| |
| |||||||
Log-Analyse und Auswertung: Firewall lässt sich nicht aktivieren. Da stimmt was nichtWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
01.06.2010, 11:16
| #1 |
 |  Firewall lässt sich nicht aktivieren. Da stimmt was nicht Hi. Bei meinen Hauptrechner ist mir heute aufgefallen das unten rechts angezeigt wird das die Firewall deaktiviert ist. Ich wollte sie wieder aktivieren aber dann kommt "Die Windows-Firewalleinstellungen können nicht angezeigt werden, da der zugehörige Dienst nicht ausgeführt wird". Laut Google sind da Rootkits oder Malware am werk was ich allerdings nicht glaube da bei meinen PC's sobald es irgendwo ein Update gibt ich es sofort runterlade und auch so vorsichtig im Internet bin. Zur Sicherheit lasse ich ihn mal durchchecken. HiJackThis: HiJackthis Logfile: Code:
ATTFilter Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 12:13:42, on 01.06.2010 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Programme\Avira\AntiVir Desktop\sched.exe C:\WINDOWS\Explorer.EXE C:\Programme\Avira\AntiVir Desktop\avgnt.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\RTHDCPL.EXE C:\Programme\TOPRO\TPPOLL.EXE C:\WINDOWS\system32\LXSUPMON.EXE C:\Programme\Skype\Phone\Skype.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\ICQ7.1\ICQ.exe C:\Programme\RALINK\Common\RaUI.exe C:\Programme\Avira\AntiVir Desktop\avguard.exe C:\Programme\LogMeIn Hamachi\hamachi-2.exe C:\Programme\Spyware Terminator\sp_rsser.exe C:\Programme\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\svchost.exe C:\Programme\Avira\AntiVir Desktop\avshadow.exe C:\Programme\Skype\Plugin Manager\skypePM.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\Programme\Mozilla Firefox\firefox.exe C:\Programme\Skype\Toolbars\Shared\SkypeNames2.exe C:\PROGRA~1\Crawler\CToolbar.exe C:\Dokumente und Einstellungen\Alex\Desktop\HiJackThis204.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60076 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://www.crawler.com/search/ie.aspx?tb_id=60076 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = hxxp://dnl.crawler.com/support/sa_customize.aspx?TbId=60076 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.crawler.com/search/ie.aspx?tb_id=60076 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = hxxp://dnl.crawler.com/support/sa_customize.aspx?TbId=60076 R3 - URLSearchHook: (no name) - - (no file) O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\Programme\Crawler\ctbr.dll O2 - BHO: ooVoo Toolbar - {A1FB2F9A-D35E-11DD-8935-E46A56D89593} - C:\Programme\oovootb\oovoodx.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll (file missing) O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (file missing) O3 - Toolbar: ooVoo Toolbar - {A1FB2F9A-D35E-11DD-8935-E46A56D89593} - C:\Programme\oovootb\oovoodx.dll O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\Programme\Crawler\ctbr.dll O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [Adobe ARM] "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [TrayServer] C:\Programme\MAGIX\Video_deluxe_2008\TrayServer.exe O4 - HKLM\..\Run: [TPPOLL] C:\Programme\TOPRO\TPPOLL.EXE O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Programme\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Programme\Alcohol Soft\Alcohol 52\axcmd.exe" /automount O4 - HKCU\..\Run: [ICQ] "C:\Programme\ICQ7.1\ICQ.exe" silent loginmode=4 O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - S-1-5-18 Startup: Verknüpfung mit RTHDCPL.lnk = C:\Programme\Realtek\Audio\Drivers\WDM\RTHDCPL.exe (User 'SYSTEM') O4 - .DEFAULT Startup: Verknüpfung mit RTHDCPL.lnk = C:\Programme\Realtek\Audio\Drivers\WDM\RTHDCPL.exe (User 'Default user') O4 - Startup: Verknüpfung mit RTHDCPL.lnk = C:\Programme\Realtek\Audio\Drivers\WDM\RTHDCPL.exe O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Programme\RALINK\Common\RaUI.exe O8 - Extra context menu item: Add to AMV Converter... - C:\Programme\MP3 Player Utilities 4.07\AMVConverter\grab.html O8 - Extra context menu item: Crawler Search - tbr:iemenu O8 - Extra context menu item: Free YouTube Download - C:\Dokumente und Einstellungen\Alex\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubedownload.htm O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Dokumente und Einstellungen\Alex\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubetomp3.htm O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Programme\MP3 Player Utilities 4.07\MediaManager\grab.html O9 - Extra button: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Programme\ICQ7.1\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Programme\ICQ7.1\ICQ.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O15 - Trusted Zone: hxxp://asia.msi.com.tw O15 - Trusted Zone: hxxp://global.msi.com.tw O15 - Trusted Zone: hxxp://www.msi.com.tw O15 - Trusted Zone: hxxp://*.windowsupdate.microsoft.com O15 - Trusted Zone: hxxp://*.windowsupdate.com O16 - DPF: {3188FB46-456D-4C07-8A11-F5F3BBBA8AF2} (SeeTooControl Class) - hxxp://www.seetoo.com/downloadAddon.php?platform=Win32&browser=ie&ref=icq&c=cb0250c3f2a8f1b7c&browserVersion=7.0 O16 - DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} (System Requirements Lab Class) - hxxp://srtest-cdn.systemrequirementslab.com.s3.amazonaws.com/bin/sysreqlabdetect.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1253456671921 O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - hxxp://liveupdate.msi.com.tw/autobios/LOnline/install.cab O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\Programme\Crawler\ctbr.dll O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Programme\MAGIX\Common\Database\bin\fbserver.exe O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Programme\LogMeIn Hamachi\hamachi-2.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Programme\Java\jre6\bin\jqs.exe (file missing) O23 - Service: ServiceLayer - Nokia - C:\Programme\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Programme\Spyware Terminator\sp_rsser.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Programme\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe -- End of file - 9306 bytes Thx |
|
02.06.2010, 20:54
| #2 |
| |  Firewall lässt sich nicht aktivieren. Da stimmt was nicht Könnte das bitte jemand prüfen? Das ist mein Hauptrechner. Da ist das für mich besonders wichtig o.o
__________________ |
|
03.06.2010, 23:56
| #3 |
| | Firewall lässt sich nicht aktivieren. Da stimmt was nicht Kann doch nicht sein das keine diesen Log auswerten kann oO
__________________ |
|
19.06.2010, 20:34
| #4 |
| | Firewall lässt sich nicht aktivieren. Da stimmt was nicht Also ich will ja nicht spammen aber das ist wirklich extrem wichtig !! |
|
19.06.2010, 20:36
| #5 |
| /// Selecta Jahrusso   | Firewall lässt sich nicht aktivieren. Da stimmt was nicht Sorry, bist wohl überflogen worden. Wir versuchen das zu vermeiden, passiert aber. Eine Bereinigung ist mitunter mit viel Arbeit für Dich verbunden.
Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der Schnellere und immer der sicherste Weg. Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist. Vista und Win7 User Alle Tools mit Rechtsklick "als Administrator ausführen" starten. Schritt 1 CustomScan mit OTL Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter netsvcs
%SYSTEMDRIVE%\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\drivers\*.sys /90
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList|helpassistant /rs
Bitte poste in Deiner nächsten Antwort OTL.txt Extras.txt
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
19.06.2010, 21:07
| #6 |
| | Firewall lässt sich nicht aktivieren. Da stimmt was nicht So. Alles mal angehangen. Die otl.txt musste ich verzippen da sie zu groß war Und nicht wundern bei F: G: H: I: Das ist mein Cardreader |
|
20.06.2010, 12:36
| #7 |
| /// Selecta Jahrusso | Firewall lässt sich nicht aktivieren. Da stimmt was nicht Schritt 1 Software mit Revo Uninstaller deinstallieren Downloade Dir bitte den Revo Uninstaller
Bebilderte Anleitung Starte den Rechner neu auf. Schritt 2
Code:
ATTFilter :OTL
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60076
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60076
FF - HKLM\software\mozilla\Firefox\Extensions\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}: C:\Programme\Crawler\firefox\ [2010.05.29 11:44:26 | 000,000,000 | ---D | M]
[2009.12.03 01:08:25 | 000,000,000 | ---D | M] (ooVoo Toolbar) -- C:\Dokumente und Einstellungen\Alex\Anwendungsdaten\Mozilla\Firefox\Profiles\7ginmzg9.Standard-Benutzer\extensions\{99E00A4C-D35E-11DD-BA95-9B6A56D89593}
[2009.12.03 01:08:28 | 000,000,000 | ---D | M] (ooVoo Toolbar) -- C:\Dokumente und Einstellungen\Alex\Anwendungsdaten\Mozilla\Firefox\Profiles\o693xrlf.test\extensions\{99E00A4C-D35E-11DD-BA95-9B6A56D89593}
[2009.12.03 01:08:28 | 000,000,000 | ---D | M] (ooVoo Toolbar) -- C:\Dokumente und Einstellungen\Alex\Anwendungsdaten\Mozilla\Firefox\Profiles\vslopdez.lolol\extensions\{99E00A4C-D35E-11DD-BA95-9B6A56D89593}
O2 - BHO: () - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\Programme\Crawler\ctbr.dll (Crawler.com)
O2 - BHO: (ooVoo Toolbar) - {A1FB2F9A-D35E-11DD-8935-E46A56D89593} - C:\Programme\oovootb\oovoodx.dll ()
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll File not found
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll File not found
O3 - HKLM\..\Toolbar: (&Crawler Toolbar) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\Programme\Crawler\ctbr.dll (Crawler.com)
O3 - HKLM\..\Toolbar: (ooVoo Toolbar) - {A1FB2F9A-D35E-11DD-8935-E46A56D89593} - C:\Programme\oovootb\oovoodx.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (&Crawler Toolbar) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\Programme\Crawler\ctbr.dll (Crawler.com)
[2009.08.25 09:32:38 | 000,001,340 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\crawlersrch.bak
[2007.07.26 13:05:16 | 000,001,329 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\crawlersrch.xml
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
:services
:files
:reg
:Commands
[purity]
[emptytemp]
[reboot]
Schritt 3 Bitte
Schritt 4 Starte bitte OTL.exe und klicke auf den Quick Scan Button. Bitte poste in Deiner nächsten Antwort OTLfix Log Gmer.txt Otl.txt
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
20.06.2010, 13:32
| #8 |
| | Firewall lässt sich nicht aktivieren. Da stimmt was nicht Dazu muss ich sagen das Crawler und oovoo sicher sind. Das eine ist eine Toolbar von einen Spywarescanner und das andere eine Toolbar von einen Messenger. Beide sind deaktiviert. Muss ich jetzt trozdem so vorgehen wie oben beschrieben oder wird eine neue Anleitung erstellt? |
|
20.06.2010, 14:06
| #9 |
| /// Selecta Jahrusso | Firewall lässt sich nicht aktivieren. Da stimmt was nicht
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
20.06.2010, 15:26
| #10 |
| | Firewall lässt sich nicht aktivieren. Da stimmt was nicht Ok. Jetzt habe ich aber noch eine wichtige Frage bevor ich weitermache: Klick auf den Markiere alle Button und klick auf löschen und bestätige mit Ja. Wirklich ALLES mackieren o_O. Da sind ja lauter Registry Ordner ausgewählt und werden dann doch auch gelöscht oder nicht!? |
|
20.06.2010, 15:31
| #11 |
| /// Selecta Jahrusso | Firewall lässt sich nicht aktivieren. Da stimmt was nicht willste dir die malware behalten ?
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
20.06.2010, 19:31
| #12 |
| | Firewall lässt sich nicht aktivieren. Da stimmt was nicht Ne. War ja nur ne Nachfrage. So. Nach dem OTL Fix wurde keine .txt erstellt. Die GMER.txt wollte ich saven ging aber nicht. CPU Auslastung bei 100% und das Prog reagierte nichtmehr (Musste PC abstürzen lassen). Hier nun die restlichen Logs wo gingen: |
|
20.06.2010, 19:56
| #13 |
| /// Selecta Jahrusso | Firewall lässt sich nicht aktivieren. Da stimmt was nicht Während dieser Scans soll(en):
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
13.07.2010, 15:38
| #14 |
| | Firewall lässt sich nicht aktivieren. Da stimmt was nicht ROOTREPEAL (c) AD, 2007-2009 ================================================== Scan Start Time: 2010/07/13 16:03 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP3 ================================================== Drivers ------------------- Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xA8D1C000 Size: 98304 File Visible: No Signed: - Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xF79D5000 Size: 8192 File Visible: No Signed: - Status: - Name: giveio.sys Image Path: giveio.sys Address: 0xF7A50000 Size: 1664 File Visible: No Signed: - Status: - Name: PCI_PNP1466 Image Path: \Driver\PCI_PNP1466 Address: 0x00000000 Size: 0 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xA37B4000 Size: 49152 File Visible: No Signed: - Status: - Name: speedfan.sys Image Path: speedfan.sys Address: 0xF798D000 Size: 5248 File Visible: No Signed: - Status: - Name: spkl.sys Image Path: spkl.sys Address: 0xF7293000 Size: 995328 File Visible: No Signed: - Status: - Name: sptd Image Path: \Driver\sptd Address: 0x00000000 Size: 0 File Visible: No Signed: - Status: - Hidden/Locked Files ------------------- Path: c:\dokumente und einstellungen\alex\anwendungsdaten\skype\etilqs_uwfugjgjxnbqrsaajlbl Status: Allocation size mismatch (API: 4096, Raw: 0) Path: c:\dokumente und einstellungen\alex\anwendungsdaten\skype\etilqs_wncurrt91hc4n9kv8vlt Status: Allocation size mismatch (API: 65536, Raw: 0) Path: C:\Dokumente und Einstellungen\Alex\Lokale Einstellungen\Apps\2.0\7VLRYYT0.19J\E82POL89.EP8\manifests\WindowsApplication2.exe.cdf-ms Status: Locked to the Windows API! Path: C:\Dokumente und Einstellungen\Alex\Lokale Einstellungen\Apps\2.0\7VLRYYT0.19J\E82POL89.EP8\manifests\WindowsApplication2.exe.manifest Status: Locked to the Windows API! SSDT ------------------- #: 041 Function Name: NtCreateKey Status: Hooked by "<unknown>" at address 0xa8f18e0e #: 053 Function Name: NtCreateThread Status: Hooked by "<unknown>" at address 0xa8f18e04 #: 063 Function Name: NtDeleteKey Status: Hooked by "<unknown>" at address 0xa8f18e13 #: 065 Function Name: NtDeleteValueKey Status: Hooked by "<unknown>" at address 0xa8f18e1d #: 071 Function Name: NtEnumerateKey Status: Hooked by "spkl.sys" at address 0xf72acda4 #: 073 Function Name: NtEnumerateValueKey Status: Hooked by "spkl.sys" at address 0xf72ad132 #: 098 Function Name: NtLoadKey Status: Hooked by "<unknown>" at address 0xa8f18e22 #: 119 Function Name: NtOpenKey Status: Hooked by "spkl.sys" at address 0xf72940c0 #: 122 Function Name: NtOpenProcess Status: Hooked by "<unknown>" at address 0xa8f18df0 #: 128 Function Name: NtOpenThread Status: Hooked by "<unknown>" at address 0xa8f18df5 #: 160 Function Name: NtQueryKey Status: Hooked by "spkl.sys" at address 0xf72ad20a #: 177 Function Name: NtQueryValueKey Status: Hooked by "spkl.sys" at address 0xf72ad08a #: 193 Function Name: NtReplaceKey Status: Hooked by "<unknown>" at address 0xa8f18e2c #: 204 Function Name: NtRestoreKey Status: Hooked by "<unknown>" at address 0xa8f18e27 #: 247 Function Name: NtSetValueKey Status: Hooked by "<unknown>" at address 0xa8f18e18 Stealth Objects ------------------- Object: Hidden Code [Driver: Ntfs, IRP_MJ_CREATE] Process: System Address: 0x8a7331f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLOSE] Process: System Address: 0x8a7331f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_READ] Process: System Address: 0x8a7331f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_WRITE] Process: System Address: 0x8a7331f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_INFORMATION] Process: System Address: 0x8a7331f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_INFORMATION] Process: System Address: 0x8a7331f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_EA] Process: System Address: 0x8a7331f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_EA] Process: System Address: 0x8a7331f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x8a7331f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_VOLUME_INFORMATION] Process: System Address: 0x8a7331f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_VOLUME_INFORMATION] Process: System Address: 0x8a7331f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_DIRECTORY_CONTROL] Process: System Address: 0x8a7331f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_FILE_SYSTEM_CONTROL] Process: System Address: 0x8a7331f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x8a7331f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SHUTDOWN] Process: System Address: 0x8a7331f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_LOCK_CONTROL] Process: System Address: 0x8a7331f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLEANUP] Process: System Address: 0x8a7331f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_SECURITY] Process: System Address: 0x8a7331f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_SECURITY] Process: System Address: 0x8a7331f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_QUOTA] Process: System Address: 0x8a7331f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_QUOTA] Process: System Address: 0x8a7331f8 Size: 121 Object: Hidden Code [Driver: Ntfs, IRP_MJ_PNP] Process: System Address: 0x8a7331f8 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_CREATE] Process: System Address: 0x8a3271f8 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_CLOSE] Process: System Address: 0x8a3271f8 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_READ] Process: System Address: 0x8a3271f8 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_WRITE] Process: System Address: 0x8a3271f8 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_QUERY_INFORMATION] Process: System Address: 0x8a3271f8 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_SET_INFORMATION] Process: System Address: 0x8a3271f8 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_QUERY_EA] Process: System Address: 0x8a3271f8 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_SET_EA] Process: System Address: 0x8a3271f8 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x8a3271f8 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_QUERY_VOLUME_INFORMATION] Process: System Address: 0x8a3271f8 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_SET_VOLUME_INFORMATION] Process: System Address: 0x8a3271f8 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_DIRECTORY_CONTROL] Process: System Address: 0x8a3271f8 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_FILE_SYSTEM_CONTROL] Process: System Address: 0x8a3271f8 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x8a3271f8 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_SHUTDOWN] Process: System Address: 0x8a3271f8 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_LOCK_CONTROL] Process: System Address: 0x8a3271f8 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_CLEANUP] Process: System Address: 0x8a3271f8 Size: 121 Object: Hidden Code [Driver: Fastfat, IRP_MJ_PNP] Process: System Address: 0x8a3271f8 Size: 121 Object: Hidden Code [Driver: Udfsȅఈ扏济WmiProviderS, IRP_MJ_CREATE] Process: System Address: 0x89bbb500 Size: 121 Object: Hidden Code [Driver: Udfsȅఈ扏济WmiProviderS, IRP_MJ_CLOSE] Process: System Address: 0x89bbb500 Size: 121 Object: Hidden Code [Driver: Udfsȅఈ扏济WmiProviderS, IRP_MJ_READ] Process: System Address: 0x89bbb500 Size: 121 Object: Hidden Code [Driver: Udfsȅఈ扏济WmiProviderS, IRP_MJ_WRITE] Process: System Address: 0x89bbb500 Size: 121 Object: Hidden Code [Driver: Udfsȅఈ扏济WmiProviderS, IRP_MJ_QUERY_INFORMATION] Process: System Address: 0x89bbb500 Size: 121 Object: Hidden Code [Driver: Udfsȅఈ扏济WmiProviderS, IRP_MJ_SET_INFORMATION] Process: System Address: 0x89bbb500 Size: 121 Object: Hidden Code [Driver: Udfsȅఈ扏济WmiProviderS, IRP_MJ_QUERY_VOLUME_INFORMATION] Process: System Address: 0x89bbb500 Size: 121 Object: Hidden Code [Driver: Udfsȅఈ扏济WmiProviderS, IRP_MJ_DIRECTORY_CONTROL] Process: System Address: 0x89bbb500 Size: 121 Object: Hidden Code [Driver: Udfsȅఈ扏济WmiProviderS, IRP_MJ_FILE_SYSTEM_CONTROL] Process: System Address: 0x89bbb500 Size: 121 Object: Hidden Code [Driver: Udfsȅఈ扏济WmiProviderS, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x89bbb500 Size: 121 Object: Hidden Code [Driver: Udfsȅఈ扏济WmiProviderS, IRP_MJ_LOCK_CONTROL] Process: System Address: 0x89bbb500 Size: 121 Object: Hidden Code [Driver: Udfsȅఈ扏济WmiProviderS, IRP_MJ_CLEANUP] Process: System Address: 0x89bbb500 Size: 121 Object: Hidden Code [Driver: Udfsȅఈ扏济WmiProviderS, IRP_MJ_PNP] Process: System Address: 0x89bbb500 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_CREATE] Process: System Address: 0x8a5ca500 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_CLOSE] Process: System Address: 0x8a5ca500 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_READ] Process: System Address: 0x8a5ca500 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_WRITE] Process: System Address: 0x8a5ca500 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x8a5ca500 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x8a5ca500 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x8a5ca500 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_SHUTDOWN] Process: System Address: 0x8a5ca500 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_POWER] Process: System Address: 0x8a5ca500 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x8a5ca500 Size: 121 Object: Hidden Code [Driver: Cdrom, IRP_MJ_PNP] Process: System Address: 0x8a5ca500 Size: 121 Object: Hidden Code [Driver: usbstor, IRP_MJ_CREATE] Process: System Address: 0x89bc2500 Size: 121 Object: Hidden Code [Driver: usbstor, IRP_MJ_CLOSE] Process: System Address: 0x89bc2500 Size: 121 Object: Hidden Code [Driver: usbstor, IRP_MJ_READ] Process: System Address: 0x89bc2500 Size: 121 Object: Hidden Code [Driver: usbstor, IRP_MJ_WRITE] Process: System Address: 0x89bc2500 Size: 121 Object: Hidden Code [Driver: usbstor, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x89bc2500 Size: 121 Object: Hidden Code [Driver: usbstor, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x89bc2500 Size: 121 Object: Hidden Code [Driver: usbstor, IRP_MJ_POWER] Process: System Address: 0x89bc2500 Size: 121 Object: Hidden Code [Driver: usbstor, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x89bc2500 Size: 121 Object: Hidden Code [Driver: usbstor, IRP_MJ_PNP] Process: System Address: 0x89bc2500 Size: 121 Object: Hidden Code [Driver: usbuhci, IRP_MJ_CREATE] Process: System Address: 0x8a4b11f8 Size: 121 Object: Hidden Code [Driver: usbuhci, IRP_MJ_CLOSE] Process: System Address: 0x8a4b11f8 Size: 121 Object: Hidden Code [Driver: usbuhci, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x8a4b11f8 Size: 121 Object: Hidden Code [Driver: usbuhci, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x8a4b11f8 Size: 121 Object: Hidden Code [Driver: usbuhci, IRP_MJ_POWER] Process: System Address: 0x8a4b11f8 Size: 121 Object: Hidden Code [Driver: usbuhci, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x8a4b11f8 Size: 121 Object: Hidden Code [Driver: usbuhci, IRP_MJ_PNP] Process: System Address: 0x8a4b11f8 Size: 121 Object: Hidden Code [Driver: ahzydixtȅ瑎獆�最Ȃః瑎てﭐ勘, IRP_MJ_CREATE] Process: System Address: 0x8a4721f8 Size: 121 Object: Hidden Code [Driver: ahzydixtȅ瑎獆�最Ȃః瑎てﭐ勘, IRP_MJ_CLOSE] Process: System Address: 0x8a4721f8 Size: 121 Object: Hidden Code [Driver: ahzydixtȅ瑎獆�最Ȃః瑎てﭐ勘, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x8a4721f8 Size: 121 Object: Hidden Code [Driver: ahzydixtȅ瑎獆�最Ȃః瑎てﭐ勘, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x8a4721f8 Size: 121 Object: Hidden Code [Driver: ahzydixtȅ瑎獆�最Ȃః瑎てﭐ勘, IRP_MJ_POWER] Process: System Address: 0x8a4721f8 Size: 121 Object: Hidden Code [Driver: ahzydixtȅ瑎獆�最Ȃః瑎てﭐ勘, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x8a4721f8 Size: 121 Object: Hidden Code [Driver: ahzydixtȅ瑎獆�最Ȃః瑎てﭐ勘, IRP_MJ_PNP] Process: System Address: 0x8a4721f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_CREATE] Process: System Address: 0x8a6c61f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_READ] Process: System Address: 0x8a6c61f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_WRITE] Process: System Address: 0x8a6c61f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x8a6c61f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x8a6c61f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x8a6c61f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_SHUTDOWN] Process: System Address: 0x8a6c61f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_CLEANUP] Process: System Address: 0x8a6c61f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_POWER] Process: System Address: 0x8a6c61f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x8a6c61f8 Size: 121 Object: Hidden Code [Driver: Ftdisk, IRP_MJ_PNP] Process: System Address: 0x8a6c61f8 Size: 121 Object: Hidden Code [Driver: NetBT, IRP_MJ_CREATE] Process: System Address: 0x89be91f8 Size: 121 Object: Hidden Code [Driver: NetBT, IRP_MJ_CLOSE] Process: System Address: 0x89be91f8 Size: 121 Object: Hidden Code [Driver: NetBT, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x89be91f8 Size: 121 Object: Hidden Code [Driver: NetBT, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x89be91f8 Size: 121 Object: Hidden Code [Driver: NetBT, IRP_MJ_CLEANUP] Process: System Address: 0x89be91f8 Size: 121 Object: Hidden Code [Driver: NetBT, IRP_MJ_PNP] Process: System Address: 0x89be91f8 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_CREATE] Process: System Address: 0x8a4081f8 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_CLOSE] Process: System Address: 0x8a4081f8 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x8a4081f8 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x8a4081f8 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_POWER] Process: System Address: 0x8a4081f8 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x8a4081f8 Size: 121 Object: Hidden Code [Driver: usbehci, IRP_MJ_PNP] Process: System Address: 0x8a4081f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE] Process: System Address: 0x89bd31f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE_NAMED_PIPE] Process: System Address: 0x89bd31f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CLOSE] Process: System Address: 0x89bd31f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_READ] Process: System Address: 0x89bd31f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_WRITE] Process: System Address: 0x89bd31f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_INFORMATION] Process: System Address: 0x89bd31f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_INFORMATION] Process: System Address: 0x89bd31f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_EA] Process: System Address: 0x89bd31f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_EA] Process: System Address: 0x89bd31f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_FLUSH_BUFFERS] Process: System Address: 0x89bd31f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_VOLUME_INFORMATION] Process: System Address: 0x89bd31f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_VOLUME_INFORMATION] Process: System Address: 0x89bd31f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DIRECTORY_CONTROL] Process: System Address: 0x89bd31f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_FILE_SYSTEM_CONTROL] Process: System Address: 0x89bd31f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x89bd31f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_INTERNAL_DEVICE_CONTROL] Process: System Address: 0x89bd31f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SHUTDOWN] Process: System Address: 0x89bd31f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_LOCK_CONTROL] Process: System Address: 0x89bd31f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CLEANUP] Process: System Address: 0x89bd31f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE_MAILSLOT] Process: System Address: 0x89bd31f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_SECURITY] Process: System Address: 0x89bd31f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_SECURITY] Process: System Address: 0x89bd31f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_POWER] Process: System Address: 0x89bd31f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SYSTEM_CONTROL] Process: System Address: 0x89bd31f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DEVICE_CHANGE] Process: System Address: 0x89bd31f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_QUOTA] Process: System Address: 0x89bd31f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_QUOTA] Process: System Address: 0x89bd31f8 Size: 121 Object: Hidden Code [Driver: MRxSmb, IRP_MJ_PNP] Process: System Address: 0x89bd31f8 Size: 121 Object: Hidden Code [Driver: Cdfsఅ瑎獆獐�, IRP_MJ_CREATE] Process: System Address: 0x89b4f500 Size: 121 Object: Hidden Code [Driver: Cdfsఅ瑎獆獐�, IRP_MJ_CLOSE] Process: System Address: 0x89b4f500 Size: 121 Object: Hidden Code [Driver: Cdfsఅ瑎獆獐�, IRP_MJ_READ] Process: System Address: 0x89b4f500 Size: 121 Object: Hidden Code [Driver: Cdfsఅ瑎獆獐�, IRP_MJ_QUERY_INFORMATION] Process: System Address: 0x89b4f500 Size: 121 Object: Hidden Code [Driver: Cdfsఅ瑎獆獐�, IRP_MJ_SET_INFORMATION] Process: System Address: 0x89b4f500 Size: 121 Object: Hidden Code [Driver: Cdfsఅ瑎獆獐�, IRP_MJ_QUERY_VOLUME_INFORMATION] Process: System Address: 0x89b4f500 Size: 121 Object: Hidden Code [Driver: Cdfsఅ瑎獆獐�, IRP_MJ_DIRECTORY_CONTROL] Process: System Address: 0x89b4f500 Size: 121 Object: Hidden Code [Driver: Cdfsఅ瑎獆獐�, IRP_MJ_FILE_SYSTEM_CONTROL] Process: System Address: 0x89b4f500 Size: 121 Object: Hidden Code [Driver: Cdfsఅ瑎獆獐�, IRP_MJ_DEVICE_CONTROL] Process: System Address: 0x89b4f500 Size: 121 Object: Hidden Code [Driver: Cdfsఅ瑎獆獐�, IRP_MJ_SHUTDOWN] Process: System Address: 0x89b4f500 Size: 121 Object: Hidden Code [Driver: Cdfsఅ瑎獆獐�, IRP_MJ_LOCK_CONTROL] Process: System Address: 0x89b4f500 Size: 121 Object: Hidden Code [Driver: Cdfsఅ瑎獆獐�, IRP_MJ_CLEANUP] Process: System Address: 0x89b4f500 Size: 121 Object: Hidden Code [Driver: Cdfsఅ瑎獆獐�, IRP_MJ_PNP] Process: System Address: 0x89b4f500 Size: 121 ==EOF== |
|
13.07.2010, 16:07
| #15 |
| /// Selecta Jahrusso | Firewall lässt sich nicht aktivieren. Da stimmt was nicht Der Thread ist über 2 Wochen alt  Vorbereitung Lösche die vorhandene Version von Combofix und lade das Programm von einem der folgenden Download-Spiegel neu herunter: BleepingComputer.com - ForoSpyware.comund speichere es auf dem Desktop (nicht woanders hin, das ist wichtig)! Wenn Du ComboFix bereits vorher auf dem Rechner hattest, lösche die alte Version, da ComboFix laufend aktualisiert wird.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen! Falls im Skript die Anweisung Suspect:: oder Collect:: enthalten ist, wird eine Message-Box erscheinen, nachdem Combofix fertig ist. Klicke OK und folge den Aufforderungen/Anweisungen, um die Dateien hochzuladen.
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
| Themen zu Firewall lässt sich nicht aktivieren. Da stimmt was nicht |
| adobe, antivir, antivir guard, avg, avira, bho, browser, browseui preloader, desktop, dll, explorer, firefox, firewall, google, hkus\s-1-5-18, internet, internet explorer, malware, mozilla, mp3, nicht angezeigt, plug-in, realtek, rundll, sicherheit, software, spyware, spyware terminator, system, windows xp |
Textbox.
.
Linear-Darstellung
