| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: tab-problem, forefoxabsturz, "data exuction prevention"?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
06.02.2010, 00:05
| #1 |
 |  tab-problem, forefoxabsturz, "data exuction prevention"? hey liebe trojaner, ich weiß echt nicht mehr weiter, ich habe mir zwar schon einiges durchgelesen, aber ehrlich gesagt kann ich nicht wirklich was damit anfangen  also ich hab es hier schon im forum gelesen, deswegen hoff ich ,dass ihr mir auch helfen könnt *lieb guck* ... also bei jedem 7 klick öffnet sich bei mozilla n neuer tab mit werbung- alles mögliche, von "meinungswelt" zu "real fuck" =irgendeine sexseite.. jetzt seit kurzem habe ich auch am anfang vom hochfahren ein fenster : "Data Excution Prevention- Microsoft Windows to hel protect your computer, Windows has closed this program. Name : windows explorer Publisher : Microsoft Corporation -> close message" und die so min 2mal. außerdem kommt dann von mozilla häufig ne absturzmeldung das sind meine hauptprobleme erstmal ich bitte bitte wirklich euch , mir zu helfen, wenn ihr es könnt  ich danke schon mal klein im vorraus lg celia |
|
08.02.2010, 13:07
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | tab-problem, forefoxabsturz, "data exuction prevention"? Hallo und
__________________ Bitte diese Liste beachten und abarbeiten. Beim Scan mit MalwareBytes auch alle externen Speicher (ext. Platten, USB-Sticks, ... mit anklemmen!! ) Wichtig für Benutzer mit Windows Vista und Windows 7: Bitte alle Tools per Rechtsklick => Als Admin ausführen! Die Logfiles kannst Du zB alle in eine Datei zippen und auf File-Upload.net hochladen und hier verlinken, denn 1. sind manche Logfiles fürs Board nämlich zu groß und 2. kann ich mit einem Klick mir gleich alle auf einmal runterladen.
__________________ |
|
08.02.2010, 15:13
| #3 |
| | tab-problem, forefoxabsturz, "data exuction prevention"? das ist das"ergebnis" von malewarebytes
__________________http://www.file-upload.net/download-...0-40-.txt.html das ist dieser andere scan-RSTI Logfile of random's system information tool 1.06 (written by random/random) Run by Cecile at 2010-02-08 15:27:25 Microsoft Windows XP Home Edition Service Pack 3 System drive C: has 70 GB (86%) free of 82 GB Total RAM: 1015 MB (51% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:27:27, on 08.02.2010 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir Desktop\sched.exe C:\Program Files\Avira\AntiVir Desktop\avguard.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Avira\AntiVir Desktop\avmailc.exe C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE C:\Program Files\EeePC\ACPI\AsTray.exe C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe C:\WINDOWS\system32\cisvc.exe C:\Program Files\EeePC\ACPI\AsEPCMon.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\ICQ6Toolbar\ICQ Service.exe C:\WINDOWS\system32\igfxext.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\Asus\EeePC\Super Hybrid Engine\SuperHybridEngine.exe C:\Program Files\Sun\StarOffice 8\program\soffice.exe C:\Program Files\Sun\StarOffice 8\program\soffice.BIN C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Cecile\My Documents\Downloads\RSIT(2).exe C:\Program Files\trend micro\Cecile.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.theprizeday.com/today.php R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = h**p://eeepc.asus.com/global R3 - URLSearchHook: (no name) - - (no file) R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll O4 - HKLM\..\Run: [AsusTray] C:\Program Files\EeePC\ACPI\AsTray.exe O4 - HKLM\..\Run: [AsusACPIServer] C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe O4 - HKLM\..\Run: [AsusEPCMonitor] C:\Program Files\EeePC\ACPI\AsEPCMon.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [Prnres] rundll32.exe "C:\Documents and Settings\Cecile\Application Data\Adobe\Update\32ret.dat"" (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: StarOffice 8.lnk = C:\Program Files\Sun\StarOffice 8\program\quickstart.exe O4 - Global Startup: Bluetooth.lnk = ? O4 - Global Startup: SuperHybridEngine.lnk = C:\Program Files\Asus\EeePC\Super Hybrid Engine\SuperHybridEngine.exe O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O8 - Extra context menu item: Send To Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://h**p://update.microsoft.com/m...?1246179299234 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://h**p://update.microsoft.com/m...?1246114629875 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Avira Firewall (AntiVirFirewallService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe O23 - Service: Avira AntiVir MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avmailc.exe O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe O23 - Service: Avira AntiVir WebGuard (AntiVirWebService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- End of file - 9118 bytes ======Scheduled tasks folder====== C:\WINDOWS\tasks\AppleSoftwareUpdate.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}] Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2008-02-12 1372160] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}] Search Helper - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2009-05-19 137600] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] SSVHelper Class - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll [2007-09-24 501136] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}] Windows Live Toolbar Helper - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {21FA44EF-376D-4D53-9B0F-8A89D3229068} - &Windows Live Toolbar - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06 1068904] {855F3B16-6D32-4fe6-8A56-BBB695989046} - ICQToolBar - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2008-12-09 958200] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "AsusTray"=C:\Program Files\EeePC\ACPI\AsTray.exe [2008-06-03 98304] "AsusACPIServer"=C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe [2008-06-03 479232] "AsusEPCMonitor"=C:\Program Files\EeePC\ACPI\AsEPCMon.exe [2008-05-20 94208] "SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe [2007-09-24 132496] "IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2007-12-19 135168] "HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2007-12-19 159744] "Persistence"=C:\WINDOWS\system32\igfxpers.exe [2007-12-19 131072] "RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2008-04-28 16861696] "SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2006-07-21 86016] "AlcWzrd"=C:\WINDOWS\ALCWZRD.EXE [2006-05-04 2808832] "Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-04 69632] "QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-03-28 413696] "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-10-15 39792] "avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2010-02-07 209153] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360] "msnmsgr"=C:\Program Files\Windows Live\Messenger\msnmsgr.exe [2009-07-26 3883840] "MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-10-15 39792] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe [2009-07-26 3883840] C:\Documents and Settings\All Users\Start Menu\Programs\Startup Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe SuperHybridEngine.lnk - C:\Program Files\Asus\EeePC\Super Hybrid Engine\SuperHybridEngine.exe C:\Documents and Settings\Cecile\Start Menu\Programs\Startup StarOffice 8.lnk - C:\Program Files\Sun\StarOffice 8\program\quickstart.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] C:\WINDOWS\system32\igfxdev.dll [2007-12-19 208896] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "HonorAutoRunSetting"= "NoDriveTypeAutoRun"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call" "C:\Program Files\ICQ6.5\ICQ.exe"="C:\Program Files\ICQ6.5\ICQ.exe:*:Enabled:ICQ6" "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger" "C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync" "C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype" "C:\WINDOWS\Explorer.EXE"="C:\WINDOWS\Explorer.EXE:*:Enabled:enable" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call" "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger" "C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"="C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E] shell\AutoRun\command - E:\Menu.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{21ed05c1-7080-11de-803f-002243af53f0}] shell\AutOpLay\command - E:\dsgs.pif shell\AutoRun\command - E:\dsgs.pif shell\eXPlore\command - E:\dsgs.pif shell\OPEn\command - E:\dsgs.pif [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4a744480-a2a9-11de-80c1-00226903b468}] shell\AutoRun\command - E:\setup_vmc_lite.exe /checkApplicationPresence [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{67918e0d-b94d-11de-80fb-00226903b468}] shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL pagefiles.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ab59b3d6-978f-11de-809f-002243af53f0}] shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL drive\usbchk.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c89106c2-a2aa-11de-80c2-00226903b468}] shell\AutoRun\command - E:\setup_vmc_lite.exe /checkApplicationPresence [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e6b0d288-8b24-11de-807f-00226903b468}] shell\AutoRun\command - E:\AutoRun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e6b0d28b-8b24-11de-807f-00226903b468}] shell\AutoRun\command - E:\setup_vmc_lite.exe /checkApplicationPresence [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f4247bfa-ac20-11de-80e8-00226903b468}] shell\AutoRun\command - E:\setup_vmc_lite.exe /checkApplicationPresence ======List of files/folders created in the last 1 months====== 2010-02-08 15:21:56 ----D---- C:\Avenger 2010-02-08 15:17:11 ----D---- C:\Program Files\trend micro 2010-02-08 15:17:10 ----D---- C:\rsit 2010-02-08 13:46:57 ----D---- C:\Documents and Settings\Cecile\Application Data\Malwarebytes 2010-02-08 13:46:44 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2010-02-08 13:46:43 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2010-02-08 13:19:54 ----D---- C:\Program Files\CCleaner 2010-02-08 02:00:13 ----D---- C:\Documents and Settings\Cecile\Application Data\TeamViewer 2010-02-07 17:00:50 ----D---- C:\Program Files\Avira 2010-02-07 17:00:50 ----D---- C:\Documents and Settings\All Users\Application Data\Avira 2010-02-07 15:05:25 ----D---- C:\Program Files\Mozilla Firefox 2010-02-07 10:38:13 ----D---- C:\Program Files\Adobe 2010-02-07 10:37:13 ----SHD---- C:\Config.Msi 2010-02-07 10:18:02 ----D---- C:\Program Files\ICQ6.5 2010-02-03 22:42:17 ----D---- C:\Documents and Settings\Cecile\Application Data\FILEminimizerPictures 2010-02-03 22:42:09 ----D---- C:\Program Files\FILEminimizer Pictures 2010-02-03 22:41:50 ----A---- C:\WINDOWS\Menu.INI 2010-01-31 21:28:35 ----D---- C:\Program Files\Common Files\Symantec Shared 2010-01-31 21:22:32 ----D---- C:\Documents and Settings\All Users\Application Data\Symantec 2010-01-31 21:22:32 ----D---- C:\Documents and Settings\All Users\Application Data\Norton 2010-01-31 21:22:28 ----D---- C:\Documents and Settings\All Users\Application Data\NortonInstaller 2010-01-31 19:19:08 ----D---- C:\WINDOWS\system32\Adobe 2010-01-20 13:24:05 ----SHD---- C:\Documents and Settings\Cecile\Application Data\SystemProc 2010-01-18 07:30:48 ----A---- C:\WINDOWS\system32\msvcr71.dll 2010-01-18 07:30:46 ----A---- C:\WINDOWS\system32\msvcp71.dll 2010-01-14 01:47:27 ----HDC---- C:\WINDOWS\$NtUninstallKB955759$ 2010-01-14 01:47:15 ----HDC---- C:\WINDOWS\$NtUninstallKB972270$ 2010-01-09 00:32:58 ----D---- C:\Program Files\BrowserZinc 2010-01-09 00:32:58 ----D---- C:\Documents and Settings\All Users\Application Data\BrowserZinc 2010-01-09 00:30:07 ----D---- C:\Program Files\GameRaving Toolbar ======List of files/folders modified in the last 1 months====== 2010-02-08 15:27:20 ----D---- C:\WINDOWS\system32 2010-02-08 15:27:20 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI 2010-02-08 15:26:13 ----D---- C:\WINDOWS\Prefetch 2010-02-08 15:24:15 ----D---- C:\WINDOWS\Temp 2010-02-08 15:23:35 ----D---- C:\Documents and Settings\Cecile\Application Data\StarOffice8 2010-02-08 15:23:23 ----D---- C:\WINDOWS 2010-02-08 15:23:00 ----D---- C:\WINDOWS\system32\CatRoot2 2010-02-08 15:21:58 ----D---- C:\Program Files 2010-02-08 15:21:56 ----D---- C:\WINDOWS\system32\drivers 2010-02-08 15:21:27 ----A---- C:\WINDOWS\SchedLgU.Txt 2010-02-08 15:21:10 ----HDC---- C:\WINDOWS\$NtUninstallKB971486$ 2010-02-08 13:41:03 ----D---- C:\WINDOWS\Debug 2010-02-08 13:41:02 ----D---- C:\WINDOWS\Minidump 2010-02-08 12:14:54 ----ASH---- C:\boot.ini 2010-02-07 19:33:43 ----HD---- C:\WINDOWS\inf 2010-02-07 16:53:49 ----SHD---- C:\WINDOWS\Installer 2010-02-07 16:53:49 ----D---- C:\WINDOWS\WinSxS 2010-02-07 16:53:36 ----D---- C:\Program Files\Common Files\Microsoft Shared 2010-02-07 12:54:16 ----D---- C:\WINDOWS\Microsoft.NET 2010-02-07 10:53:54 ----D---- C:\Documents and Settings\Cecile\Application Data\Skype 2010-02-07 10:38:30 ----D---- C:\Program Files\Common Files\Adobe 2010-02-07 10:38:24 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe 2010-02-07 10:32:31 ----D---- C:\Program Files\ICQ6Toolbar 2010-02-07 10:29:19 ----D---- C:\Program Files\QuickTime 2010-02-07 10:26:38 ----RSD---- C:\WINDOWS\assembly 2010-02-07 10:21:22 ----D---- C:\Documents and Settings\All Users\Application Data\ICQ 2010-02-07 10:14:45 ----SD---- C:\WINDOWS\Tasks 2010-02-07 10:03:56 ----D---- C:\Documents and Settings\Cecile\Application Data\Adobe 2010-02-04 00:36:30 ----D---- C:\Backup 2010-02-01 23:03:03 ----D---- C:\Documents and Settings\Cecile\Application Data\skypePM 2010-01-31 21:28:35 ----D---- C:\Program Files\Common Files 2010-01-31 19:19:11 ----SD---- C:\WINDOWS\Downloaded Program Files 2010-01-23 04:14:47 ----D---- C:\Program Files\Microsoft Silverlight 2010-01-23 04:11:55 ----RSHDC---- C:\WINDOWS\system32\dllcache 2010-01-23 04:11:52 ----D---- C:\Program Files\Internet Explorer 2010-01-23 04:11:39 ----D---- C:\WINDOWS\ie8updates 2010-01-23 04:10:51 ----HD---- C:\WINDOWS\$hf_mig$ 2010-01-14 11:06:20 ----D---- C:\WINDOWS\AppPatch ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 avfwot;avfwot; C:\WINDOWS\system32\DRIVERS\avfwot.sys [2010-02-07 97608] R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys [] R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2010-02-07 96104] R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 36352] R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592] R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2010-02-07 28520] R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2006-03-01 12032] R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2010-02-07 56816] R3 AR5211;Atheros Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\ar5211.sys [2007-05-02 546976] R3 AsusACPI;ASUS ACPI Driver; C:\WINDOWS\system32\DRIVERS\ASUSACPI.sys [2007-07-26 11264] R3 avfwim;AvFw Packet Filter Miniport; C:\WINDOWS\system32\DRIVERS\avfwim.sys [2010-02-07 69632] R3 btaudio;Bluetooth Audio Device; C:\WINDOWS\system32\drivers\btaudio.sys [2008-04-15 534440] R3 BTDriver;Virtueller Bluetooth-Kommunikationstreiber; C:\WINDOWS\system32\DRIVERS\btport.sys [2008-02-04 37160] R3 BTKRNL;Bluetooth-Bus-Enumerator; C:\WINDOWS\system32\DRIVERS\btkrnl.sys [2008-04-15 990632] R3 BTWDNDIS;Bluetooth LAN Access Server; C:\WINDOWS\system32\DRIVERS\btwdndis.sys [2007-09-20 156392] R3 btwhid;btwhid; C:\WINDOWS\system32\DRIVERS\btwhid.sys [2008-03-10 57384] R3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2008-03-27 47272] R3 CmBatt;Microsoft AC Adapter Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-14 13952] R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-14 144384] R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2007-12-19 5854688] R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-04-28 4733440] R3 Ktp;Elantech Smart-Pad; C:\WINDOWS\system32\DRIVERS\ETD.sys [2008-05-19 25088] R3 L1e;Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller; C:\WINDOWS\system32\DRIVERS\l1e51x86.sys [2008-03-11 36864] R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160] R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128] R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208] R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520] R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368] R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608] R3 usbvideo;USB Video Device (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-14 121984] S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024] S3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368] S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2009-08-26 49920] S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2009-08-26 21568] S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys [2008-12-30 101120] S3 massfilter;ZTE Mass Storage Filter Driver; C:\WINDOWS\system32\drivers\massfilter.sys [] S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504] S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248] S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880] S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136] S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232] S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856] S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104] S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200] S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568] S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944] S3 ZTEusbmdm6k;ZTE Proprietary USB Driver; C:\WINDOWS\system32\DRIVERS\ZTEusbmdm6k.sys [] S3 ZTEusbnmea;ZTE NMEA Port; C:\WINDOWS\system32\DRIVERS\ZTEusbnmea.sys [] S3 ZTEusbser6k;ZTE Diagnostic Port; C:\WINDOWS\system32\DRIVERS\ZTEusbser6k.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 AntiVirFirewallService;Avira Firewall; C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe [2010-02-07 388865] R2 AntiVirMailService;Avira AntiVir MailGuard; C:\Program Files\Avira\AntiVir Desktop\avmailc.exe [2010-02-07 194817] R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2010-02-07 108289] R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2010-02-07 185089] R2 AntiVirWebService;Avira AntiVir WebGuard; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [2010-02-07 434945] R2 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe [2008-04-14 342624] R2 ICQ Service;ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2008-10-19 222456] R2 IviRegMgr;IviRegMgr; C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe [2007-01-04 112152] R2 SeaPort;SeaPort; C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-05-19 240512] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632] S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104] S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664] S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408] S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336] S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096] -----------------EOF----------------- Geändert von celia1 (08.02.2010 um 15:49 Uhr) |
|
08.02.2010, 21:44
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | tab-problem, forefoxabsturz, "data exuction prevention"? Ok, mach bitte nun nen Durchgang mit CF: ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
15.02.2010, 13:30
| #5 |
| | tab-problem, forefoxabsturz, "data exuction prevention"? hallo cosinus, tut mir leid, dass ich nicht die zeit da war... hatte paar private probleme, aber jetzt bin ich wieder da... soll ich lieber die schritte nochmal einmal durchgehen oder dein nächsten schritt"combofix" jetzt durchführen ... lg |
|
15.02.2010, 22:34
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | tab-problem, forefoxabsturz, "data exuction prevention"? Mach bitte einfach das Log mit CF wie in der Anleitung beschrieben
__________________ --> tab-problem, forefoxabsturz, "data exuction prevention"? |
|
17.02.2010, 14:38
| #7 |
| | tab-problem, forefoxabsturz, "data exuction prevention"? das ist der bericht von combi fix ComboFix 10-02-12.01 - Cecile 17.02.2010 14:27:24.1.2 - x86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.596 [GMT 1:00] Running from: c:\documents and settings\Cecile\Desktop\cofifix.exe AV: AntiVir Desktop *On-access scanning disabled* (Updated) {11638345-E4FC-4BEE-BB73-EC754659C5F6} FW: Avira Firewall *enabled* {11638345-E4FC-4BEE-BB73-EC754659C5F6} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk c:\documents and settings\Cecile\Application Data\SystemProc c:\recycler\S-1-5-21-1702280784-662691950-4043198955-1003 c:\recycler\S-1-5-21-2684140027-3040661829-210546423-1003 c:\recycler\S-1-5-21-3816753149-1207111628-141548857-1003 c:\recycler\S-1-5-21-57989841-2000478354-1547161642-1003 c:\windows\system32\Thumbs.db D:\Autorun.inf . ((((((((((((((((((((((((( Files Created from 2010-01-17 to 2010-02-17 ))))))))))))))))))))))))))))))) . 2010-02-15 12:07 . 2010-02-15 12:07 -------- d-----w- c:\documents and settings\All Users\Application Data\UAB 2010-02-15 12:07 . 2010-02-15 12:07 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters 2010-02-15 12:07 . 2010-02-15 12:07 -------- d-----w- c:\documents and settings\Cecile\Local Settings\Application Data\PC_Drivers_Headquarters 2010-02-15 11:51 . 2010-02-15 11:51 -------- d-----w- c:\documents and settings\All Users\Application Data\ParetoLogic 2010-02-15 11:51 . 2010-02-15 11:51 -------- d-----w- c:\program files\Common Files\ParetoLogic 2010-02-15 11:51 . 2010-02-15 11:51 -------- d-----w- c:\documents and settings\All Users\Application Data\FileCure 2010-02-08 14:17 . 2010-02-08 14:27 -------- d-----w- c:\program files\trend micro 2010-02-08 14:17 . 2010-02-08 14:17 -------- d-----w- C:\rsit 2010-02-08 12:46 . 2010-02-08 12:46 -------- d-----w- c:\documents and settings\Cecile\Application Data\Malwarebytes 2010-02-08 12:46 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-02-08 12:46 . 2010-02-08 12:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2010-02-08 12:46 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-02-08 12:46 . 2010-02-08 12:46 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-02-08 12:19 . 2010-02-08 12:19 -------- d-----w- c:\program files\CCleaner 2010-02-08 01:00 . 2010-02-08 01:00 -------- d-----w- c:\documents and settings\Cecile\Application Data\TeamViewer 2010-02-08 01:00 . 2010-02-08 01:00 -------- d-----w- c:\documents and settings\Cecile\temp 2010-02-07 16:00 . 2010-02-07 15:52 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys 2010-02-07 16:00 . 2010-02-07 15:52 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys 2010-02-07 16:00 . 2010-02-07 15:52 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys 2010-02-07 16:00 . 2010-02-07 15:52 97608 ----a-w- c:\windows\system32\drivers\avfwot.sys 2010-02-07 16:00 . 2010-02-07 15:52 69632 ----a-w- c:\windows\system32\drivers\avfwim.sys 2010-02-07 16:00 . 2010-02-07 16:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira 2010-02-07 16:00 . 2010-02-07 16:00 -------- d-----w- c:\program files\Avira 2010-02-07 11:38 . 2010-02-15 12:05 -------- d-----w- c:\documents and settings\Cecile\Local Settings\Application Data\WMTools Downloaded Files 2010-02-07 09:18 . 2010-02-07 09:22 -------- d-----w- c:\program files\ICQ6.5 2010-02-03 21:42 . 2010-02-04 10:46 -------- d-----w- c:\documents and settings\Cecile\Application Data\FILEminimizerPictures 2010-02-03 21:42 . 2010-02-03 21:42 -------- d-----w- c:\program files\FILEminimizer Pictures 2010-02-02 11:44 . 2010-02-02 11:44 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache 2010-01-31 20:28 . 2010-01-31 20:36 -------- d-----w- c:\program files\Common Files\Symantec Shared 2010-01-31 20:22 . 2010-01-31 20:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton 2010-01-31 20:22 . 2010-01-31 20:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec 2010-01-31 20:22 . 2010-01-31 20:22 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller 2010-01-31 18:19 . 2010-02-07 09:03 -------- d-----w- c:\windows\system32\Adobe 2010-01-30 08:00 . 2010-01-30 08:00 -------- d-----w- c:\documents and settings\Cecile\Local Settings\Application Data\Unity 2010-01-26 11:18 . 2008-04-13 23:17 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-02-17 10:15 . 2009-06-30 15:55 -------- d-----w- c:\documents and settings\Cecile\Application Data\StarOffice8 2010-02-16 15:31 . 2009-07-01 19:10 4754 ----a-w- c:\documents and settings\Cecile\Application Data\wklnhst.dat 2010-02-13 05:12 . 2009-07-07 11:29 -------- d-----w- c:\documents and settings\Cecile\Application Data\Skype 2010-02-13 04:13 . 2009-07-07 11:34 -------- d-----w- c:\documents and settings\Cecile\Application Data\skypePM 2010-02-09 13:54 . 2009-07-08 02:07 -------- d-----w- c:\documents and settings\Cecile\Application Data\dvdcss 2010-02-07 15:52 . 2009-08-07 04:49 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2010-02-07 09:38 . 2008-06-24 13:04 -------- d-----w- c:\program files\Common Files\Adobe 2010-02-07 09:32 . 2009-07-07 11:51 -------- d-----w- c:\program files\ICQ6Toolbar 2010-02-07 09:29 . 2009-10-31 05:31 -------- d-----w- c:\program files\QuickTime 2010-02-07 09:21 . 2009-07-07 11:51 -------- d-----w- c:\documents and settings\All Users\Application Data\ICQ 2010-02-04 10:34 . 2009-06-30 15:56 1 ----a-w- c:\documents and settings\Cecile\Application Data\StarOffice8\user\uno_packages\cache\stamp.sys 2010-01-23 03:14 . 2009-11-13 03:52 -------- d-----w- c:\program files\Microsoft Silverlight 2010-01-18 06:30 . 2010-01-18 06:30 348160 ----a-w- c:\windows\system32\msvcr71.dll 2010-01-18 06:30 . 2010-01-18 06:30 499712 ----a-w- c:\windows\system32\msvcp71.dll 2010-01-09 15:03 . 2010-01-08 23:30 -------- d-----w- c:\program files\GameRaving Toolbar 2010-01-08 23:32 . 2010-01-08 23:32 -------- d-----w- c:\program files\BrowserZinc 2010-01-08 23:32 . 2010-01-08 23:32 -------- d-----w- c:\documents and settings\All Users\Application Data\BrowserZinc 2009-12-31 16:50 . 2008-04-25 05:06 353792 ----a-w- c:\windows\system32\drivers\srv.sys 2009-12-21 19:14 . 2008-04-25 05:06 916480 ----a-w- c:\windows\system32\wininet.dll 2009-12-16 18:43 . 2008-04-25 05:00 343040 ----a-w- c:\windows\system32\mspaint.exe 2009-12-14 07:08 . 2008-04-25 05:03 33280 ----a-w- c:\windows\system32\csrsrv.dll 2009-12-08 19:26 . 2008-04-25 05:05 2145280 ----a-w- c:\windows\system32\ntoskrnl.exe 2009-12-08 18:43 . 2008-04-14 00:01 2023936 ----a-w- c:\windows\system32\ntkrnlpa.exe 2009-12-04 18:22 . 2008-04-25 05:05 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys 2009-11-27 17:11 . 2008-04-25 05:05 1291776 ----a-w- c:\windows\system32\quartz.dll 2009-11-27 17:11 . 2008-04-14 05:42 17920 ----a-w- c:\windows\system32\msyuv.dll 2009-11-27 16:07 . 2008-04-25 05:05 28672 ----a-w- c:\windows\system32\msvidc32.dll 2009-11-27 16:07 . 2001-08-17 22:36 8704 ----a-w- c:\windows\system32\tsbyuv.dll 2009-11-27 16:07 . 2008-04-25 05:05 11264 ----a-w- c:\windows\system32\msrle32.dll 2009-11-27 16:07 . 2008-04-25 05:03 84992 ----a-w- c:\windows\system32\avifil32.dll 2009-11-27 16:07 . 2008-04-14 05:41 48128 ----a-w- c:\windows\system32\iyuv_32.dll 2009-11-26 13:01 . 2010-01-08 23:32 58744 ----a-w- c:\documents and settings\All Users\Application Data\BrowserZinc\browserzinc114.exe 2009-11-21 15:51 . 2008-04-25 05:03 471552 ----a-w- c:\windows\AppPatch\aclayers.dll 2008-05-07 08:34 . 2008-06-24 13:21 15523560 ----a-w- c:\program files\U1 Setup.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883840] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232] "AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2008-09-26 2356088] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AsusTray"="c:\program files\EeePC\ACPI\AsTray.exe" [2008-06-03 98304] "AsusACPIServer"="c:\program files\EeePC\ACPI\AsAcpiSvr.exe" [2008-06-03 479232] "AsusEPCMonitor"="c:\program files\EeePC\ACPI\AsEPCMon.exe" [2008-05-20 94208] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-24 132496] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-12-19 135168] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-12-19 159744] "Persistence"="c:\windows\system32\igfxpers.exe" [2007-12-19 131072] "RTHDCPL"="RTHDCPL.EXE" [2008-04-28 16861696] "SoundMan"="SOUNDMAN.EXE" [2006-07-21 86016] "AlcWzrd"="ALCWZRD.EXE" [2006-05-04 2808832] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-03-28 413696] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-02-07 209153] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] "Prnres"="c:\documents and settings\Cecile\Application Data\Adobe\Update\32ret.dat" [2010-02-05 216576] c:\documents and settings\Cecile\Start Menu\Programs\Startup\ StarOffice 8.lnk - c:\program files\Sun\StarOffice 8\program\quickstart.exe [2007-8-17 122880] c:\documents and settings\All Users\Start Menu\Programs\Startup\ SuperHybridEngine.lnk - c:\program files\Asus\EeePC\Super Hybrid Engine\SuperHybridEngine.exe [2008-6-24 294912] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2008-10-15 00:04 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] 2009-07-26 15:44 3883840 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\ICQ6.5\\ICQ.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 avfwot;avfwot;c:\windows\system32\drivers\avfwot.sys [07.02.2010 17:00 97608] R2 AntiVirFirewallService;Avira Firewall;c:\program files\Avira\AntiVir Desktop\avfwsvc.exe [07.02.2010 17:00 388865] R2 AntiVirMailService;Avira AntiVir MailGuard;c:\program files\Avira\AntiVir Desktop\avmailc.exe [07.02.2010 17:00 194817] R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [07.02.2010 17:00 108289] R2 AntiVirWebService;Avira AntiVir WebGuard;c:\program files\Avira\AntiVir Desktop\avwebgrd.exe [07.02.2010 17:00 434945] R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [07.07.2009 12:51 222456] R3 avfwim;AvFw Packet Filter Miniport;c:\windows\system32\drivers\avfwim.sys [07.02.2010 17:00 69632] S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys --> c:\windows\system32\drivers\massfilter.sys [?] . Contents of the 'Scheduled Tasks' folder 2010-02-09 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 13:57] 2010-02-15 c:\windows\Tasks\ParetoLogic Registration3.job - c:\program files\Common Files\ParetoLogic\UUS3\UUS3.dll [2009-08-04 18:19] 2010-02-15 c:\windows\Tasks\ParetoLogic Update Version3.job - c:\program files\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2009-08-04 18:19] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.theprizeday.com/today.php uInternet Connection Wizard,ShellNext = hxxp://eeepc.asus.com/global IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll FF - ProfilePath - c:\documents and settings\Cecile\Application Data\Mozilla\Firefox\Profiles\ctrmgbq8.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxps://my.screenname.aol.com/_cqr/login/login.psp?sitedomain=sns.webmail.aol.com&lang=de&locale=de&authLev=0&siteState=ver%3a4%7crt%3aSTANDARD%7cat%3aSNS%7cld%3awebmail.aol.com%7crp%3aLite%2 52fToday.aspx%7cuv%3aAOL%7clc%3ade-de%7cmt%3aAOL%7csnt%3aScreenName%7csid%3a0f9c157e-5c54-471d-8b07-7dd6f38e04f5&offerId=webmail-de-de&seamless=novl&xchk=false FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q= FF - plugin: c:\documents and settings\Cecile\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- FIREFOX POLICIES ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); . - - - - ORPHANS REMOVED - - - - AddRemove-UnityWebPlayer - c:\documents and settings\Cecile\Local Settings\Application Data\Unity\WebPlayer\Uninstall.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-02-17 14:32 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'lsass.exe'(1156) c:\program files\Avira\AntiVir Desktop\avsda.dll . Completion time: 2010-02-17 14:34:58 ComboFix-quarantined-files.txt 2010-02-17 13:34 Pre-Run: 75.054.710.784 bytes free Post-Run: 75.023.773.696 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=AlwaysOff - - End Of File - - E350AA88D4EE61719B49B8C994F73934 |
|
17.02.2010, 19:05
| #8 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | tab-problem, forefoxabsturz, "data exuction prevention"?Zitat:
Wenn die Datei schon ausgewertet sein sollte, bitte eine weitere Auswertung starten. Mach danch auch noch einen Kontrollscan, öffne Malwarebytes, aktualisiere das Programm, starte einen Vollscan und lass alle etwaigen Funde entfernen. Anschließend wieder das Logfile posten.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
18.02.2010, 00:31
| #9 |
| | tab-problem, forefoxabsturz, "data exuction prevention"? das erschien ,als ich auf senden gedrückt habe, bei virustotal.. ich mache jetzt den malewarescan.... |
|
18.02.2010, 01:12
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | tab-problem, forefoxabsturz, "data exuction prevention"? Was erschien, häh? 
__________________ Logfiles bitte immer in CODE-Tags posten |
|
18.02.2010, 01:16
| #11 |
| | tab-problem, forefoxabsturz, "data exuction prevention"? ach ich hab vergessen ,dies reinzukopieren   0 bytes size received / Se ha recibido un archivo vacio und das kam bei maleware raus Malwarebytes' Anti-Malware 1.44 Datenbank Version: 3707 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 18.02.2010 01:13:44 mbam-log-2010-02-18 (01-13-44).txt Scan-Methode: Vollständiger Scan (C:\|D:\|E:\|) Durchsuchte Objekte: 178354 Laufzeit: 41 minute(s), 9 second(s) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) |
|
18.02.2010, 01:18
| #12 |
| | tab-problem, forefoxabsturz, "data exuction prevention"? ach so, ich vergaß als ich auf diese datei klickte, kam antivir und ich hab auf löschen geklickt... |
|
18.02.2010, 01:29
| #13 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ |  tab-problem, forefoxabsturz, "data exuction prevention"?Zitat:
 Du sollst sie auwerten, löschst sie aber im gleichen Atemzug Stell sie bitte aus der Quarantäne wieder her und werte sie aus.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
18.02.2010, 01:32
| #14 |
| | tab-problem, forefoxabsturz, "data exuction prevention"? soooooooorryyyy  ähm wie mach ich das *lieb duck* |
|
18.02.2010, 01:40
| #15 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | tab-problem, forefoxabsturz, "data exuction prevention"? Ich habs nicht installiert, müsste aber hier sein => Antivir-Quarantäne (Verwaltung > Quarantäne) wiederherstellen Wenn sie weg ist, ist sie weg d.h. sie muss nicht mehr unbedingt in der Quarantäne liegen. Sie wurde ja auch erkannt, also es war wohl doch schon bekannte Malware.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu tab-problem, forefoxabsturz, "data exuction prevention"? |
| computer, data, fenster, firefox"absturz", forum, gen, hochfahren, klein, klick, kurzem, liebe, message, microsoft, min, mozilla, mögliche, neuer, neuer tab, nicht mehr, probleme, protect, tab, tabproblem, this, troja, trojaner, virus??, wirklich, öffnet |
Linear-Darstellung
