Trojaner-Board
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   :( :( :( noch ein antimalware doc opfer.ratlos! :( (https://www.trojaner-board.de/90561-noch-antimalware-doc-opfer-ratlos.html)

hateTrojan 22.09.2010 16:17
All processes killed
========== OTL ==========
No active process named 2123905.exe was found!
No active process named 28299.exe was found!
No active process named xtkbs.exe was found!
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\mwcenrsaxo.exe not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\xtkbs.exe not found.
File C:\Users\*****\AppData\Local\Temp\xtkbs.exe not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\mwcenrsaxo.exe not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\TaskMan not found.
File C:\Users\*****\AppData\Roaming\ohydy.exe not found.
D:\AUTOMODE moved successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\\helptvol:C:\Windows\system32\cleaosk.dll deleted successfully.
File C:\Users\*****\AppData\Roaming\ohydy.exe not found.
C:\Users\*****\AppData\Local\Windows Server folder moved successfully.
C:\Users\*****\AppData\Roaming\B12491E320CBB39863A02EF2A3860B11 folder moved successfully.
File C:\Windows\System32\drivers\xxbsdja.sys not found.
File C:\Windows\System32\drivers\cnywu.sys not found.
File C:\Users\*****\AppData\Local\aclcoreamd.exe not found.
Folder C:\Users\*****\AppData\Roaming\B12491E320CBB39863A02EF2A3860B11\ not found.
ADS C:\ProgramData\Temp:82591FF7 deleted successfully.
ADS C:\ProgramData\Temp:3A6BC948 deleted successfully.
ADS C:\ProgramData\Temp:AC9C6AC1 deleted successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: admo
->Temp folder emptied: 97098 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 41661 bytes

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 41661 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Guest
->Temp folder emptied: 907864 bytes
->Temporary Internet Files folder emptied: 95647380 bytes
->Java cache emptied: 24497735 bytes
->FireFox cache emptied: 40747538 bytes
->Flash cache emptied: 5182 bytes

User: *****
->Temp folder emptied: 3369030875 bytes
->Temporary Internet Files folder emptied: 140718235 bytes
->Java cache emptied: 86498362 bytes
->FireFox cache emptied: 91061862 bytes
->Google Chrome cache emptied: 13818871 bytes
->Flash cache emptied: 472851 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 109051314 bytes
RecycleBin emptied: 137918 bytes

Total Files Cleaned = 3.789,00 mb


OTL by OldTimer - Version 3.2.12.0 log created on 09222010_171019

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...




...ok erledigt!danke.
is alles wieder gut oder gibts noch mehr zu machen? :)

cosinus 22.09.2010 20:19
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.
http://saved.im/mtm0nzyzmzd5/cofi.jpg
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

hateTrojan 23.09.2010 12:56
phu also hab alles gemacht was ich sollte,...nur gestern als alles dann fertig war u er im prozess ca 3 mal neu gestartet hat ging weder mein inet noch sonstige programme (spiele etc). es stand dann immer in einem kleinen fenster dass der pfad geloescht wurde ( od so aehnlich, ich habs leider nicht aufgeschrieben) hab dann abgeschalten u heute geht wieder alles.

hier ist die log datei:

Combofix Logfile:
Code:
ComboFix 10-09-22.02 - ***** 23.09.2010  0:12.1.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6002.2.1252.44.1033.18.2046.1338 [GMT 2:00]
Running from: c:\users\*****\Desktop\cofi.exe
 * Created a new restore point
.

(((((((((((((((((((((((((((((((((((((((  Other Deletions  )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Mozilla Firefox\components\npclntax.xpt
c:\windows\system32\KBL.LOG
c:\windows\system32\muzapp.exe

Infected copy of c:\windows\system32\DRIVERS\RDPCDD.sys was found and disinfected
Restored copy from - Kitty ate it :p
.
(((((((((((((((((((((((((  Files Created from 2010-08-22 to 2010-09-22  )))))))))))))))))))))))))))))))
.

2010-09-22 22:34 . 2010-09-22 22:37        --------        d-----w-        c:\users\*****\AppData\Local\temp
2010-09-22 19:46 . 2010-09-22 19:46        --------        d-----w-        c:\program files\CCleaner
2010-09-22 15:10 . 2010-09-22 15:10        --------        d-----w-        C:\_OTL
2010-09-22 09:08 . 2010-09-22 09:08        --------        d-----w-        c:\users\*****\AppData\Roaming\funkitron
2010-09-17 11:44 . 2010-09-17 11:44        --------        d-----w-        c:\users\*****\AppData\Roaming\PC Suite
2010-09-17 11:44 . 2010-09-17 11:44        --------        d-----w-        c:\programdata\PC Suite
2010-09-17 11:42 . 2009-09-19 05:30        98432        ----a-w-        c:\windows\system32\drivers\ss_bbus.sys
2010-09-17 11:42 . 2009-09-19 05:30        14848        ----a-w-        c:\windows\system32\drivers\ss_bmdfl.sys
2010-09-17 11:42 . 2009-09-19 05:30        12416        ----a-w-        c:\windows\system32\drivers\ss_bcmnt.sys
2010-09-17 11:42 . 2009-09-19 05:30        12416        ----a-w-        c:\windows\system32\drivers\ss_bcm.sys
2010-09-17 11:42 . 2009-09-19 05:30        123648        ----a-w-        c:\windows\system32\drivers\ss_bmdm.sys
2010-09-17 11:38 . 2010-09-17 11:38        --------        d-----w-        c:\program files\Common Files\Samsung
2010-09-08 21:33 . 2010-09-08 21:33        --------        d-----w-        c:\users\admo\AppData\Roaming\Hewlett-Packard
2010-09-08 21:32 . 2010-09-08 21:32        --------        d-----w-        c:\users\admo\AppData\Local\Hewlett-Packard
2010-09-08 21:32 . 2010-09-08 21:32        --------        d-----w-        c:\users\admo\AppData\Local\QuickPlay
2010-09-08 21:32 . 2010-09-08 21:32        106408        ----a-w-        c:\users\admo\AppData\Local\GDIPFONTCACHEV1.DAT
2010-09-08 21:31 . 2010-09-08 21:31        --------        d-----w-        c:\users\admo\AppData\Roaming\Malwarebytes
2010-09-07 17:44 . 2010-09-07 17:44        --------        d-----w-        c:\users\*****\AppData\Roaming\Malwarebytes
2010-09-07 17:44 . 2010-04-29 13:39        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-07 17:44 . 2010-09-08 21:38        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2010-09-07 17:44 . 2010-09-07 17:44        --------        d-----w-        c:\programdata\Malwarebytes
2010-09-07 17:44 . 2010-04-29 13:39        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
2010-09-06 20:21 . 2010-09-06 20:21        --------        d-----w-        c:\users\*****\AppData\Roaming\PeerNetworking
2010-09-06 15:06 . 2010-09-06 15:06        --------        d-----w-        c:\program files\Conduit
2010-09-06 15:06 . 2010-09-06 15:06        --------        d-----w-        c:\program files\DVDVideoSoftTB
2010-09-06 15:06 . 2010-09-06 15:06        --------        d-----w-        c:\users\*****\AppData\Roaming\DVDVideoSoftIEHelpers
2010-09-03 18:20 . 2010-05-27 20:08        81920        ----a-w-        c:\windows\system32\iccvid.dll
2010-09-03 18:20 . 2010-06-11 16:16        274944        ----a-w-        c:\windows\system32\schannel.dll
2010-09-03 18:20 . 2010-06-21 13:37        2037760        ----a-w-        c:\windows\system32\win32k.sys
2010-09-03 18:20 . 2010-06-18 17:31        36864        ----a-w-        c:\windows\system32\rtutils.dll
2010-09-03 18:19 . 2010-06-11 16:15        1248768        ----a-w-        c:\windows\system32\msxml3.dll
2010-09-03 18:19 . 2010-06-08 17:35        3548040        ----a-w-        c:\windows\system32\ntoskrnl.exe
2010-09-03 18:19 . 2010-06-08 17:35        3600768        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2010-09-03 18:19 . 2010-06-18 15:04        302080        ----a-w-        c:\windows\system32\drivers\srv.sys
2010-09-03 18:19 . 2010-06-18 15:04        144896        ----a-w-        c:\windows\system32\drivers\srv2.sys
2010-09-03 18:19 . 2010-06-16 16:04        905088        ----a-w-        c:\windows\system32\drivers\tcpip.sys

.
((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-22 17:51 . 2008-12-12 13:06        --------        d-----w-        c:\programdata\Google Updater
2010-09-22 09:07 . 2008-03-30 12:38        --------        d-----w-        c:\programdata\WildTangent
2010-09-17 11:43 . 2007-10-24 15:26        --------        d--h--w-        c:\program files\InstallShield Installation Information
2010-09-17 11:42 . 2010-09-17 11:38        --------        d-----w-        c:\program files\Samsung
2010-09-17 11:41 . 2010-09-17 11:41        --------        d-----w-        c:\program files\DIFX
2010-09-17 11:41 . 2010-09-17 11:39        --------        d-----w-        c:\program files\PC Connectivity Solution
2010-09-17 11:41 . 2010-09-17 11:38        --------        d-----w-        c:\programdata\Samsung
2010-09-17 11:38 . 2010-09-17 11:38        --------        d-----w-        c:\users\*****\AppData\Roaming\Samsung
2010-09-17 11:38 . 2010-09-17 11:38        --------        d-----w-        c:\program files\MarkAny
2010-09-08 16:28 . 2008-11-05 19:17        --------        d-----w-        c:\users\*****\AppData\Roaming\uTorrent
2010-09-05 19:34 . 2007-10-24 16:38        --------        d-----w-        c:\program files\Microsoft Works
2010-09-05 19:22 . 2007-10-24 17:01        --------        d-----w-        c:\programdata\Microsoft Help
2010-09-05 19:20 . 2006-11-02 11:18        --------        d-----w-        c:\program files\Windows Mail
2010-09-03 18:20 . 2008-11-28 22:12        --------        d-----w-        c:\users\*****\AppData\Roaming\Skype
2010-09-03 17:54 . 2008-11-28 22:16        --------        d-----w-        c:\users\*****\AppData\Roaming\skypePM
2010-06-26 06:05 . 2010-09-03 18:40        916480        ----a-w-        c:\windows\system32\wininet.dll
2010-06-26 06:02 . 2010-09-03 18:40        71680        ----a-w-        c:\windows\system32\iesetup.dll
2010-06-26 06:02 . 2010-09-03 18:40        109056        ----a-w-        c:\windows\system32\iesysprep.dll
2010-06-26 04:25 . 2010-09-03 18:40        133632        ----a-w-        c:\windows\system32\ieUnatt.exe
.

(((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\tbDVDV.dll" [2010-04-27 2393184]

[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
2010-04-27 08:08        2393184        ----a-w-        c:\program files\DVDVideoSoftTB\tbDVDV.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\tbDVDV.dll" [2010-04-27 2393184]

[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{872B5B88-9DB5-4310-BDD0-AC189557E5F5}"= "c:\program files\DVDVideoSoftTB\tbDVDV.dll" [2010-04-27 2393184]

[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KiesTrayAgent"="c:\program files\Samsung\Kies\" [X]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-12 39408]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan.lnk - c:\program files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-28 199184]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"RequireSignedAppInit_DLLs"=1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]
@="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2009-12-22 135664]
R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys [2009-09-19 98432]
R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys [2009-09-19 14848]
R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys [2009-09-19 123648]
R3 ss_bserd;SAMSUNG USB Mobile Logging Driver;c:\windows\system32\DRIVERS\ss_bserd.sys [2009-09-19 100224]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S1 uigxrdr;uigxrdr;c:\windows\system32\DRIVERS\uigxrdr.sys [2008-07-29 272384]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
S2 dgdersvc;Device Error Recovery Service;c:\windows\system32\dgdersvc.exe [2009-12-22 95568]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2009-12-22 217088]
S2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [2008-06-10 222456]
S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [2009-12-22 18136]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2009-12-22 36640]


--- Other Services/Drivers In Memory ---

*Deregistered* - xxbsdja

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation        REG_MULTI_SZ          FontCache

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-08-23 17:34        451872        ----a-w-        c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-09-22 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-28 08:10]

2010-09-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-22 20:12]

2010-09-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-22 20:12]

2010-06-15 c:\windows\Tasks\HPCeeScheduleFor*****.job
- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2007-10-24 18:58]

2010-09-22 c:\windows\Tasks\User_Feed_Synchronization-{8F90BF23-9CF4-4FB0-976F-A39A46C2B0C7}.job
- c:\windows\system32\msfeedssync.exe [2010-09-03 04:24]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.at/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_gb&c=81&bd=Pavilion&pf=laptop
uInternet Settings,ProxyOverride = *.local
IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-GB\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
DPF: {59136DB4-6CA3-4B40-8F2F-BBF84B6F1E91} - hxxps://stream.web.de/mail/activex/mail_upload_11213.cab
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game05.zylom.com/activex/zylomgamesplayer.cab
FF - ProfilePath - c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\mbf4as2b.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT2269050&SearchSource=13
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&q=
FF - component: c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\mbf4as2b.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\FFExternalAlert.dll
FF - component: c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\mbf4as2b.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\RadioWMPCore.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHANS REMOVED - - - -

SafeBoot-dmboot.sys
SafeBoot-dmio.sys
SafeBoot-dmload.sys
SafeBoot-dmadmin
SafeBoot-dmserver
SafeBoot-SRService
AddRemove-01_Simmental - c:\program files\SAMSUNG\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\SAMSUNG\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\SAMSUNG\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-07_Schorl - c:\program files\SAMSUNG\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-15_Symbian_Samsung_PC_DLC_Driver - c:\program files\SAMSUNG\USB Drivers\15_Symbian_Samsung_PC_DLC_Driver\Uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-09-23 00:37
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ... 

scanning hidden autostart entries ...

scanning hidden files ... 

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\xxbsdja]

.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\LEXBCES.EXE
c:\windows\System32\LEXPPS.EXE
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\crypserv.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\system32\WUDFHost.exe
c:\program files\HP\QuickPlay\Kernel\TV\QPSched.exe
c:\windows\system32\conime.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Completion time: 2010-09-23  00:48:27 - machine was rebooted
ComboFix-quarantined-files.txt  2010-09-22 22:48

Pre-Run: 10.630.643.712 bytes free
Post-Run: 10.577.039.360 bytes free

- - End Of File - - 0DBE6913B8DDFFD1BAA01C6E29212433
--- --- ---

cosinus 23.09.2010 15:09
Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:
Registry::
[-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\xxbsdja]

File::
c:\windows\system32\drivers\dgderdrv.sys

Driver:
dgderdrv
3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

hateTrojan 23.09.2010 16:22
ok erledigt.
diesmal ist wieder dieser error gekomme als ich den inet explorer wieder oeffnen wollte "illegal operation attempted on a registry key that has been marked for deletion" ...erst wenn ich den laptop selbst noch mal ab u aufdrehe geht alles wieder...ist das normal?

Combofix Logfile:
Code:
ComboFix 10-09-22.02 - ***** 23.09.2010  16:34:20.2.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6002.2.1252.44.1033.18.2046.1288 [GMT 2:00]
Running from: c:\users\*****\Desktop\cofi.exe
Command switches used :: c:\users\*****\Desktop\CFScript.txt
 * Created a new restore point

FILE ::
"c:\windows\system32\drivers\dgderdrv.sys"
.

(((((((((((((((((((((((((((((((((((((((  Other Deletions  )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\dgderdrv.sys

.
(((((((((((((((((((((((((((((((((((((((  Drivers/Services  )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_dgderdrv
-------\Service_dgderdrv


(((((((((((((((((((((((((  Files Created from 2010-08-23 to 2010-09-23  )))))))))))))))))))))))))))))))
.

2010-09-23 14:43 . 2010-09-23 14:53        --------        d-----w-        c:\users\*****\AppData\Local\temp
2010-09-23 14:43 . 2010-09-23 14:43        --------        d-----w-        c:\users\Public\AppData\Local\temp
2010-09-23 14:43 . 2010-09-23 14:43        --------        d-----w-        c:\users\Guest\AppData\Local\temp
2010-09-23 14:43 . 2010-09-23 14:43        --------        d-----w-        c:\users\Default\AppData\Local\temp
2010-09-23 14:43 . 2010-09-23 14:43        --------        d-----w-        c:\users\admo\AppData\Local\temp
2010-09-23 14:32 . 2010-09-23 14:32        --------        d-----w-        C:\32788R22FWJFW
2010-09-23 11:42 . 2010-09-23 14:53        --------        d-----w-        c:\windows\system32\MpEngineStore
2010-09-22 22:53 . 2010-04-05 17:02        317952        ----a-w-        c:\windows\system32\MP4SDECD.DLL
2010-09-22 22:51 . 2010-05-27 20:08        739328        ----a-w-        c:\windows\system32\inetcomm.dll
2010-09-22 19:46 . 2010-09-22 19:46        --------        d-----w-        c:\program files\CCleaner
2010-09-22 15:10 . 2010-09-22 15:10        --------        d-----w-        C:\_OTL
2010-09-22 09:08 . 2010-09-22 09:08        --------        d-----w-        c:\users\*****\AppData\Roaming\funkitron
2010-09-17 11:44 . 2010-09-17 11:44        --------        d-----w-        c:\users\*****\AppData\Roaming\PC Suite
2010-09-17 11:44 . 2010-09-17 11:44        --------        d-----w-        c:\programdata\PC Suite
2010-09-17 11:42 . 2009-09-19 05:30        98432        ----a-w-        c:\windows\system32\drivers\ss_bbus.sys
2010-09-17 11:42 . 2009-09-19 05:30        14848        ----a-w-        c:\windows\system32\drivers\ss_bmdfl.sys
2010-09-17 11:42 . 2009-09-19 05:30        12416        ----a-w-        c:\windows\system32\drivers\ss_bcmnt.sys
2010-09-17 11:42 . 2009-09-19 05:30        12416        ----a-w-        c:\windows\system32\drivers\ss_bcm.sys
2010-09-17 11:42 . 2009-09-19 05:30        123648        ----a-w-        c:\windows\system32\drivers\ss_bmdm.sys
2010-09-17 11:38 . 2010-09-17 11:38        --------        d-----w-        c:\program files\Common Files\Samsung
2010-09-08 21:33 . 2010-09-08 21:33        --------        d-----w-        c:\users\admo\AppData\Roaming\Hewlett-Packard
2010-09-08 21:32 . 2010-09-08 21:32        --------        d-----w-        c:\users\admo\AppData\Local\Hewlett-Packard
2010-09-08 21:32 . 2010-09-08 21:32        --------        d-----w-        c:\users\admo\AppData\Local\QuickPlay
2010-09-08 21:32 . 2010-09-08 21:32        106408        ----a-w-        c:\users\admo\AppData\Local\GDIPFONTCACHEV1.DAT
2010-09-08 21:31 . 2010-09-08 21:31        --------        d-----w-        c:\users\admo\AppData\Roaming\Malwarebytes
2010-09-07 17:44 . 2010-09-07 17:44        --------        d-----w-        c:\users\*****\AppData\Roaming\Malwarebytes
2010-09-07 17:44 . 2010-04-29 13:39        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-07 17:44 . 2010-09-08 21:38        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2010-09-07 17:44 . 2010-09-07 17:44        --------        d-----w-        c:\programdata\Malwarebytes
2010-09-07 17:44 . 2010-04-29 13:39        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
2010-09-06 20:21 . 2010-09-06 20:21        --------        d-----w-        c:\users\*****\AppData\Roaming\PeerNetworking
2010-09-06 15:06 . 2010-09-06 15:06        --------        d-----w-        c:\program files\Conduit
2010-09-06 15:06 . 2010-09-06 15:06        --------        d-----w-        c:\program files\DVDVideoSoftTB
2010-09-06 15:06 . 2010-09-06 15:06        --------        d-----w-        c:\users\*****\AppData\Roaming\DVDVideoSoftIEHelpers
2010-09-03 18:20 . 2010-05-27 20:08        81920        ----a-w-        c:\windows\system32\iccvid.dll
2010-09-03 18:20 . 2010-06-11 16:16        274944        ----a-w-        c:\windows\system32\schannel.dll
2010-09-03 18:20 . 2010-06-21 13:37        2037760        ----a-w-        c:\windows\system32\win32k.sys
2010-09-03 18:20 . 2010-06-18 17:31        36864        ----a-w-        c:\windows\system32\rtutils.dll
2010-09-03 18:19 . 2010-06-11 16:15        1248768        ----a-w-        c:\windows\system32\msxml3.dll
2010-09-03 18:19 . 2010-06-08 17:35        3548040        ----a-w-        c:\windows\system32\ntoskrnl.exe
2010-09-03 18:19 . 2010-06-08 17:35        3600768        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2010-09-03 18:19 . 2010-06-18 15:04        302080        ----a-w-        c:\windows\system32\drivers\srv.sys
2010-09-03 18:19 . 2010-06-18 15:04        144896        ----a-w-        c:\windows\system32\drivers\srv2.sys
2010-09-03 18:19 . 2010-06-16 16:04        905088        ----a-w-        c:\windows\system32\drivers\tcpip.sys

.
((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-23 14:48 . 2009-03-04 16:30        --------        d-----w-        c:\program files\Microsoft Silverlight
2010-09-23 11:43 . 2007-10-24 17:01        --------        d-----w-        c:\programdata\Microsoft Help
2010-09-23 11:38 . 2006-11-02 11:18        --------        d-----w-        c:\program files\Windows Mail
2010-09-23 11:30 . 2008-03-30 12:38        --------        d-----w-        c:\programdata\WildTangent
2010-09-23 11:30 . 2008-05-02 21:47        8268        ----a-w-        c:\users\*****\AppData\Local\d3d9caps.dat
2010-09-22 22:52 . 2008-05-02 19:23        106408        ----a-w-        c:\users\*****\AppData\Local\GDIPFONTCACHEV1.DAT
2010-09-22 17:51 . 2008-12-12 13:06        --------        d-----w-        c:\programdata\Google Updater
2010-09-17 11:43 . 2007-10-24 15:26        --------        d--h--w-        c:\program files\InstallShield Installation Information
2010-09-17 11:42 . 2010-09-17 11:38        --------        d-----w-        c:\program files\Samsung
2010-09-17 11:41 . 2010-09-17 11:41        --------        d-----w-        c:\program files\DIFX
2010-09-17 11:41 . 2010-09-17 11:39        --------        d-----w-        c:\program files\PC Connectivity Solution
2010-09-17 11:41 . 2010-09-17 11:38        --------        d-----w-        c:\programdata\Samsung
2010-09-17 11:38 . 2010-09-17 11:38        --------        d-----w-        c:\users\*****\AppData\Roaming\Samsung
2010-09-17 11:38 . 2010-09-17 11:38        --------        d-----w-        c:\program files\MarkAny
2010-09-14 16:22 . 2009-02-23 22:30        1        ----a-w-        c:\users\*****\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-09-13 23:58 . 2010-09-13 23:58        452104        ----a-w-        c:\users\*****\AppData\Roaming\Real\Update\setup3.12\setup.exe
2010-09-08 16:28 . 2008-11-05 19:17        --------        d-----w-        c:\users\*****\AppData\Roaming\uTorrent
2010-09-06 15:06 . 2010-09-06 15:06        52224        ----a-w-        c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\mbf4as2b.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\FFExternalAlert.dll
2010-09-06 15:06 . 2010-09-06 15:06        101376        ----a-w-        c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\mbf4as2b.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\RadioWMPCore.dll
2010-09-05 19:34 . 2007-10-24 16:38        --------        d-----w-        c:\program files\Microsoft Works
2010-09-03 18:20 . 2008-11-28 22:12        --------        d-----w-        c:\users\*****\AppData\Roaming\Skype
2010-09-03 17:54 . 2008-11-28 22:16        --------        d-----w-        c:\users\*****\AppData\Roaming\skypePM
2010-07-03 16:20 . 2010-05-20 18:19        439816        ----a-w-        c:\users\*****\AppData\Roaming\Real\Update\setup3.10\setup.exe
2010-06-26 06:05 . 2010-09-03 18:40        916480        ----a-w-        c:\windows\system32\wininet.dll
2010-06-26 06:02 . 2010-09-03 18:40        71680        ----a-w-        c:\windows\system32\iesetup.dll
2010-06-26 06:02 . 2010-09-03 18:40        109056        ----a-w-        c:\windows\system32\iesysprep.dll
2010-06-26 04:25 . 2010-09-03 18:40        133632        ----a-w-        c:\windows\system32\ieUnatt.exe
.

(((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\tbDVDV.dll" [2010-04-27 2393184]

[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]
2010-04-27 08:08        2393184        ----a-w-        c:\program files\DVDVideoSoftTB\tbDVDV.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\tbDVDV.dll" [2010-04-27 2393184]

[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{872B5B88-9DB5-4310-BDD0-AC189557E5F5}"= "c:\program files\DVDVideoSoftTB\tbDVDV.dll" [2010-04-27 2393184]

[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KiesTrayAgent"="c:\program files\Samsung\Kies\" [X]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-12-12 39408]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan.lnk - c:\program files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-28 199184]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"RequireSignedAppInit_DLLs"=1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]
@="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 dgdersvc;Device Error Recovery Service;c:\windows\system32\dgdersvc.exe [2009-12-22 95568]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2009-12-22 135664]
R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys [2009-09-19 98432]
R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys [2009-09-19 14848]
R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys [2009-09-19 123648]
R3 ss_bserd;SAMSUNG USB Mobile Logging Driver;c:\windows\system32\DRIVERS\ss_bserd.sys [2009-09-19 100224]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2009-12-22 217088]
S2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [2008-06-10 222456]


--- Other Services/Drivers In Memory ---

*Deregistered* - xxbsdja

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation        REG_MULTI_SZ          FontCache

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-08-23 17:34        451872        ----a-w-        c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-09-23 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-28 08:10]

2010-09-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-22 20:12]

2010-09-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-22 20:12]

2010-06-15 c:\windows\Tasks\HPCeeScheduleFor*****.job
- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2007-10-24 18:58]

2010-09-23 c:\windows\Tasks\User_Feed_Synchronization-{8F90BF23-9CF4-4FB0-976F-A39A46C2B0C7}.job
- c:\windows\system32\msfeedssync.exe [2010-09-03 04:24]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.at/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_gb&c=81&bd=Pavilion&pf=laptop
uInternet Settings,ProxyOverride = *.local
IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-GB\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
DPF: {59136DB4-6CA3-4B40-8F2F-BBF84B6F1E91} - hxxps://stream.web.de/mail/activex/mail_upload_11213.cab
DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game05.zylom.com/activex/zylomgamesplayer.cab
FF - ProfilePath - c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\mbf4as2b.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT2269050&SearchSource=13
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&q=
FF - component: c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\mbf4as2b.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\FFExternalAlert.dll
FF - component: c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\mbf4as2b.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\RadioWMPCore.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-09-23 16:51
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ... 

scanning hidden autostart entries ...

scanning hidden files ... 

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\xxbsdja]

.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Other Running Processes ------------------------
.
c:\windows\servicing\TrustedInstaller.exe
c:\windows\System32\LEXBCES.EXE
c:\windows\System32\LEXPPS.EXE
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\crypserv.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\system32\WUDFHost.exe
c:\program files\HP\QuickPlay\Kernel\TV\QPSched.exe
c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
c:\windows\system32\conime.exe
c:\windows\System32\mrt.exe
c:\windows\system32\wbem\unsecapp.exe
.
**************************************************************************
.
Completion time: 2010-09-23  17:01:42 - machine was rebooted
ComboFix-quarantined-files.txt  2010-09-23 15:01
ComboFix2.txt  2010-09-22 22:48

Pre-Run: 9.718.607.872 bytes free
Post-Run: 9.610.960.896 bytes free

Current=1 Default=1 Failed=0 LastKnownGood=1 Sets=1,2,3,4
- - End Of File - - DC51F7900051C9753376BF48ABC77622
--- --- ---







DANKEEEEE ARNE!!!

cosinus 23.09.2010 21:06
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus

Anschließend den bootkit_remover herunterladen. Entpacke das Tool in einen eigenen Ordner auf dem Desktop und führe in diesem Ordner die Datei remove.exe aus.

Wenn Du Windows Vista oder Windows 7 verwendest, musst Du die remover.exe über ein Rechtsklick => als Administrator ausführen

Ein schwarzes Fenster wird sich öffnen und automatisch nach bösartigen Veränderungen im MBR suchen.
Poste dann bitte, ob es Veränderungen gibt und wenn ja in welchem device. Am besten alles posten was die remover.exe ausgibt.


Alle Zeitangaben in WEZ +1. Es ist jetzt 11:36 Uhr.
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131