| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Heuristischer Treffer mit Inhalt HEUR/HTML.MalwareWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
25.03.2010, 09:54
| #1 |
| |  Heuristischer Treffer mit Inhalt HEUR/HTML.Malware Hallo zusammen, ich brauche dringend Hilfe, da ich mich überhaupt nich mit solchen Problemen auskenne... Avira AntiVir hat mir mehrmals die Meldung "heuristischer Treffer gefunden - enthält verdächtigen Code HEUR/HTML.Malware" gebracht und zusätzlich die Meldung eines Virus, der in "C:Users/***/AppData/Local/Microsoft/Windows/TemporaryInternetFiles/Content.IES/QVRM30KM/13134[1].js" steckt. Anmerkung hierzu "Enthält Erkennungsmuster des JavaScript Virus JS/Redirectos.5109" HAbe mein System bereits von AntiVir scannen lassen, als auch mit dem CCCleaner bereinigt und mit Malwarebytes scannen lassen. Hier noch der Bericht von MalwareBytes: Malwarebytes' Anti-Malware 1.44 Datenbank Version: 3910 Windows 6.0.6002 Service Pack 2 Internet Explorer 7.0.6002.18005 25.03.2010 09:29:22 mbam-log-2010-03-25 (09-29-22).txt Scan-Methode: Vollständiger Scan (C:\|D:\|) Durchsuchte Objekte: 353500 Laufzeit: 1 hour(s), 30 minute(s), 30 second(s) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 4 Infizierte Registrierungswerte: 2 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 6 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\YVIBBBHA8C (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\WEK9EMDHI9 (Trojan.Agent) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yvibbbha8c (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wek9emdhi9 (Trojan.Agent) -> Quarantined and deleted successfully. Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: C:\Program Files\Hardcopy\hcf.exe (Rogue.Installer) -> Quarantined and deleted successfully. C:\Users\Katha\AppData\Local\Temp\Ocd.exe (Trojan.FakeAlert) -> Delete on reboot. C:\Windows\Ovavia.exe (Trojan.Agent) -> Delete on reboot. C:\Windows\System32\sshnas21.dll (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Quarantined and deleted successfully. Ich hoffe, die Angaben sind präzise genug und mir kann irgendjemand hier helfen!!! Vielen Dank für eure Mühe!!! |
|
25.03.2010, 12:08
| #3 |
| | Heuristischer Treffer mit Inhalt HEUR/HTML.Malware Ah okay. schonmal vielen Dank!
__________________Hier der log von RSIT: Logfile of random's system information tool 1.06 (written by random/random) Run by Katha at 2010-03-25 11:55:56 Microsoft® Windows Vista™ Home Premium Service Pack 2 System drive C: has 52 GB (34%) free of 153 GB Total RAM: 3070 MB (54% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:56:19, on 25.03.2010 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v7.00 (7.00.6002.18005) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\AsGHost.exe C:\Windows\system32\taskeng.exe C:\Program Files\ASUS\ASUS Live Update\ALU.exe C:\Windows\Explorer.EXE C:\Program Files\ASUS\SmartLogon\sensorsrv.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\ASUS\AI TouchMedia\AI TouchMedia\Kernel\CLML\CLMLSvc.exe C:\Program Files\ASUS\AI TouchMedia\AI TouchMedia\PCMAgent.exe C:\Program Files\ASUS\AI TouchMedia\PlayMovie\PMVService.exe C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe C:\Windows\System32\rundll32.exe C:\Windows\RtHDVCpl.exe C:\Program Files\ASUS\ATK Media\DMedia.exe C:\Windows\AsScrPro.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\FreePDF_XP\fpassist.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Adobe\Adobe Bridge CS4\Bridge.exe C:\Program Files\ICQ6.5\ICQ.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\McAfee Security Scan\1.0.150\SSScheduler.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\Program Files\Brother\ControlCenter3\brccMCtl.exe C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Internet Explorer\IEUser.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\Macromed\Flash\FlashUtil10e.exe C:\Windows\system32\SearchFilterHost.exe C:\Users\Katha\Downloads\RSIT.exe C:\Program Files\trend micro\Katha.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: (no name) - - (no file) O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: ASUS Security Protect Manager - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ItIEAddIn.dll O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\ASUS\AI TouchMedia\AI TouchMedia\Kernel\CLML\CLMLSvc.exe" O4 - HKLM\..\Run: [P2Go_Menu] "C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0" O4 - HKLM\..\Run: [PCMAgent] "C:\Program Files\ASUS\AI TouchMedia\AI TouchMedia\PCMAgent.exe" O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\ASUS\AI TouchMedia\PlayMovie\PMVService.exe" O4 - HKLM\..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe O4 - HKLM\..\Run: [ATKOSD2] C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll,RegisterModule O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMedia.exe O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" O4 - HKLM\..\Run: [PPort11reminder] "C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini" O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin O4 - HKLM\..\Run: [Skytel] Skytel.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [FreePDF Assistant] C:\Program Files\FreePDF_XP\fpassist.exe O4 - HKLM\..\Run: [ Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 O4 - HKCU\..\Run: [AdobeBridge] "C:\Program Files\Adobe\Adobe Bridge CS4\Bridge.exe" -stealth O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6.5\ICQ.exe" silent O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST') O4 - Startup: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O4 - Global Startup: Bluetooth.lnk = ? O4 - Global Startup: McAfee Security Scan.lnk = ? O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: ASUS Security Protect Manager e-Wallet - {1009C944-97D5-44A9-9E32-DFF54F498968} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWallet.dll O9 - Extra 'Tools' menuitem: ASUS Security Protect Manager e-&Wallet - {1009C944-97D5-44A9-9E32-DFF54F498968} - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWallet.dll O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe O13 - Gopher Prefix: O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll O20 - AppInit_DLLs: APSHook.dll O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Program Files\ATKGFNEX\GFNEXSrv.exe O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe -- End of file - 12817 bytes ======Scheduled tasks folder====== C:\Windows\tasks\User_Feed_Synchronization-{67E7BBF6-66F0-4E36-B0DC-E6C3584B6C85}.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}] Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}] Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2009-06-11 259696] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}] Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll [2009-11-09 764912] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}] Google Dictionary Compression sdch - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll [2009-04-28 470512] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DF21F1DB-80C6-11D3-9483-B03D0EC10000}] ASUS Security Protect Manager - C:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ItIEAddIn.dll [2006-11-21 70928] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2009-06-11 259696] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-21 1008184] "CLMLServer"=C:\Program Files\ASUS\AI TouchMedia\AI TouchMedia\Kernel\CLML\CLMLSvc.exe [2008-06-12 196608] "P2Go_Menu"=C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [2008-06-14 210216] "PCMAgent"=C:\Program Files\ASUS\AI TouchMedia\AI TouchMedia\PCMAgent.exe [2008-06-12 212992] "PlayMovie"=C:\Program Files\ASUS\AI TouchMedia\PlayMovie\PMVService.exe [2008-05-20 172032] "HControlUser"=C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe [2008-01-12 98304] "ATKOSD2"=C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe [2008-07-15 7651328] "NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2008-07-25 13548064] "NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2008-07-25 92704] "RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2008-06-13 6183456] "CognizanceTS"=C:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll [2003-12-22 17920] "ATKMEDIA"=C:\Program Files\ASUS\ATK Media\DMedia.exe [2008-08-19 159744] "ASUS Screen Saver Protector"=C:\Windows\AsScrPro.exe [2008-11-03 3054136] "SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2008-07-03 1328424] "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792] "SSBkgdUpdate"=C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [2006-10-25 210472] "PaperPort PTD"=C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe [2007-10-11 29984] "IndexSearch"=C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe [2007-10-11 46368] "PPort11reminder"=C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe [2007-08-31 328992] "BrMfcWnd"=C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [2008-02-19 1089536] "ControlCenter3"=C:\Program Files\Brother\ControlCenter3\brctrcen.exe [2007-12-21 86016] "avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153] "GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016] "NBKeyScan"=C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2008-02-18 2221352] "AdobeCS4ServiceManager"=C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [2008-08-14 611712] "Skytel"=C:\Windows\Skytel.exe [2007-11-20 1826816] "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-11 149280] "QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-11-10 417792] "iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-11-12 141600] "FreePDF Assistant"=C:\Program Files\FreePDF_XP\fpassist.exe [2009-09-05 385024] " Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2010-01-07 1394000] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-04-11 1233920] "WindowsWelcomeCenter"=oobefldr.dll,ShowWelcomeCenter [] "LightScribe Control Panel"=C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2008-06-09 2363392] "swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-11-03 39408] "Skype"=C:\Program Files\Skype\Phone\Skype.exe [2009-02-04 23975720] "IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [2008-02-28 1828136] "AdobeBridge"=C:\Program Files\Adobe\Adobe Bridge CS4\Bridge.exe [2008-08-28 13145448] "WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-21 202240] "ICQ"=C:\Program Files\ICQ6.5\ICQ.exe [2009-11-16 172792] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe McAfee Security Scan.lnk - C:\Program Files\McAfee Security Scan\1.0.150\SSScheduler.exe WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE C:\Users\Katha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLS"="APSHook.dll" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] "notification packages"=scecli ASWLNPkg [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "EnableUIADesktopToggle"=0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "BindDirectlyToPropertySetStorage"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F] shell\AutoRun\command - F:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{798b83cf-ecf8-11de-94cc-0023547c52a7}] shell\AutoRun\command - F:\AutoRun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{798b83e1-ecf8-11de-94cc-0023547c52a7}] shell\AutoRun\command - F:\AutoRun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9bebc7e2-0d98-11de-9718-0023547c52a7}] shell\AutoRun\command - F:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a0dc352f-ce68-11de-9626-0023547c52a7}] shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe LONI.vbs ======List of files/folders created in the last 1 months====== 2010-03-25 11:55:56 ----D---- C:\rsit 2010-03-25 11:55:56 ----D---- C:\Program Files\trend micro 2010-03-25 07:54:09 ----D---- C:\Users\Katha\AppData\Roaming\Malwarebytes 2010-03-25 07:54:04 ----D---- C:\ProgramData\Malwarebytes 2010-03-25 07:54:04 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2010-03-25 07:41:39 ----D---- C:\Program Files\CCleaner 2010-03-16 19:24:30 ----A---- C:\Windows\system32\browserchoice.exe 2010-03-12 03:00:43 ----A---- C:\Windows\system32\nshhttp.dll 2010-03-12 03:00:40 ----A---- C:\Windows\system32\httpapi.dll ======List of files/folders modified in the last 1 months====== 2010-03-25 11:56:09 ----D---- C:\Windows\Prefetch 2010-03-25 11:56:01 ----D---- C:\Windows\Temp 2010-03-25 11:55:56 ----RD---- C:\Program Files 2010-03-25 11:50:25 ----D---- C:\Users\Katha\AppData\Roaming\Skype 2010-03-25 09:34:53 ----D---- C:\Users\Katha\AppData\Roaming\skypePM 2010-03-25 09:32:47 ----A---- C:\Windows\system32\acovcnt.exe 2010-03-25 09:32:05 ----D---- C:\Windows 2010-03-25 09:31:56 ----D---- C:\Windows\system32\drivers 2010-03-25 09:30:53 ----D---- C:\Windows\Provisioning 2010-03-25 09:29:22 ----D---- C:\Windows\Tasks 2010-03-25 09:29:22 ----D---- C:\Windows\System32 2010-03-25 09:29:22 ----D---- C:\Program Files\Hardcopy 2010-03-25 09:18:30 ----D---- C:\Windows\system32\Tasks 2010-03-25 07:54:04 ----HD---- C:\ProgramData 2010-03-25 07:49:33 ----D---- C:\Windows\Debug 2010-03-25 00:15:47 ----A---- C:\Windows\system32\PerfStringBackup.INI 2010-03-25 00:15:46 ----D---- C:\Windows\inf 2010-03-24 23:28:38 ----SHD---- C:\System Volume Information 2010-03-24 23:17:14 ----D---- C:\Program Files\Mozilla Firefox 2010-03-21 17:49:30 ----D---- C:\Windows\Minidump 2010-03-21 17:49:23 ----SD---- C:\Windows\Downloaded Program Files 2010-03-16 19:25:18 ----D---- C:\Windows\winsxs 2010-03-16 19:25:13 ----D---- C:\Windows\system32\catroot 2010-03-15 18:52:08 ----D---- C:\Windows\system32\catroot2 2010-03-12 04:22:31 ----D---- C:\Program Files\Windows Mail 2010-03-12 04:22:31 ----D---- C:\Program Files\Movie Maker 2010-03-02 06:30:12 ----A---- C:\Windows\system32\mrt.exe 2010-02-26 17:58:26 ----D---- C:\Windows\rescache 2010-02-26 11:47:27 ----D---- C:\Windows\system32\de-DE 2010-02-26 11:47:25 ----D---- C:\Windows\AppPatch 2010-02-26 11:47:24 ----RSD---- C:\Windows\Fonts ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys [2009-02-13 11608] R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2009-04-27 96104] R1 ssmdrv;ssmdrv; C:\Windows\system32\DRIVERS\ssmdrv.sys [2009-06-09 28520] R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; \??\C:\Program Files\ASUS\AI TouchMedia\PlayMovie\000.fcl [2008-05-20 61424] R2 adfs;adfs; C:\Windows\system32\drivers\adfs.sys [2008-08-14 74720] R2 ASMMAP;ASMMAP; \??\C:\Program Files\ATKGFNEX\ASMMAP.sys [2007-07-24 13880] R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2009-12-08 56816] R2 ghaio;ghaio; \??\C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys [2007-08-03 20936] R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2008-06-25 47104] R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2007-07-30 43008] R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2007-07-30 38400] R3 AgereSoftModem;Agere Systems Soft Modem; C:\Windows\system32\DRIVERS\AGRSM.sys [2008-03-21 1203776] R3 ATSWPDRV;AuthenTec TruePrint USB Driver (SwipeSensor); C:\Windows\system32\DRIVERS\ATSwpDrv.sys [2007-06-17 146824] R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-21 14208] R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600] R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-06-13 2152344] R3 itecir;ITECIR Infrared Receiver; C:\Windows\system32\DRIVERS\itecir.sys [2007-12-19 54784] R3 kbfiltr;Keyboard Filter; C:\Windows\system32\DRIVERS\kbfiltr.sys [2008-06-03 15928] R3 MODEMCSA;Unimodem-Datenstromfiltergerät; C:\Windows\system32\drivers\MODEMCSA.sys [2008-01-21 18432] R3 MTsensor;ATK0100 ACPI UTILITY; C:\Windows\system32\DRIVERS\ATKACPI.sys [2006-12-14 7680] R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\NETw5v32.sys [2009-05-28 4233728] R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda32v.sys [2008-06-25 44064] R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2008-07-25 7547552] R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2008-02-14 118784] R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-04-11 89088] R3 SNP2UVC;USB2.0 PC Camera (SNP2UVC); C:\Windows\system32\DRIVERS\snp2uvc.sys [2008-05-13 1772544] R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2008-07-03 200112] S3 BthEnum;Bluetooth-Auflistungsdienst; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-04-11 22528] S3 BthPan;Bluetooth Device (Personal Area Network); C:\Windows\system32\DRIVERS\bthpan.sys [2008-01-21 92160] S3 BTHPORT;Bluetooth-Porttreiber; C:\Windows\System32\Drivers\BTHport.sys [2009-04-11 507904] S3 BTHUSB;USB-Treiber für Bluetooth-Sender; C:\Windows\System32\Drivers\BTHUSB.sys [2009-04-11 29696] S3 btwaudio;Bluetooth-Audiogerät; C:\Windows\system32\drivers\btwaudio.sys [2008-07-09 81960] S3 btwavdt;Bluetooth AVDT; C:\Windows\system32\drivers\btwavdt.sys [2008-05-13 100392] S3 btwl2cap;Bluetooth L2CAP Service; C:\Windows\system32\DRIVERS\btwl2cap.sys [2008-01-29 29736] S3 btwrchid;btwrchid; C:\Windows\system32\DRIVERS\btwrchid.sys [2008-05-13 17320] S3 drmkaud;Microsoft Kernel-DRM-Audioentschlüsselung; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632] S3 HdAudAddService;Microsoft 1.1 UAA Function Driver for High Definition Audio Service; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520] S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\Windows\system32\DRIVERS\ewusbmdm.sys [] S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192] S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888] S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504] S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016] S3 RFCOMM;Bluetooth-Gerät (RFCOMM-Protokoll-TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-04-11 148992] S3 smserial;smserial; C:\Windows\system32\DRIVERS\smserial.sys [2006-11-02 1010560] S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2009-08-28 40448] S3 usbscan;USB-Scannertreiber; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-21 35328] S3 usbvideo;USB Video Device (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-21 134016] S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-10-01 40448] S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328] S3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller; C:\Windows\system32\DRIVERS\yk60x86.sys [2006-11-02 194048] S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656] S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616] S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2008-01-21 11264] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 AgereModemAudio;Agere Modem Call Progress Audio; C:\Windows\system32\agrsmsvc.exe [2008-03-18 13312] R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-06-09 108289] R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-08-05 185089] R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-08-28 144672] R2 ASBroker;Logon Session Broker; C:\Windows\System32\svchost.exe [2008-01-21 21504] R2 ASChannel;Local Communication Channel; C:\Windows\System32\svchost.exe [2008-01-21 21504] R2 ASLDRService;ASLDR Service; C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe [2007-10-03 94208] R2 ATKGFNEXSrv;ATKGFNEX Service; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [2007-08-08 94208] R2 Bonjour Service;Bonjour-Dienst; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888] R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2008-01-21 21504] R2 btwdins;Bluetooth Service; C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe [2008-07-30 522792] R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2008-06-09 73728] R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2008-02-18 877864] R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2008-07-25 196608] R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\Windows\system32\IoctlSvc.exe [2006-12-19 81920] R2 spmgr;spmgr; C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe [2007-08-03 125496] R3 iPod Service;iPod-Dienst; C:\Program Files\iPod\bin\iPodService.exe [2009-11-12 545568] R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2008-02-28 529704] S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-03-28 655624] S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-21 21504] S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-04-28 182768] S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824] S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-27 441136] S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184] -----------------EOF----------------- ist ein log von GMER zusätzlich nötig und wie oder woher krieg ich den? Danke!!!! |
|
25.03.2010, 12:10
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Heuristischer Treffer mit Inhalt HEUR/HTML.Malware Lies doch einfach die Anleitung zu GMER ... 
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
25.03.2010, 12:30
| #5 |
| | Heuristischer Treffer mit Inhalt HEUR/HTML.Malware ja okay. sorry! war ne blöde frage. jetzt hab ichs schon gemacht... allerdings hab ich nun n neues problem =( während des scannens kam plötzlich ne meldung, dass das programm nicht mehr funktioniert. also hab ichs erneut ausgeführt, was dann dazu geführt hat, dass mein bildschirm blau wurde und die mitteilung erschien, dass ein fehler im system gefunden wurde und der pc sofort heruntergefahren wird, um schäden zu vermeiden...... was mach ich denn jetzt??? mein pc darf nich den geist aufgeben!!! =( danke für die geduld und hilfe! liebe grüße, katha |
|
25.03.2010, 12:51
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Heuristischer Treffer mit Inhalt HEUR/HTML.Malware Immer Ruhe bewahren. GMER stürzt leider häufiger ab. Probier den Durchgang einfach nochmal. Ob es klappt oder nicht, bitte auch das hier machen: Lade dir Lop S&D herunter. Windows2000/XP: Führe Lop S&D.exe per Doppelklick aus. Windows Vista und 7: Rechtsklick auf Lop S&D.exe => Ausführen als Admin!! Wähle die Sprache deiner Wahl und anschließend die Option 1. Warte bis der Scanbericht erstellt wird und poste ihn hier (Du findest ihn unter C:\lopR.txt, sollte der Bericht nicht erscheinen).
__________________ --> Heuristischer Treffer mit Inhalt HEUR/HTML.Malware |
|
25.03.2010, 13:20
| #7 |
| | Heuristischer Treffer mit Inhalt HEUR/HTML.Malware Okay. Vielen Dank! Leider konnte auch bei 2 weiteren Versuchen GMER nicht vollständig ausgeführt werden. es kommen immer Fehlermeldungen. Aber hier der log von LOP: --------------------\\ Lop S&D 4.2.5-0 XP/Vista Microsoft® Windows Vista™ Home Premium ( v6.0.6002 ) Service Pack 2 X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU P8600 @ 2.40GHz ) BIOS : Default System BIOS USER : Katha ( Administrator ) BOOT : Normal boot C:\ (Local Disk) - NTFS - Total:149 Go (Free:50 Go) D:\ (Local Disk) - NTFS - Total:139 Go (Free:139 Go) E:\ (CD or DVD) G:\ (USB) "C:\Lop SD" ( MAJ : 19-12-2008|23:40 ) Option : [1] ( 25.03.2010|13:16 ) [ UAC => 1 ] --------------------\\ Ordner Verzeichnis unter Local [09.04.2009|16:50] C:\Users\Katha\AppData\Local\Adobe [12.06.2009|21:56] C:\Users\Katha\AppData\Local\Ahead [07.03.2009|14:42] C:\Users\Katha\AppData\Local\Anwendungsdaten [11.03.2009|19:18] C:\Users\Katha\AppData\Local\Apple [19.01.2010|17:31] C:\Users\Katha\AppData\Local\Apple Computer [21.09.2009|15:14] C:\Users\Katha\AppData\Local\Apple_Inc [31.03.2009|11:21] C:\Users\Katha\AppData\Local\ArchiCAD_3001995593 [07.03.2009|15:09] C:\Users\Katha\AppData\Local\ASUS [25.03.2010|02:05] C:\Users\Katha\AppData\Local\d3d9caps.dat [23.03.2010|22:17] C:\Users\Katha\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [08.02.2010|19:12] C:\Users\Katha\AppData\Local\FreePDF_XP [26.02.2010|17:55] C:\Users\Katha\AppData\Local\GDIPFONTCACHEV1.DAT [12.06.2009|17:18] C:\Users\Katha\AppData\Local\Google [15.12.2009|19:46] C:\Users\Katha\AppData\Local\Graphisoft [04.06.2009|17:07] C:\Users\Katha\AppData\Local\GS-LW-Temp [25.03.2010|09:31] C:\Users\Katha\AppData\Local\IconCache.db [12.10.2009|18:04] C:\Users\Katha\AppData\Local\keyfile3.drm [20.09.2009|14:34] C:\Users\Katha\AppData\Local\Microsoft [05.10.2009|19:10] C:\Users\Katha\AppData\Local\Microsoft Games [20.01.2010|23:34] C:\Users\Katha\AppData\Local\Microsoft Help [25.03.2010|07:32] C:\Users\Katha\AppData\Local\MigWiz [15.03.2009|21:13] C:\Users\Katha\AppData\Local\Mozilla [29.03.2009|21:40] C:\Users\Katha\AppData\Local\Nero [24.03.2009|23:35] C:\Users\Katha\AppData\Local\PlayMovie [09.03.2009|18:13] C:\Users\Katha\AppData\Local\PowerCinema [17.03.2009|22:10] C:\Users\Katha\AppData\Local\Scansoft [29.03.2009|21:21] C:\Users\Katha\AppData\Local\Seven Zip [25.03.2010|13:15] C:\Users\Katha\AppData\Local\Temp [07.03.2009|14:42] C:\Users\Katha\AppData\Local\Temporary Internet Files [07.03.2009|14:42] C:\Users\Katha\AppData\Local\Verlauf [07.03.2009|16:57] C:\Users\Katha\AppData\Local\VirtualStore [5|Datei(en),] C:\Users\Katha\AppData\Local\Bytes [28|Verzeichnis(se),] C:\Users\Katha\AppData\Local\Bytes frei --------------------\\ Geplante Aufgaben unter C:\Windows\Tasks [25.03.2010 13:15][--ah-----] C:\Windows\tasks\User_Feed_Synchronization-{67E7BBF6-66F0-4E36-B0DC-E6C3584B6C85}.job [25.03.2010 12:22][--ah-----] C:\Windows\tasks\SA.DAT [25.03.2010 09:31][--a------] C:\Windows\tasks\SCHEDLGU.TXT --------------------\\ Ordner Verzeichnis unter C:\ProgramData [21.09.2009|15:07] C:\ProgramData\{755AC846-7372-4AC8-8550-C52491DAA8BD} [30.03.2009|17:28] C:\ProgramData\Adobe [28.03.2009|21:21] C:\ProgramData\ALM [11.03.2009|19:18] C:\ProgramData\Apple [21.09.2009|18:55] C:\ProgramData\Apple Computer [02.11.2006|14:02] C:\ProgramData\Application Data [07.03.2009|15:09] C:\ProgramData\ASUS [18.03.2009|09:35] C:\ProgramData\Avira [17.03.2009|21:59] C:\ProgramData\Brother [28.06.2009|15:14] C:\ProgramData\CanonBJ [07.03.2009|17:18] C:\ProgramData\CyberLink [02.11.2006|14:02] C:\ProgramData\Desktop [02.11.2006|14:02] C:\ProgramData\Documents [15.04.2009|16:23] C:\ProgramData\Estsoft [10.03.2009|18:57] C:\ProgramData\ezsidmv.dat [02.11.2006|14:02] C:\ProgramData\Favorites [18.01.2010|19:16] C:\ProgramData\FLEXnet [08.02.2010|15:13] C:\ProgramData\FreePDF [03.11.2008|12:28] C:\ProgramData\Google [12.03.2009|13:16] C:\ProgramData\ICQ [17.03.2009|22:01] C:\ProgramData\InstallShield [29.03.2009|21:42] C:\ProgramData\LightScribe [25.03.2010|07:54] C:\ProgramData\Malwarebytes [26.10.2009|20:47] C:\ProgramData\McAfee [24.10.2009|20:47] C:\ProgramData\McAfee Security Scan [25.03.2009|20:51] C:\ProgramData\Microsoft [02.11.2009|14:44] C:\ProgramData\Microsoft Help [28.03.2009|19:00] C:\ProgramData\Nero [02.06.2009|11:37] C:\ProgramData\NVIDIA [25.03.2010|12:24] C:\ProgramData\nvModes.001 [14.03.2010|19:54] C:\ProgramData\nvModes.dat [03.11.2008|13:40] C:\ProgramData\P4G [08.09.2009|10:45] C:\ProgramData\PlayFirst [28.04.2009|17:52] C:\ProgramData\ScanSoft [10.03.2009|18:56] C:\ProgramData\Skype [02.11.2006|14:02] C:\ProgramData\Start Menu [07.03.2009|14:58] C:\ProgramData\Symantec [03.11.2008|11:36] C:\ProgramData\Temp [02.11.2006|14:02] C:\ProgramData\Templates [14.06.2009|22:28] C:\ProgramData\Trymedia [18.01.2010|17:44] C:\ProgramData\WindowsSearch [15.04.2009|16:32] C:\ProgramData\WinZip [3|Datei(en),] C:\ProgramData\Bytes [41|Verzeichnis(se),] C:\ProgramData\Bytes frei --------------------\\ Ordner Verzeichnis unter C:\Program Files [28.03.2009|21:24] C:\Program Files\Adobe [21.09.2009|15:02] C:\Program Files\Apple Software Update [03.11.2008|13:42] C:\Program Files\ASUS [03.11.2008|13:21] C:\Program Files\ASUS Security Center [03.11.2008|12:59] C:\Program Files\ATKGFNEX [18.03.2009|09:35] C:\Program Files\Avira [21.09.2009|15:05] C:\Program Files\Bonjour [17.03.2009|22:03] C:\Program Files\Brother [25.03.2010|07:41] C:\Program Files\CCleaner [26.01.2010|18:37] C:\Program Files\CINEMA 4D R10 [21.09.2009|15:00] C:\Program Files\Common Files [28.03.2009|20:39] C:\Program Files\CS4 [03.11.2008|11:37] C:\Program Files\CyberLink [07.05.2009|19:03] C:\Program Files\DivX [03.11.2008|13:10] C:\Program Files\Dolby [03.11.2008|13:43] C:\Program Files\Downloaded Installations [15.04.2009|16:22] C:\Program Files\ESTsoft [03.11.2008|13:20] C:\Program Files\Fingerprint Sensor [08.02.2010|15:13] C:\Program Files\FreePDF_XP [08.02.2010|15:12] C:\Program Files\ghostscript [04.05.2009|22:58] C:\Program Files\Google [11.03.2009|19:15] C:\Program Files\Graphisoft [25.03.2010|09:29] C:\Program Files\Hardcopy [12.01.2010|00:07] C:\Program Files\ICQ6.5 [12.03.2009|13:16] C:\Program Files\ICQ6Toolbar [30.06.2009|15:14] C:\Program Files\Infovox 230 [30.06.2009|15:15] C:\Program Files\Inspiration 7.5 Intl [20.01.2010|09:42] C:\Program Files\InstallShield Installation Information [03.11.2008|12:49] C:\Program Files\Intel [02.06.2009|11:41] C:\Program Files\Internet Explorer [21.09.2009|15:10] C:\Program Files\iPhone-Konfigurationsprogramm [31.01.2010|19:15] C:\Program Files\iPod [31.01.2010|19:16] C:\Program Files\iTunes [14.12.2009|20:29] C:\Program Files\Java [25.03.2010|07:54] C:\Program Files\Malwarebytes' Anti-Malware [24.10.2009|20:47] C:\Program Files\McAfee Security Scan [02.11.2006|13:37] C:\Program Files\Microsoft Games [03.11.2008|11:28] C:\Program Files\Microsoft Office [03.11.2008|11:28] C:\Program Files\Microsoft Visual Studio [25.03.2009|20:48] C:\Program Files\Microsoft Visual Studio 8 [03.11.2008|11:28] C:\Program Files\Microsoft Works [03.11.2008|11:27] C:\Program Files\Microsoft.NET [12.03.2010|04:22] C:\Program Files\Movie Maker [24.03.2010|23:17] C:\Program Files\Mozilla Firefox [25.03.2009|20:52] C:\Program Files\MSBuild [18.03.2009|09:20] C:\Program Files\MSXML 4.0 [28.03.2009|19:00] C:\Program Files\Nero [17.03.2009|22:01] C:\Program Files\Nuance [03.11.2008|13:40] C:\Program Files\P4G [03.11.2008|12:19] C:\Program Files\Picasa2 [31.01.2010|19:13] C:\Program Files\QuickTime [03.11.2008|13:08] C:\Program Files\Realtek [02.11.2006|13:37] C:\Program Files\Reference Assemblies [22.01.2010|03:18] C:\Program Files\ReluxSuite [17.03.2009|22:00] C:\Program Files\ScanSoft [10.03.2009|18:56] C:\Program Files\Skype [03.11.2008|13:45] C:\Program Files\Synaptics [25.03.2010|11:56] C:\Program Files\trend micro [20.01.2010|09:41] C:\Program Files\TREPCAD 4 [02.11.2006|14:01] C:\Program Files\Uninstall Information [15.03.2009|23:56] C:\Program Files\VideoLAN [03.11.2008|13:23] C:\Program Files\WIDCOMM [02.06.2009|11:41] C:\Program Files\Windows Calendar [02.06.2009|11:41] C:\Program Files\Windows Collaboration [02.06.2009|11:41] C:\Program Files\Windows Defender [02.06.2009|11:41] C:\Program Files\Windows Journal [12.03.2010|04:22] C:\Program Files\Windows Mail [28.10.2009|03:16] C:\Program Files\Windows Media Player [02.11.2006|13:37] C:\Program Files\Windows NT [02.06.2009|11:41] C:\Program Files\Windows Photo Gallery [18.11.2009|03:20] C:\Program Files\Windows Portable Devices [02.06.2009|11:41] C:\Program Files\Windows Sidebar [06.01.2010|13:57] C:\Program Files\WinZip [03.11.2008|13:18] C:\Program Files\Wireless Console 2 [0|Datei(en),] C:\Program Files\Bytes [76|Verzeichnis(se),] C:\Program Files\Bytes frei --------------------\\ Ordner Verzeichnis unter C:\Program Files\Common Files [28.03.2009|21:24] C:\Program Files\Common Files\Adobe [31.01.2010|19:15] C:\Program Files\Common Files\Apple [03.11.2008|11:28] C:\Program Files\Common Files\DESIGNER [07.05.2009|19:02] C:\Program Files\Common Files\DivX Shared [17.03.2009|22:00] C:\Program Files\Common Files\InstallShield [11.03.2009|19:13] C:\Program Files\Common Files\Java [03.11.2008|11:36] C:\Program Files\Common Files\LightScribe [28.03.2009|21:08] C:\Program Files\Common Files\Macrovision Shared [30.06.2009|15:09] C:\Program Files\Common Files\microsoft shared [28.03.2009|19:02] C:\Program Files\Common Files\Nero [07.05.2009|19:03] C:\Program Files\Common Files\PX Storage Engine [17.03.2009|22:00] C:\Program Files\Common Files\ScanSoft Shared [02.11.2006|12:18] C:\Program Files\Common Files\Services [10.03.2009|18:56] C:\Program Files\Common Files\Skype [02.11.2006|12:18] C:\Program Files\Common Files\SpeechEngines [07.03.2009|14:59] C:\Program Files\Common Files\Symantec Shared [02.06.2009|11:41] C:\Program Files\Common Files\System [0|Datei(en),] C:\Program Files\Common Files\Bytes [19|Verzeichnis(se),] C:\Program Files\Common Files\Bytes frei --------------------\\ Process ( 107 Processes ) iexplore.exe ~ [PID:4384] --------------------\\ Ueberpruefung mit S_Lop Kein Lop Ordner gefunden ! --------------------\\ Suche nach Lop Dateien - Ordnern Kein Lop Ordner gefunden ! --------------------\\ Suche innerhalb der Registry ..... OK ! --------------------\\ Ueberpruefung der Hosts Datei Hosts Datei SAUBER --------------------\\ Suche nach verborgenen Dateien mit Catchme catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net Rootkit scan 2010-03-25 13:16:36 Windows 6.0.6002 Service Pack 2 NTFS scanning hidden processes ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden files: 0 --------------------\\ Suche nach anderen Infektionen Kein anderen Infektionen gefunden ! [F:19][D:4]-> C:\Users\Katha\AppData\Local\Temp [F:159][D:1]-> C:\Users\Katha\AppData\Roaming\MICROS~1\Windows\Cookies [F:3106][D:9]-> C:\Users\Katha\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5 [F:1][D:1]-> C:\$Recycle.Bin 1 - "C:\Lop SD\LopR_1.txt" - 25.03.2010|13:10 - Option : [4] 2 - "C:\Lop SD\LopR_2.txt" - 25.03.2010|13:18 - Option : [1] --------------------\\ Scan beendet um 13:18:24 [ UAC => 1 ] eigentlich kam jetzt auch schon lange keine Virenmeldung oder sonstiges mehr... Kann es sein, dass bereits der Malware-scan geholfen hat? immerhin hat er auch 12 infizierte Dateien gefunden und gelöscht... oder was sprechen die für mich kryptischen logs?  Tausend dank nochmal!!!! Übrigens großartiges Forum und erstklassige Hilfestellungen! |
|
25.03.2010, 14:03
| #9 |
| | Heuristischer Treffer mit Inhalt HEUR/HTML.Malware ist leider wieder abgestürzt... soll ichs weiterhin versuchen oder gehts auch ohne? puh, mir fällt schonmal ein stein vom herzen, dass du sagst, es sieht gut aus...=) Vielen Dank für die grandiose Hilfe!!!! |
|
25.03.2010, 14:28
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Heuristischer Treffer mit Inhalt HEUR/HTML.Malware Dann probier sonst mal RootRepeal:
Code:
ATTFilter Drivers
Files
Processes
SSDT
Stealth Objects
Hidden Services
Shadow SSDT
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Heuristischer Treffer mit Inhalt HEUR/HTML.Malware |
| .dll, adware.mywebsearch, anti-malware, antivir, avira, avira antivir, bericht, code, dateien, dringend, explorer, hallo zusammen, heur.html.malware, heur/html.malware, heuristischer treffer, javascript, local\temp, malwarebytes, meldung, probleme, präzise, rogue.installer, scan, software, system, system32, trojan.agent, trojan.downloader, trojan.fakealert, virus, {66ba574b-1e11-49b8-909c-8cc9e0e8e015}.job |
Linear-Darstellung
