D7-46C5-98C0-0FC1B0CC9F27}\RP457\A0125361.dll (Trojan.BHO) -> No action taken. C:\System Volume Information\_restore{0373A44D-44D7-46C5-98C0-0FC1B0CC9F27}\RP466\A0128676.exe (Adware.Casino) -> No action taken. C:\System Volume Information\_restore{0373A44D-44D7-46C5-98C0-0FC1B0CC9F27}\RP480\A0131573.exe (Adware.Casino) -> No action taken. C:\System Volume Information\_restore{0373A44D-44D7-46C5-98C0-0FC1B0CC9F27}\RP486\A0137689.exe (Adware.Casino) -> No action taken. C:\System Volume Information\_restore{0373A44D-44D7-46C5-98C0-0FC1B0CC9F27}\RP491\A0139366.exe (Adware.Casino) -> No action taken. C:\System Volume Information\_restore{0373A44D-44D7-46C5-98C0-0FC1B0CC9F27}\RP498\A0153499.exe (Adware.Casino) -> No action taken. C:\System Volume Information\_restore{0373A44D-44D7-46C5-98C0-0FC1B0CC9F27}\RP482\A0133083.exe (Adware.Casino) -> No action taken. C:\WINDOWS\Temp\0.33736223522493713.exe (Trojan.Zbot) -> No action taken. C:\Casino\EuroGrand Casino\_SetupCasino_ed826d_de.exe (Adware.Casino) -> No action taken. C:\Dokumente und Einstellungen\Ich schaffe das!\Eigene Dateien\Downloads\SetupCasino_ed826d_de.exe (Adware.Casino) -> No action taken. C:\Dokumente und Einstellungen\Ich schaffe das!\Eigene Dateien\Downloads\SetupPoker_421f43.exe (Adware.Casino) -> No action taken. C:\Dokumente und Einstellungen\Ich schaffe das!\Eigene Dateien\Downloads\SetupPoker_68e0.exe (Adware.Casino) -> No action taken. C:\Programme\WebMediaPlayer\sqlite3.dll (Adware.EGDAccess) -> No action taken. C:\Programme\WebMediaPlayer\WebMediaPlayer.exe (Adware.EGDAccess) -> No action taken. C:\Programme\WebMediaPlayer\resources\wmp_translation_file.xml (Adware.EGDAccess) -> No action taken. C:\Programme\WebMediaPlayer\skins\classic.skn (Adware.EGDAccess) -> No action taken. C:\Dokumente und Einstellungen\Ich schaffe das!\Lokale Einstellungen\Temp\0.398823052069617.exe (Trojan.Dropper) -> No action taken. C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> No action taken. C:\WINDOWS\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job (Trojan.Downloader) -> No action taken. |
Zitat:
Das Log nach dem Löschprozess hier posten. Es fehlen die Logs von OTL. Siehe Anleitung. **************************************** |
Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Datenbank Version: 4275 Windows 5.1.2600 Service Pack 2 Internet Explorer 6.0.2900.2180 05.07.2010 02:46:36 mbam-log-2010-07-05 (02-46-36).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Durchsuchte Objekte: 240601 Laufzeit: 1 Stunde(n), 36 Minute(n), 59 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 3 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 4 Infizierte Dateien: 20 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\32 Vegas Casino (Adware.21Nova) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\WebMediaPlayer (Rogue.WebMedia) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: C:\Programme\WebMediaPlayer (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Programme\WebMediaPlayer\resources (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Programme\WebMediaPlayer\skins (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Programme\WebMediaPlayer\updates (Adware.EGDAccess) -> Quarantined and deleted successfully. Infizierte Dateien: C:\Poker\Poker at bet365\_SetupPoker_68e0.exe (Adware.Casino) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0373A44D-44D7-46C5-98C0-0FC1B0CC9F27}\RP457\A0125361.dll (Trojan.BHO) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0373A44D-44D7-46C5-98C0-0FC1B0CC9F27}\RP466\A0128676.exe (Adware.Casino) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0373A44D-44D7-46C5-98C0-0FC1B0CC9F27}\RP480\A0131573.exe (Adware.Casino) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0373A44D-44D7-46C5-98C0-0FC1B0CC9F27}\RP486\A0137689.exe (Adware.Casino) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0373A44D-44D7-46C5-98C0-0FC1B0CC9F27}\RP491\A0139366.exe (Adware.Casino) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0373A44D-44D7-46C5-98C0-0FC1B0CC9F27}\RP498\A0153499.exe (Adware.Casino) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{0373A44D-44D7-46C5-98C0-0FC1B0CC9F27}\RP482\A0133083.exe (Adware.Casino) -> Quarantined and deleted successfully. C:\WINDOWS\Temp\0.33736223522493713.exe (Trojan.Zbot) -> Quarantined and deleted successfully. C:\Casino\EuroGrand Casino\_SetupCasino_ed826d_de.exe (Adware.Casino) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\Ich schaffe das!\Eigene Dateien\Downloads\SetupCasino_ed826d_de.exe (Adware.Casino) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\Ich schaffe das!\Eigene Dateien\Downloads\SetupPoker_421f43.exe (Adware.Casino) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\Ich schaffe das!\Eigene Dateien\Downloads\SetupPoker_68e0.exe (Adware.Casino) -> Quarantined and deleted successfully. C:\Programme\WebMediaPlayer\sqlite3.dll (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Programme\WebMediaPlayer\WebMediaPlayer.exe (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Programme\WebMediaPlayer\resources\wmp_translation_file.xml (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Programme\WebMediaPlayer\skins\classic.skn (Adware.EGDAccess) -> Quarantined and deleted successfully. C:\Dokumente und Einstellungen\Ich schaffe das!\Lokale Einstellungen\Temp\0.398823052069617.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Quarantined and deleted successfully. C:\WINDOWS\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job (Trojan.Downloader) -> Quarantined and deleted successfully. OTL Logfile: Code: OTL logfile created on: 05.07.2010 14:46:41 - Run 2 |
> OTL Fix: Bitte als Administrator ausführen! * Schliesse alle Programme ( auch Firefox/Internet Explorer) und starte das Programm OTL. * Kopiere den Inhalt im Codefenster (siehe unten) in die Textbox von OTL. (unter BenutzerdefinierteScans/Fixes einfügen) Zitat:
* Klicke auf den roten Run Fix Button. * Abwarten bis OTL den PC neustartet. Bitte das zulassen und nach dem Neustart "Run" in die infobox klicken und abwarten bis das Log hochkommt. * Log hier posten, (wird auf C:\ gespeichert) ********************** |
das habe ich jetzt nicht gemacht, aber seit dem scan mit malwarebytes und der anschließenden löschung von malwarebytes gibt es das problem mit selbstständig aufpoppenden inetseiten nich mehr, ist das ausreichend oder muss ich mir doch sorgen machen dass auf meinem pc noch schlimmes drauf ist? |
Zitat:
Der PC ist leider noch nicht sauber. Bitte nach der Anleitung vorgehen, damit wir den Bereinigungsprozess zu Ende bringen können. lg. ************************************* |
All processes killed ========== OTL ========== Service TuneUp.UtilitiesSvc stopped successfully! Service TuneUp.UtilitiesSvc deleted successfully! File C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe not found. Service TuneUp.Defrag stopped successfully! Service TuneUp.Defrag deleted successfully! File C:\Programme\TuneUp Utilities 2010\TuneUpDefragService.exe not found. Service AppMgmt stopped successfully! Service AppMgmt deleted successfully! File C:\WINDOWS\System32\appmgmts.dll not found. Service TuneUpUtilitiesDrv stopped successfully! Service TuneUpUtilitiesDrv deleted successfully! File C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys not found. HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Search_URL| /E : value set successfully! HKLM\SOFTWARE\Microsoft\Internet Explorer\Search\\Default_Search_URL| /E : value set successfully! Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully. C:\Dokumente und Einstellungen\Ich schaffe das!\Anwendungsdaten\Mozilla\Firefox\Profiles\x9t1e6ox.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb}\chrome\mozapps\extensions folder moved successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\EWABQAF7KL deleted successfully. C:\Dokumente und Einstellungen\Ich schaffe das!\Lokale Einstellungen\Temp\Fgm.exe moved successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF}\ not found. C:\Programme\PokerStars\PokerStarsUpdate.exe moved successfully. Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found. Starting removal of ActiveX control {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\ not found. Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found. Starting removal of ActiveX control {D8089245-3211-40F6-819B-9E5E92CD61A2} C:\WINDOWS\Downloaded Program Files\FlashAX.inf moved successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{D8089245-3211-40F6-819B-9E5E92CD61A2}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D8089245-3211-40F6-819B-9E5E92CD61A2}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{D8089245-3211-40F6-819B-9E5E92CD61A2}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D8089245-3211-40F6-819B-9E5E92CD61A2}\ not found. C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job moved successfully. C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job moved successfully. C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-842925246-1123561945-725345543-1127.job moved successfully. C:\WINDOWS\tasks\SA.DAT moved successfully. C:\WINDOWS\Fxozya.exe moved successfully. C:\Dokumente und Einstellungen\Ich schaffe das!\hs_err_pid3492.log moved successfully. File C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-842925246-1123561945-725345543-1127.job not found. C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-842925246-1123561945-725345543-1127.job moved successfully. ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:82292B2D deleted successfully. ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:322D2CD3 deleted successfully. ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:70B3C619 deleted successfully. ========== FILES ========== File\Folder C:\WINDOWS\Fxozya.exe not found. File\Folder C:\DOKUME~1\ICHSCH~1\LOKALE~1\Temp\Fgm.exe not found. ========== COMMANDS ========== [EMPTYFLASH] User: Administrator User: All Users User: Default User User: Ich schaffe das! ->Flash cache emptied: 76874 bytes User: LocalService User: NetworkService ->Flash cache emptied: 2180 bytes Total Flash Files Cleaned = 0,00 mb [EMPTYTEMP] User: Administrator ->Temporary Internet Files folder emptied: 32768 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Ich schaffe das! ->Temp folder emptied: 58102858 bytes ->Temporary Internet Files folder emptied: 1493735 bytes ->Java cache emptied: 61400927 bytes ->FireFox cache emptied: 86438989 bytes ->Google Chrome cache emptied: 819568 bytes ->Flash cache emptied: 0 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 462032 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Java cache emptied: 17119 bytes ->Flash cache emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 2114764 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 959513 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 202,00 mb C:\WINDOWS\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully OTL by OldTimer - Version 3.2.8.1 log created on 07082010_223711 Files\Folders moved on Reboot... Registry entries deleted on Reboot... |
Bitte noch durchführen: RootkitScan: http://ad13.geekstogo.com/RootRepeal.exe auf dein Desktop laden > doppelklick auf rootrepeal.exe. > Im Scanfenster gehe unten in der Leiste auf "REPORT". Klicke Scan > alle Scanalternativen ankreuzen > klicke ok > alle Festplatten ankreuzen > klicke ok Der Scan startet. Das log hier posten. Online Scan mit ESET: http://www.eset.de/onlinescanner Scan mit Dr.WEB im abgesicherten Modus: (Schneller Scan) http://www.trojaner-board.de/59299-a...eb-cureit.html Fünde löschen/Log posten. ************************************* |
ROOTREPEAL (c) AD, 2007-2009 ================================================== Scan Start Time: 2010/07/09 00:20 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP2 ================================================== Drivers ------------------- Name: ACPI.sys Image Path: ACPI.sys Address: 0xB9E6D000 Size: 188800 File Visible: - Signed: - Status: - Name: ACPI_HAL Image Path: \Driver\ACPI_HAL Address: 0x804D7000 Size: 2146304 File Visible: - Signed: - Status: - Name: AegisP.sys Image Path: C:\WINDOWS\system32\DRIVERS\AegisP.sys Address: 0xBA4A8000 Size: 19360 File Visible: - Signed: - Status: - Name: afd.sys Image Path: C:\WINDOWS\System32\drivers\afd.sys Address: 0xA8A79000 Size: 138368 File Visible: - Signed: - Status: - Name: aosqdmh4.SYS Image Path: C:\WINDOWS\System32\Drivers\aosqdmh4.SYS Address: 0xB9345000 Size: 233472 File Visible: - Signed: - Status: - Name: atapi.sys Image Path: atapi.sys Address: 0xB9E25000 Size: 98304 File Visible: - Signed: - Status: - Name: atapi.sys Image Path: atapi.sys Address: 0x00000000 Size: 0 File Visible: - Signed: - Status: - Name: ATMFD.DLL Image Path: C:\WINDOWS\System32\ATMFD.DLL Address: 0xBFFA0000 Size: 286720 File Visible: - Signed: - Status: - Name: audstub.sys Image Path: C:\WINDOWS\system32\DRIVERS\audstub.sys Address: 0xBA76A000 Size: 3072 File Visible: - Signed: - Status: - Name: avgio.sys Image Path: C:\Programme\Avira\AntiVir Desktop\avgio.sys Address: 0xBA618000 Size: 6144 File Visible: - Signed: - Status: - Name: avgntflt.sys Image Path: C:\WINDOWS\system32\DRIVERS\avgntflt.sys Address: 0xA880A000 Size: 86016 File Visible: - Signed: - Status: - Name: avipbb.sys Image Path: C:\WINDOWS\system32\DRIVERS\avipbb.sys Address: 0xA8987000 Size: 139264 File Visible: - Signed: - Status: - Name: Beep.SYS Image Path: C:\WINDOWS\System32\Drivers\Beep.SYS Address: 0xBA5FE000 Size: 4224 File Visible: - Signed: - Status: - Name: BOOTVID.dll Image Path: C:\WINDOWS\system32\BOOTVID.dll Address: 0xBA4B8000 Size: 12288 File Visible: - Signed: - Status: - Name: Cdfs.SYS Image Path: C:\WINDOWS\System32\Drivers\Cdfs.SYS Address: 0xBA1E8000 Size: 63744 File Visible: - Signed: - Status: - Name: cdrom.sys Image Path: C:\WINDOWS\system32\DRIVERS\cdrom.sys Address: 0xBA2C8000 Size: 49536 File Visible: - Signed: - Status: - Name: CLASSPNP.SYS Image Path: C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS Address: 0xBA0E8000 Size: 53248 File Visible: - Signed: - Status: - Name: disk.sys Image Path: disk.sys Address: 0xBA0D8000 Size: 36352 File Visible: - Signed: - Status: - Name: drmk.sys Image Path: C:\WINDOWS\system32\drivers\drmk.sys Address: 0xBA148000 Size: 61440 File Visible: - Signed: - Status: - Name: Dxapi.sys Image Path: C:\WINDOWS\System32\drivers\Dxapi.sys Address: 0xA8CF6000 Size: 12288 File Visible: - Signed: - Status: - Name: dxg.sys Image Path: C:\WINDOWS\System32\drivers\dxg.sys Address: 0xBF000000 Size: 73728 File Visible: - Signed: - Status: - Name: dxgthk.sys Image Path: C:\WINDOWS\System32\drivers\dxgthk.sys Address: 0xBA790000 Size: 4096 File Visible: - Signed: - Status: - Name: Fips.SYS Image Path: C:\WINDOWS\System32\Drivers\Fips.SYS Address: 0xBA1B8000 Size: 35072 File Visible: - Signed: - Status: - Name: fltMgr.sys Image Path: fltMgr.sys Address: 0xB9E06000 Size: 124800 File Visible: - Signed: - Status: - Name: Fs_Rec.SYS Image Path: C:\WINDOWS\System32\Drivers\Fs_Rec.SYS Address: 0xBA5FC000 Size: 7936 File Visible: - Signed: - Status: - Name: ftdisk.sys Image Path: ftdisk.sys Address: 0xB9E3D000 Size: 126336 File Visible: - Signed: - Status: - Name: hal.dll Image Path: C:\WINDOWS\system32\hal.dll Address: 0x806E3000 Size: 134400 File Visible: - Signed: - Status: - Name: hamachi.sys Image Path: C:\WINDOWS\system32\DRIVERS\hamachi.sys Address: 0xBA380000 Size: 18560 File Visible: - Signed: - Status: - Name: HDAudBus.sys Image Path: C:\WINDOWS\system32\DRIVERS\HDAudBus.sys Address: 0xB9417000 Size: 151552 File Visible: - Signed: - Status: - Name: HIDCLASS.SYS Image Path: C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS Address: 0xBA178000 Size: 36864 File Visible: - Signed: - Status: - Name: HIDPARSE.SYS Image Path: C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS Address: 0xBA3C0000 Size: 28672 File Visible: - Signed: - Status: - Name: hidusb.sys Image Path: C:\WINDOWS\system32\DRIVERS\hidusb.sys Address: 0xBA5A0000 Size: 9600 File Visible: - Signed: - Status: - Name: HTTP.sys Image Path: C:\WINDOWS\System32\Drivers\HTTP.sys Address: 0xA7C5E000 Size: 263552 File Visible: - Signed: - Status: - Name: igxpdv32.DLL Image Path: C:\WINDOWS\System32\igxpdv32.DLL Address: 0xBF04F000 Size: 1671168 File Visible: - Signed: - Status: - Name: igxpdx32.DLL Image Path: C:\WINDOWS\System32\igxpdx32.DLL Address: 0xBF1E7000 Size: 2695168 File Visible: - Signed: - Status: - Name: igxpgd32.dll Image Path: C:\WINDOWS\System32\igxpgd32.dll Address: 0xBF024000 Size: 176128 File Visible: - Signed: - Status: - Name: igxpmp32.sys Image Path: C:\WINDOWS\system32\DRIVERS\igxpmp32.sys Address: 0xB9450000 Size: 5851072 File Visible: - Signed: - Status: - Name: igxprd32.dll Image Path: C:\WINDOWS\System32\igxprd32.dll Address: 0xBF012000 Size: 73728 File Visible: - Signed: - Status: - Name: intelppm.sys Image Path: C:\WINDOWS\system32\DRIVERS\intelppm.sys Address: 0xBA2B8000 Size: 40192 File Visible: - Signed: - Status: - Name: Ip6Fw.sys Image Path: C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys Address: 0xBA3F8000 Size: 29056 File Visible: - Signed: - Status: - Name: ipnat.sys Image Path: C:\WINDOWS\system32\DRIVERS\ipnat.sys Address: 0xA8B9B000 Size: 134912 File Visible: - Signed: - Status: - Name: ipsec.sys Image Path: C:\WINDOWS\system32\DRIVERS\ipsec.sys Address: 0xA8CAB000 Size: 74752 File Visible: - Signed: - Status: - Name: isapnp.sys Image Path: isapnp.sys Address: 0xBA0A8000 Size: 36224 File Visible: - Signed: - Status: - Name: kbdclass.sys Image Path: C:\WINDOWS\system32\DRIVERS\kbdclass.sys Address: 0xBA390000 Size: 25216 File Visible: - Signed: - Status: - Name: kbdhid.sys Image Path: C:\WINDOWS\system32\DRIVERS\kbdhid.sys Address: 0xB9CAF000 Size: 14848 File Visible: - Signed: - Status: - Name: KDCOM.DLL Image Path: C:\WINDOWS\system32\KDCOM.DLL Address: 0xBA5A8000 Size: 8192 File Visible: - Signed: - Status: - Name: kmixer.sys Image Path: C:\WINDOWS\system32\drivers\kmixer.sys Address: 0xA5F59000 Size: 171776 File Visible: - Signed: - Status: - Name: ks.sys Image Path: C:\WINDOWS\system32\DRIVERS\ks.sys Address: 0xB937E000 Size: 143360 File Visible: - Signed: - Status: - Name: KSecDD.sys Image Path: KSecDD.sys Address: 0xB9DDD000 Size: 92544 File Visible: - Signed: - Status: - Name: mnmdd.SYS Image Path: C:\WINDOWS\System32\Drivers\mnmdd.SYS Address: 0xBA602000 Size: 4224 File Visible: - Signed: - Status: - Name: Modem.SYS Image Path: C:\WINDOWS\System32\Drivers\Modem.SYS Address: 0xBA388000 Size: 30336 File Visible: - Signed: - Status: - Name: mouclass.sys Image Path: C:\WINDOWS\system32\DRIVERS\mouclass.sys Address: 0xBA398000 Size: 23552 File Visible: - Signed: - Status: - Name: mouhid.sys Image Path: C:\WINDOWS\system32\DRIVERS\mouhid.sys Address: 0xB9CB7000 Size: 12288 File Visible: - Signed: - Status: - Name: MountMgr.sys Image Path: MountMgr.sys Address: 0xBA0B8000 Size: 42240 File Visible: - Signed: - Status: - Name: mrxsmb.sys Image Path: C:\WINDOWS\system32\DRIVERS\mrxsmb.sys Address: 0xA89A9000 Size: 454016 File Visible: - Signed: - Status: - Name: Msfs.SYS Image Path: C:\WINDOWS\System32\Drivers\Msfs.SYS Address: 0xBA3D0000 Size: 19072 File Visible: - Signed: - Status: - Name: msgpc.sys Image Path: C:\WINDOWS\system32\DRIVERS\msgpc.sys Address: 0xBA318000 Size: 35072 File Visible: - Signed: - Status: - Name: mssmbios.sys Image Path: C:\WINDOWS\system32\DRIVERS\mssmbios.sys Address: 0xB9C9F000 Size: 15488 File Visible: - Signed: - Status: - Name: Mup.sys Image Path: Mup.sys Address: 0xB9CE3000 Size: 107904 File Visible: - Signed: - Status: - Name: NDIS.sys Image Path: NDIS.sys Address: 0xB9D23000 Size: 182912 File Visible: - Signed: - Status: - Name: ndistapi.sys Image Path: C:\WINDOWS\system32\DRIVERS\ndistapi.sys Address: 0xB9CAB000 Size: 9600 File Visible: - Signed: - Status: - Name: ndiswan.sys Image Path: C:\WINDOWS\system32\DRIVERS\ndiswan.sys Address: 0xB932E000 Size: 91776 File Visible: - Signed: - Status: - Name: NDProxy.SYS Image Path: C:\WINDOWS\System32\Drivers\NDProxy.SYS Address: 0xBA128000 Size: 38016 File Visible: - Signed: - Status: - Name: netbios.sys Image Path: C:\WINDOWS\system32\DRIVERS\netbios.sys Address: 0xBA198000 Size: 34560 File Visible: - Signed: - Status: - Name: netbt.sys Image Path: C:\WINDOWS\system32\DRIVERS\netbt.sys Address: 0xA8B73000 Size: 162816 File Visible: - Signed: - Status: - Name: Npfs.SYS Image Path: C:\WINDOWS\System32\Drivers\Npfs.SYS Address: 0xBA3D8000 Size: 30848 File Visible: - Signed: - Status: - Name: Ntfs.sys Image Path: Ntfs.sys Address: 0xB9D50000 Size: 574592 File Visible: - Signed: - Status: - Name: ntkrnlpa.exe Image Path: C:\WINDOWS\system32\ntkrnlpa.exe Address: 0x804D7000 Size: 2146304 File Visible: - Signed: - Status: - Name: Null.SYS Image Path: C:\WINDOWS\System32\Drivers\Null.SYS Address: 0xBA688000 Size: 2944 File Visible: - Signed: - Status: - Name: parport.sys Image Path: C:\WINDOWS\system32\DRIVERS\parport.sys Address: 0xB93A1000 Size: 80384 File Visible: - Signed: - Status: - Name: PartMgr.sys Image Path: PartMgr.sys Address: 0xBA330000 Size: 18688 File Visible: - Signed: - Status: - Name: ParVdm.SYS Image Path: C:\WINDOWS\System32\Drivers\ParVdm.SYS Address: 0xBA65E000 Size: 7040 File Visible: - Signed: - Status: - Name: pci.sys Image Path: pci.sys Address: 0xB9E5C000 Size: 68224 File Visible: - Signed: - Status: - Name: PCI_PNP2970 Image Path: \Driver\PCI_PNP2970 Address: 0x00000000 Size: 0 File Visible: No Signed: - Status: - Name: pciide.sys Image Path: pciide.sys Address: 0xBA670000 Size: 3328 File Visible: - Signed: - Status: - Name: PCIIDEX.SYS Image Path: C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS Address: 0xBA328000 Size: 28672 File Visible: - Signed: - Status: - Name: PnpManager Image Path: \Driver\PnpManager Address: 0x804D7000 Size: 2146304 File Visible: - Signed: - Status: - Name: portcls.sys Image Path: C:\WINDOWS\system32\drivers\portcls.sys Address: 0xA8D06000 Size: 139264 File Visible: - Signed: - Status: - Name: psched.sys Image Path: C:\WINDOWS\system32\DRIVERS\psched.sys Address: 0xB931D000 Size: 69120 File Visible: - Signed: - Status: - Name: ptilink.sys Image Path: C:\WINDOWS\system32\DRIVERS\ptilink.sys Address: 0xBA348000 Size: 17792 File Visible: - Signed: - Status: - Name: rasacd.sys Image Path: C:\WINDOWS\system32\DRIVERS\rasacd.sys Address: 0xBA590000 Size: 8832 File Visible: - Signed: - Status: - Name: rasl2tp.sys Image Path: C:\WINDOWS\system32\DRIVERS\rasl2tp.sys Address: 0xBA2E8000 Size: 51328 File Visible: - Signed: - Status: - Name: raspppoe.sys Image Path: C:\WINDOWS\system32\DRIVERS\raspppoe.sys Address: 0xBA2F8000 Size: 41472 File Visible: - Signed: - Status: - Name: raspptp.sys Image Path: C:\WINDOWS\system32\DRIVERS\raspptp.sys Address: 0xBA308000 Size: 48384 File Visible: - Signed: - Status: - Name: raspti.sys Image Path: C:\WINDOWS\system32\DRIVERS\raspti.sys Address: 0xBA350000 Size: 16512 File Visible: - Signed: - Status: - Name: RAW Image Path: \FileSystem\RAW Address: 0x804D7000 Size: 2146304 File Visible: - Signed: - Status: - Name: rdbss.sys Image Path: C:\WINDOWS\system32\DRIVERS\rdbss.sys Address: 0xA8A18000 Size: 176512 File Visible: - Signed: - Status: - Name: RDPCDD.sys Image Path: C:\WINDOWS\System32\DRIVERS\RDPCDD.sys Address: 0xBA604000 Size: 4224 File Visible: - Signed: - Status: - Name: redbook.sys Image Path: C:\WINDOWS\system32\DRIVERS\redbook.sys Address: 0xBA2D8000 Size: 57600 File Visible: - Signed: - Status: - Name: RootMdm.sys Image Path: C:\WINDOWS\System32\Drivers\RootMdm.sys Address: 0xBA5F4000 Size: 5888 File Visible: - Signed: - Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xA72B5000 Size: 49152 File Visible: No Signed: - Status: - Name: rt73.sys Image Path: C:\WINDOWS\system32\DRIVERS\rt73.sys Address: 0xA8C14000 Size: 451968 File Visible: - Signed: - Status: - Name: Rtenicxp.sys Image Path: C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys Address: 0xB93FD000 Size: 103296 File Visible: - Signed: - Status: - Name: RtkHDAud.sys Image Path: C:\WINDOWS\system32\drivers\RtkHDAud.sys Address: 0xA8D28000 Size: 4820992 File Visible: - Signed: - Status: - Name: Rtnicxp.sys Image Path: C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys Address: 0xB93C6000 Size: 80512 File Visible: - Signed: - Status: - Name: SCSIPORT.SYS Image Path: C:\WINDOWS\System32\Drivers\SCSIPORT.SYS Address: 0xB9E9C000 Size: 98304 File Visible: - Signed: - Status: - Name: secdrv.sys Image Path: C:\WINDOWS\system32\DRIVERS\secdrv.sys Address: 0xA82E6000 Size: 11200 File Visible: - Signed: - Status: - Name: serenum.sys Image Path: C:\WINDOWS\system32\DRIVERS\serenum.sys Address: 0xB9CBF000 Size: 15488 File Visible: - Signed: - Status: - Name: serial.sys Image Path: C:\WINDOWS\system32\DRIVERS\serial.sys Address: 0xB93B5000 Size: 65920 File Visible: - Signed: - Status: - Name: sfdrv01.sys Image Path: sfdrv01.sys Address: 0xB9CFE000 Size: 73728 File Visible: - Signed: - Status: - Name: sfhlp02.sys Image Path: sfhlp02.sys Address: 0xBA338000 Size: 32768 File Visible: - Signed: - Status: - Name: sfvfs02.sys Image Path: sfvfs02.sys Address: 0xB9D10000 Size: 77824 File Visible: - Signed: - Status: - Name: sphu.sys Image Path: sphu.sys Address: 0xB9EB4000 Size: 995328 File Visible: No Signed: - Status: - Name: sptd Image Path: \Driver\sptd Address: 0x00000000 Size: 0 File Visible: No Signed: - Status: - Name: sr.sys Image Path: sr.sys Address: 0xB9DF4000 Size: 73472 File Visible: - Signed: - Status: - Name: srv.sys Image Path: C:\WINDOWS\system32\DRIVERS\srv.sys Address: 0xA824B000 Size: 352640 File Visible: - Signed: - Status: - Name: ssmdrv.sys Image Path: C:\WINDOWS\system32\DRIVERS\ssmdrv.sys Address: 0xBA400000 Size: 23040 File Visible: - Signed: - Status: - Name: swenum.sys Image Path: C:\WINDOWS\system32\DRIVERS\swenum.sys Address: 0xBA5F6000 Size: 4352 File Visible: - Signed: - Status: - Name: sysaudio.sys Image Path: C:\WINDOWS\system32\drivers\sysaudio.sys Address: 0xA811B000 Size: 60800 File Visible: - Signed: - Status: - Name: tcpip.sys Image Path: C:\WINDOWS\system32\DRIVERS\tcpip.sys Address: 0xA8BBC000 Size: 360320 File Visible: - Signed: - Status: - Name: tcpip6.sys Image Path: C:\WINDOWS\system32\DRIVERS\tcpip6.sys Address: 0xA8A9B000 Size: 226880 File Visible: - Signed: - Status: - Name: TDI.SYS Image Path: C:\WINDOWS\system32\DRIVERS\TDI.SYS Address: 0xBA4B0000 Size: 20480 File Visible: - Signed: - Status: - Name: termdd.sys Image Path: C:\WINDOWS\system32\DRIVERS\termdd.sys Address: 0xBA118000 Size: 40704 File Visible: - Signed: - Status: - Name: truecrypt.sys Image Path: C:\WINDOWS\System32\drivers\truecrypt.sys Address: 0xA8A44000 Size: 215808 File Visible: - Signed: - Status: - Name: tunmp.sys Image Path: C:\WINDOWS\system32\DRIVERS\tunmp.sys Address: 0xBA5A4000 Size: 12416 File Visible: - Signed: - Status: - Name: update.sys Image Path: C:\WINDOWS\system32\DRIVERS\update.sys Address: 0xB92E9000 Size: 209408 File Visible: - Signed: - Status: - Name: usbccgp.sys Image Path: C:\WINDOWS\system32\DRIVERS\usbccgp.sys Address: 0xBA3E0000 Size: 31616 File Visible: - Signed: - Status: - Name: USBD.SYS Image Path: C:\WINDOWS\system32\DRIVERS\USBD.SYS Address: 0xBA5FA000 Size: 8192 File Visible: - Signed: - Status: - Name: usbehci.sys Image Path: C:\WINDOWS\system32\DRIVERS\usbehci.sys Address: 0xBA448000 Size: 26624 File Visible: - Signed: - Status: - Name: usbhub.sys Image Path: C:\WINDOWS\system32\DRIVERS\usbhub.sys Address: 0xBA158000 Size: 57600 File Visible: - Signed: - Status: - Name: USBPORT.SYS Image Path: C:\WINDOWS\system32\DRIVERS\USBPORT.SYS Address: 0xB93DA000 Size: 143360 File Visible: - Signed: - Status: - Name: usbuhci.sys Image Path: C:\WINDOWS\system32\DRIVERS\usbuhci.sys Address: 0xBA440000 Size: 20480 File Visible: - Signed: - Status: - Name: vga.sys Image Path: C:\WINDOWS\System32\drivers\vga.sys Address: 0xBA3C8000 Size: 20992 File Visible: - Signed: - Status: - Name: VIDEOPRT.SYS Image Path: C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS Address: 0xB943C000 Size: 81920 File Visible: - Signed: - Status: - Name: VolSnap.sys Image Path: VolSnap.sys Address: 0xBA0C8000 Size: 53760 File Visible: - Signed: - Status: - Name: wanarp.sys Image Path: C:\WINDOWS\system32\DRIVERS\wanarp.sys Address: 0xBA188000 Size: 34560 File Visible: - Signed: - Status: - Name: watchdog.sys Image Path: C:\WINDOWS\System32\watchdog.sys Address: 0xBA418000 Size: 20480 File Visible: - Signed: - Status: - Name: wdmaud.sys Image Path: C:\WINDOWS\system32\drivers\wdmaud.sys Address: 0xA7E7E000 Size: 82944 File Visible: - Signed: - Status: - Name: Win32k Image Path: \Driver\Win32k Address: 0xBF800000 Size: 1851392 File Visible: - Signed: - Status: - Name: win32k.sys Image Path: C:\WINDOWS\System32\win32k.sys Address: 0xBF800000 Size: 1851392 File Visible: - Signed: - Status: - Name: WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\WMILIB.SYS Address: 0xBA5AA000 Size: 8192 File Visible: - Signed: - Status: - Name: WMIxWDM Image Path: \Driver\WMIxWDM Address: 0x804D7000 Size: 2146304 File Visible: - Signed: - Status: - eine frage, wozu braucht man soviele verschiedene scans? |
Liste der Anhänge anzeigen (Anzahl: 1) Zitat:
du hast hier leider nur die Drivers gescannt. Bitte folge der RootRepeal Anleitung. Anhang 7483 Rootrepeal öffnen und dann gehe auf REPORT. Siehe auch die beigefügte Grafik. Bitte den Scan erneut durchführen, wie beschrieben und das Log posten. Zitat:
lg. ********************************************** |
hoffe mal diesmal ist es das richtige |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 13:56 Uhr. |
Copyright ©2000-2025, Trojaner-Board