Trojaner-Board
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   TR/Kazy/mekl.1 - Auch mich hats erwischt - Alle Dateien weg (https://www.trojaner-board.de/98021-tr-kazy-mekl-1-mich-hats-erwischt-alle-dateien-weg.html)

jexsen 28.04.2011 20:02
Hi,

hier der Log von GMER

Code:
GMER 1.0.15.15570 - hxxp://www.gmer.net
Rootkit scan 2011-04-28 20:59:05
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 FUJITSU_MHW2160BH_PL rev.0000001C
Running: cuj63pu7.exe; Driver: C:\Users\Philipp\AppData\Local\Temp\pxliyfod.sys


---- System - GMER 1.0.15 ----

SSDT            8B4FD584                                                                                        ZwCreateThread
SSDT            8B4FD570                                                                                        ZwOpenProcess
SSDT            8B4FD575                                                                                        ZwOpenThread
SSDT            8B4FD57F                                                                                        ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

.text          ntoskrnl.exe!KeInsertQueue + 411                                                                820A1A08 4 Bytes  [84, D5, 4F, 8B]
.text          ntoskrnl.exe!KeInsertQueue + 5E1                                                                820A1BD8 4 Bytes  [70, D5, 4F, 8B]
.text          ntoskrnl.exe!KeInsertQueue + 5FD                                                                820A1BF4 4 Bytes  [75, D5, 4F, 8B]
.text          ntoskrnl.exe!KeInsertQueue + 811                                                                820A1E08 4 Bytes  [7F, D5, 4F, 8B]

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                          Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                          Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00027873b61e                     
Reg            HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0016cfe759b3                     
Reg            HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\00027873b61e (not active ControlSet) 
Reg            HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\0016cfe759b3 (not active ControlSet) 

---- EOF - GMER 1.0.15 ----
Der Rest folgt.

Gruß

jexsen 28.04.2011 20:29
Hi,

hier der OSAM Log

Ich glaube ich habe die Online-Abfrage durch OSAM auch mit ausgeführt :confused:

Ich hoffe das ist nicht so schlimm

Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 21:26:26 on 28.04.2011

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit
Default Browser: Mozilla Corporation Firefox 3.6.16

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Control Panel Objects]
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Nero BurnRights" - "Nero AG" - C:\Program Files\Nero\Nero 7\Nero Toolkit\NeroBurnRights.cpl
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgio" (avgio) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"catchme" (catchme) - ? - C:\Users\Philipp\AppData\Local\Temp\catchme.sys  (File not found)
"FssFltr" (fssfltr) - "Microsoft Corporation" - C:\Windows\System32\DRIVERS\fssfltr.sys
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"pxliyfod" (pxliyfod) - ? - C:\Users\Philipp\AppData\Local\Temp\pxliyfod.sys  (Hidden registry entry, rootkit activity | File not found)
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{7D4D6379-F301-4311-BEBA-E26EB0561882} "NeroDigitalColumnHandler Class" - "Nero AG" - C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -  (File not found | COM-object registry key not found)
{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -  (File not found | COM-object registry key not found)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -  (File not found | COM-object registry key not found)
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -  (File not found | COM-object registry key not found)
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{7842554E-6BED-11D2-8CDB-B05550C10000} "Monitor Class" - "Broadcom Corporation." - C:\Windows\system32\btncopy.dll
{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2} "NeroCoverEdLiveIcons Class" - "Nero AG" - C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll
{B327765E-D724-4347-8B16-78AE18552FC3} "NeroDigitalIconHandler Class" - "Nero AG" - C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll
{7F1CF152-04F8-453A-B34C-E609530A9DC8} "NeroDigitalPropSheetHandler Class" - "Nero AG" - C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll
{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - C:\Program Files\Real\RealPlayer\rpshell.dll
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - ? - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll
{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -  (File not found | COM-object registry key not found)
{E0D79304-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, S.L." - C:\Program Files\WinZip\wzshlstb.dll
{E0D79305-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, S.L." - C:\Program Files\WinZip\wzshlstb.dll
{E0D79306-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, S.L." - C:\Program Files\WinZip\wzshlstb.dll
{E0D79307-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, S.L." - C:\Program Files\WinZip\wzshlstb.dll
{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
-----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )-----
{E312764E-7706-43F1-8DAB-FCDD2B1E416D} "{E312764E-7706-43F1-8DAB-FCDD2B1E416D}" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_24.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
{C3F79A2B-B9B4-4A66-B012-3EE46475B072} "MessengerStatsClient Class" - "Microsoft Corporation" - C:\Windows\Downloaded Program Files\MessengerStatsPAClient.dll / hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
{05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} "Office Genuine Advantage Validation Tool" - ? - C:\Windows\system32\OGACheckControl.DLL / hxxp://download.microsoft.com/download/e/7/3/e7345c16-80aa-4488-ae10-9ac6be844f99/OGAControl.cab
{17492023-C23A-453E-A040-C7C580BBF700} "Windows Genuine Advantage Validation Tool" - "Microsoft Corporation" - C:\Windows\system32\LegitCheckControl.DLL / hxxp://download.microsoft.com/download/5/b/0/5b0d4654-aa20-495c-b89f-c1c34c691085/LegitCheckControl.cab
{8FFBE65D-2C9C-4669-84BD-5829DC0B603C} "{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}" - ? -  (File not found | COM-object registry key not found) / hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
"@btrez.dll,-4015" - ? - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
{5F7B1267-94A9-47F5-98DB-E99415F33AEC} "In Blog veröffentlichen" - "Microsoft Corporation" - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Plug-In" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} "Search Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype Plug-In" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} "Windows Live Toolbar Helper" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll
{5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? -  (File not found | COM-object registry key not found)

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE  (Shortcut exists | File exists)
"desktop.ini" - ? - C:\Users\Philipp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"Audible Download Manager.lnk" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Audible Download Manager.lnk  (Shortcut exists | File not found)
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"BTTray.lnk" - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe  (Shortcut exists | File exists)
"WinZip Quick Pick.lnk" - "WinZip Computing, S.L." - C:\Program Files\WinZip\WZQKPICK.EXE  (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}" - "Nero AG" - "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
"MyTomTomSA.exe" - "TomTom" - "C:\Program Files\MyTomTom 3\MyTomTomSA.exe"
"Skype" - "Skype Technologies S.A." - "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
"StartCCC" - ? - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe  (File found, but it contains no detailed information)
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"AppleSyncNotifier" - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe"
"LanguageShortcut" - ? - "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
"NeroFilterCheck" - "Nero AG" - C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
"Play AVStation TV Scheduler" - "SAMSUNG ELECTRONICS CO., LTD." - C:\Program Files\Samsung\Play AVStation\TvScheduler.exe
"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime
"RemoteControl" - "Cyberlink Corp." - "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
"SearchSettings" - "Spigot, Inc." - C:\Program Files\pdfforge Toolbar\SearchSettings.exe
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
"TkBellExe" - "RealNetworks, Inc." - "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"PDFCreator" - ? - C:\Windows\system32\pdfcmnnt.dll  (File found, but it contains no detailed information)
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"Bluetooth Service" (btwdins) - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"NBService" (NBService) - "Nero AG" - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
"NMIndexingService" (NMIndexingService) - "Nero AG" - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"Samsung Update Plus" (Samsung Update Plus) - ? - C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exe  (File found, but it contains no detailed information)
"SeaPort" (SeaPort) - "Microsoft Corporation" - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
"SQL Server VSS Writer" (SQLWriter) - "Microsoft Corporation" - C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
"Windows Live Family Safety-Dienst" (fsssvc) - "Microsoft Corporation" - C:\Program Files\Windows Live\Family Safety\fsssvc.exe

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
Der Rest folgt

Gruß

jexsen 28.04.2011 20:32
Hi,

und hier zu guter letzt der Inhalt der MBRCheck .txt Datei

Code:
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:                       
Windows Version:                Windows Vista Home Premium Edition
Windows Information:                Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer:        SAMSUNG ELECTRONICS CO., LTD.
BIOS Manufacturer:                Phoenix Technologies LTD
System Manufacturer:                SAMSUNG ELECTRONICS CO., LTD.
System Product Name:                R40P/R41P
Logical Drives Mask:                0x0000001c

Kernel Drivers (total 144):
  0x82034000 \SystemRoot\system32\ntoskrnl.exe
  0x82001000 \SystemRoot\system32\hal.dll
  0x87000000 \SystemRoot\system32\kdcom.dll
  0x87007000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
  0x87077000 \SystemRoot\system32\PSHED.dll
  0x87088000 \SystemRoot\system32\BOOTVID.dll
  0x87090000 \SystemRoot\system32\CLFS.SYS
  0x870D1000 \SystemRoot\system32\CI.dll
  0x871B1000 \SystemRoot\system32\drivers\Wdf01000.sys
  0x8722D000 \SystemRoot\system32\drivers\WDFLDR.SYS
  0x8723A000 \SystemRoot\system32\drivers\acpi.sys
  0x87280000 \SystemRoot\system32\drivers\WMILIB.SYS
  0x87289000 \SystemRoot\system32\drivers\msisadrv.sys
  0x87291000 \SystemRoot\system32\drivers\pci.sys
  0x872B8000 \SystemRoot\System32\drivers\partmgr.sys
  0x872C7000 \SystemRoot\system32\DRIVERS\compbatt.sys
  0x872CA000 \SystemRoot\system32\DRIVERS\BATTC.SYS
  0x872D4000 \SystemRoot\system32\drivers\volmgr.sys
  0x872E3000 \SystemRoot\System32\drivers\volmgrx.sys
  0x8732D000 \SystemRoot\system32\drivers\pciide.sys
  0x87334000 \SystemRoot\system32\drivers\PCIIDEX.SYS
  0x87342000 \SystemRoot\system32\DRIVERS\pcmcia.sys
  0x8736F000 \SystemRoot\System32\drivers\mountmgr.sys
  0x8737F000 \SystemRoot\system32\drivers\atapi.sys
  0x87387000 \SystemRoot\system32\drivers\ataport.SYS
  0x873A5000 \SystemRoot\system32\drivers\fltmgr.sys
  0x873D7000 \SystemRoot\system32\drivers\fileinfo.sys
  0x87409000 \SystemRoot\System32\Drivers\ksecdd.sys
  0x8747A000 \SystemRoot\system32\drivers\ndis.sys
  0x87585000 \SystemRoot\system32\drivers\msrpc.sys
  0x875B0000 \SystemRoot\system32\drivers\NETIO.SYS
  0x875EB000 \SystemRoot\System32\drivers\tcpip.sys
  0x876D5000 \SystemRoot\System32\drivers\fwpkclnt.sys
  0x876F0000 \SystemRoot\System32\Drivers\Ntfs.sys
  0x8780F000 \SystemRoot\system32\drivers\volsnap.sys
  0x87848000 \SystemRoot\System32\Drivers\spldr.sys
  0x87850000 \SystemRoot\System32\Drivers\mup.sys
  0x8785F000 \SystemRoot\System32\drivers\ecache.sys
  0x87886000 \SystemRoot\system32\drivers\disk.sys
  0x87897000 \SystemRoot\system32\drivers\CLASSPNP.SYS
  0x878B8000 \SystemRoot\system32\drivers\crcdisk.sys
  0x878E1000 \SystemRoot\system32\DRIVERS\tunnel.sys
  0x878EC000 \SystemRoot\system32\DRIVERS\tunmp.sys
  0x878F5000 \SystemRoot\system32\DRIVERS\intelppm.sys
  0x87904000 \SystemRoot\system32\DRIVERS\CmBatt.sys
  0x8BC04000 \SystemRoot\system32\DRIVERS\atikmdag.sys
  0x87908000 \SystemRoot\System32\drivers\dxgkrnl.sys
  0x8C38C000 \SystemRoot\System32\drivers\watchdog.sys
  0x8C398000 \SystemRoot\system32\DRIVERS\usbohci.sys
  0x8C3A2000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0x8C3E0000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0x879A8000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0x8C3EF000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
  0x879C0000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
  0x87A4D000 \SystemRoot\system32\DRIVERS\i8042prt.sys
  0x8C3F5000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0x87A60000 \SystemRoot\system32\DRIVERS\SynTP.sys
  0x8BC00000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0x87A8B000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0x87A96000 \SystemRoot\system32\DRIVERS\Rtnicxp.sys
  0x87AA7000 \SystemRoot\system32\DRIVERS\sdbus.sys
  0x87AC1000 \SystemRoot\system32\DRIVERS\rimmptsk.sys
  0x87AD0000 \SystemRoot\system32\DRIVERS\rimsptsk.sys
  0x87AE4000 \SystemRoot\system32\DRIVERS\rixdptsk.sys
  0x87B35000 \SystemRoot\system32\DRIVERS\msiscsi.sys
  0x87B64000 \SystemRoot\system32\DRIVERS\storport.sys
  0x87BA5000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0x87BB0000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
  0x87BC7000 \SystemRoot\system32\DRIVERS\ndistapi.sys
  0x87BD2000 \SystemRoot\system32\DRIVERS\ndiswan.sys
  0x87800000 \SystemRoot\system32\DRIVERS\raspppoe.sys
  0x873E7000 \SystemRoot\system32\DRIVERS\raspptp.sys
  0x8C80A000 \SystemRoot\system32\DRIVERS\rassstp.sys
  0x8C81F000 \SystemRoot\system32\DRIVERS\termdd.sys
  0x8C82F000 \SystemRoot\system32\DRIVERS\swenum.sys
  0x8C831000 \SystemRoot\system32\DRIVERS\ks.sys
  0x8C85B000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0x8C865000 \SystemRoot\system32\DRIVERS\umbus.sys
  0x8C872000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0x8C8A7000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0x8C8B8000 \SystemRoot\system32\DRIVERS\AGRSM.sys
  0x8C9D4000 \SystemRoot\system32\drivers\modem.sys
  0x8C9EA000 \SystemRoot\system32\drivers\RTKVHDA.sys
  0x8CB7B000 \SystemRoot\system32\drivers\portcls.sys
  0x8CBA8000 \SystemRoot\system32\drivers\drmk.sys
  0x8CBCD000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0x8CBD6000 \SystemRoot\System32\Drivers\Null.SYS
  0x8CBDD000 \SystemRoot\System32\Drivers\Beep.SYS
  0x8CBE4000 \SystemRoot\System32\drivers\vga.sys
  0x8CC05000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
  0x8CC26000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0x8CC2E000 \SystemRoot\system32\drivers\rdpencdd.sys
  0x8CC36000 \SystemRoot\System32\Drivers\Msfs.SYS
  0x8CC41000 \SystemRoot\System32\Drivers\Npfs.SYS
  0x8CC4F000 \SystemRoot\System32\DRIVERS\rasacd.sys
  0x8CC58000 \SystemRoot\system32\DRIVERS\tdx.sys
  0x8CC6E000 \SystemRoot\system32\DRIVERS\smb.sys
  0x8CC82000 \SystemRoot\system32\drivers\afd.sys
  0x8CCCA000 \SystemRoot\System32\DRIVERS\netbt.sys
  0x8CCFC000 \SystemRoot\system32\DRIVERS\pacer.sys
  0x8CD12000 \SystemRoot\system32\DRIVERS\netbios.sys
  0x8CD20000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0x8CD33000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
  0x8CD39000 \SystemRoot\system32\DRIVERS\rdbss.sys
  0x8CD75000 \SystemRoot\system32\drivers\nsiproxy.sys
  0x8CD7F000 \SystemRoot\System32\Drivers\dfsc.sys
  0x8CD96000 \SystemRoot\system32\DRIVERS\avipbb.sys
  0x8CDB2000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys
  0x8CDB4000 \SystemRoot\system32\DRIVERS\hidusb.sys
  0x8CDBD000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
  0x8CDCD000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0x8CDD4000 \SystemRoot\system32\DRIVERS\mouhid.sys
  0x8CDDC000 \SystemRoot\System32\Drivers\crashdmp.sys
  0x8CDE9000 \SystemRoot\System32\Drivers\dump_dumpata.sys
  0x8CDF4000 \SystemRoot\System32\Drivers\dump_atapi.sys
  0x94450000 \SystemRoot\System32\win32k.sys
  0x8CDFC000 \SystemRoot\System32\drivers\Dxapi.sys
  0x8CE06000 \SystemRoot\system32\DRIVERS\monitor.sys
  0x94670000 \SystemRoot\System32\TSDDD.dll
  0x94690000 \SystemRoot\System32\cdd.dll
  0x8CE15000 \SystemRoot\system32\drivers\luafv.sys
  0x8CE30000 \SystemRoot\system32\DRIVERS\avgntflt.sys
  0x8CE44000 \SystemRoot\system32\DRIVERS\kmdfmemio.sys
  0x8CE5D000 \SystemRoot\system32\drivers\spsys.sys
  0x8CF0D000 \SystemRoot\system32\DRIVERS\lltdio.sys
  0x8CF1D000 \SystemRoot\system32\DRIVERS\nwifi.sys
  0x8CF47000 \SystemRoot\system32\DRIVERS\ndisuio.sys
  0x8CF51000 \SystemRoot\system32\DRIVERS\rspndr.sys
  0x8CF64000 \SystemRoot\system32\drivers\HTTP.sys
  0x8CFD1000 \SystemRoot\System32\DRIVERS\srvnet.sys
  0x878C1000 \SystemRoot\system32\DRIVERS\bowser.sys
  0x99C0F000 \SystemRoot\System32\drivers\mpsdrv.sys
  0x99C24000 \SystemRoot\system32\drivers\mrxdav.sys
  0x99C45000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0x99C64000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
  0x99C9D000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
  0x99CB5000 \SystemRoot\System32\DRIVERS\srv2.sys
  0x99CDD000 \SystemRoot\System32\DRIVERS\srv.sys
  0x99D2C000 \SystemRoot\system32\drivers\peauth.sys
  0x99E0A000 \SystemRoot\System32\Drivers\secdrv.SYS
  0x99E14000 \SystemRoot\System32\drivers\tcpipreg.sys
  0x99E20000 \SystemRoot\system32\DRIVERS\cdfs.sys
  0x99E36000 \??\C:\Users\Philipp\AppData\Local\Temp\pxliyfod.sys
  0x77D40000 \Windows\System32\ntdll.dll

Processes (total 79):
      0 System Idle Process
      4 System
    528 C:\Windows\System32\smss.exe
    596 csrss.exe
    648 C:\Windows\System32\wininit.exe
    660 csrss.exe
    692 C:\Windows\System32\services.exe
    704 C:\Windows\System32\lsass.exe
    712 C:\Windows\System32\lsm.exe
    752 C:\Windows\System32\winlogon.exe
    900 C:\Windows\System32\svchost.exe
    980 C:\Windows\System32\svchost.exe
    1016 C:\Windows\System32\svchost.exe
    1112 C:\Windows\System32\Ati2evxx.exe
    1164 C:\Windows\System32\svchost.exe
    1204 C:\Windows\System32\svchost.exe
    1220 C:\Windows\System32\svchost.exe
    1288 C:\Windows\System32\audiodg.exe
    1308 C:\Windows\System32\svchost.exe
    1328 C:\Windows\System32\SLsvc.exe
    1360 C:\Windows\System32\svchost.exe
    1508 C:\Windows\System32\Ati2evxx.exe
    1556 C:\Windows\System32\svchost.exe
    1844 C:\Windows\System32\spoolsv.exe
    1920 C:\Program Files\Avira\AntiVir Desktop\sched.exe
    1992 C:\Windows\System32\svchost.exe
    2016 C:\Windows\System32\taskeng.exe
    2044 C:\Windows\System32\dwm.exe
    340 C:\Windows\explorer.exe
    412 C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe
    1732 C:\Windows\RtHDVCpl.exe
    2008 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    600 C:\Windows\System32\taskeng.exe
    1948 C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
    2100 C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe
    2276 C:\Program Files\Samsung\Samsung Recovery Solution II\WCScheduler.exe
    2288 C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
    2336 C:\Windows\System32\taskeng.exe
    2348 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    2548 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    2600 C:\Program Files\Common Files\Java\Java Update\jusched.exe
    2624 C:\Windows\System32\agrsmsvc.exe
    2656 C:\Program Files\iTunes\iTunesHelper.exe
    2696 C:\Program Files\Windows Sidebar\sidebar.exe
    2752 C:\Windows\ehome\ehtray.exe
    2764 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    2780 C:\Program Files\MyTomTom 3\MyTomTomSA.exe
    2788 C:\Program Files\Skype\Phone\Skype.exe
    2800 C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    2824 C:\Windows\ehome\ehmsas.exe
    2836 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    2884 C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
    2972 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    3124 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    3392 C:\Program Files\Skype\Plugin Manager\skypePM.exe
    3544 C:\Program Files\Bonjour\mDNSResponder.exe
    3572 C:\Windows\System32\svchost.exe
    3600 C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    3836 C:\Windows\System32\svchost.exe
    3860 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    3872 C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    3956 C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    4044 C:\Windows\System32\svchost.exe
    2148 C:\Windows\System32\svchost.exe
    1304 C:\Windows\System32\SearchIndexer.exe
    2316 C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    3380 C:\Program Files\Windows Media Player\wmpnscfg.exe
    1388 C:\Windows\System32\svchost.exe
    1860 C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
    3388 C:\Program Files\iPod\bin\iPodService.exe
    2408 C:\Program Files\Windows Media Player\wmpnetwk.exe
    5420 C:\Program Files\Samsung\Samsung Update Plus\SLUSelfUpdateClient.exe
    5476 C:\Program Files\Samsung\Samsung Update Plus\Downloads\SupUpdateNotice.exe
    5544 C:\Program Files\Mozilla Firefox\firefox.exe
    5364 C:\Program Files\WinZip\WZQKPICK.EXE
    4564 C:\Windows\System32\SearchProtocolHost.exe
    5028 C:\Windows\System32\SearchFilterHost.exe
    3744 C:\Users\Philipp\Downloads\MBRCheck.exe
    5740 C:\Windows\System32\conime.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000002`80100000  (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000013`c0100000  (NTFS)

PhysicalDrive0 Model Number: FUJITSUMHW2160BHPL, Rev: 0000001C

      Size  Device Name          MBR Status
  --------------------------------------------
    149 GB  \\.\PhysicalDrive0  Unknown MBR code
            SHA1: A2D287FA4F944275462643BCFFB6129A056114F3


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!
Gruß

cosinus 28.04.2011 20:55
Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

jexsen 29.04.2011 00:10
Hi,

hier der Log von Malwarebytes

Code:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6467

Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8112.16421

29.04.2011 01:08:27
mbam-log-2011-04-29 (01-08-27).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 282596
Laufzeit: 1 Stunde(n), 30 Minute(n), 51 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
Gruß

jexsen 29.04.2011 05:40
Hi,

hier noch der Log von SuperAntiSpyware

Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 04/29/2011 at 03:57 AM

Application Version : 4.51.1000

Core Rules Database Version : 6950
Trace Rules Database Version: 4762

Scan type      : Complete Scan
Total Scan Time : 02:30:18

Memory items scanned      : 695
Memory threats detected  : 0
Registry items scanned    : 9813
Registry threats detected : 0
File items scanned        : 139315
File threats detected    : 1

Adware.Tracking Cookie
        C:\Users\Philipp\AppData\Roaming\Microsoft\Windows\Cookies\philipp@doubleclick[1].txt
Gruß

cosinus 29.04.2011 11:20
Sieht ok aus, da wurden nur Cookies gefunden.
Noch Probleme oder weitere Funde in der Zwischenzeit?

jexsen 29.04.2011 11:39
Nein eigentlich keine Probleme mehr.

Vielen Dank!

Eine Frage hätte ich noch.

Soll ich SuperAntiSpyware jetzt deinstallieren?

Gruß

cosinus 29.04.2011 12:21
Ja, alle anderen können auch runter.

Dann wären wir durch! :abklatsch:

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update



PDF-Reader aktualisieren
Dein Adobe Reader ist nicht aktuell, was ein großes Sicherheitsrisiko darstellt. Du solltest daher besser die alte Version über Systemsteuerung => Software deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst.

Ich empfehle einen alternativen PDF-Reader wie SumatraPDF oder Foxit PDF Reader, beide sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers, hier der direkte Downloadlink:

Mozilla und andere Browser => http://filepony.de/?q=Flash+Player
Internet Explorer => http://fpdownload.adobe.com/get/flas..._player_ax.exe


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

jexsen 30.04.2011 09:25
Hi,

habe jetzt alle von Dir empfohlenen Updates durchgeführt und auch die wichtigsten Passwörter geändert.

Vielen, vielen Dank nochmal!

Gibt es eigentlich noch irgendwelche Vorsichtsmaßnahmen die ich treffen kann damit sowas nicht nochmal passiert. Habe eigentlich nur AntiVir auf meinem PC im Hintergrung laufen.

Gruß

cosinus 01.05.2011 12:21
Halte Dich am besten grob an diese fünf Regeln:

1) Sei misstrauisch im Internet und v.a. bei unbekannten E-Mails, sei vorsichtig bei der Herausgabe persönlicher Daten!!
2) Halte Windows und alle verwendeten Programme immer aktuell
3) Führe regelmäßig Backups auf externe Medien durch
4) Arbeite mit eingeschränkten Rechten
5) Nutze sichere Programme wie zB Opera oder Firefox zum Surfen statt den IE, zum Mailen Thunderbird statt Outlook Express - E-Mails nur als reinen text anzeigen lassen

Alles noch genauer erklärt steht hier => Kompromittierung unvermeidbar?


Alle Zeitangaben in WEZ +1. Es ist jetzt 23:55 Uhr.
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131