| |
| |||||||
Log-Analyse und Auswertung: svchost.exe hat 100% Auslastung - vermute TrojanerWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
21.07.2011, 14:22
| #16 |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  svchost.exe hat 100% Auslastung - vermute Trojaner Combofix - Scripten 1. Starte das Notepad (Start / Ausführen / notepad[Enter]) 2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein. Code:
ATTFilter File::
c:\docume~1\u\LOCALS~1\Temp\RarSFX0\DrvSnSht.sys
c:\docume~1\u\LOCALS~1\Temp\DYCD.exe
c:\windows\system32\DRIVERS\DRHARD.SYS
c:\docume~1\u\LOCALS~1\Temp\KZ.exe
c:\docume~1\u\LOCALS~1\Temp\OFI.exe
c:\windows\system32\drivers\slxv.sys
Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"=-
Driver::
DRHARD
DrvSnSht
DYCD
KZ
R-ImageDisk
4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall. (Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !) 5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.  6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien: Combofix.txt Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
21.07.2011, 15:56
| #17 |
 | svchost.exe hat 100% Auslastung - vermute Trojaner Nach Neustart 3 Events:
__________________2. (Message) Launching Application 2. (Message) Name: AVM Fritz!Box USB-Fernanschluss From clickonce.avm.de Publisher: AVM ... GmbH [Instal] [Don't Install] 4. (PopUp-Balloon) Catchme.tmp - Corrupt File The file or directory C: is corrupt and unreadable. Please run the Chkdsk utility. 5. (PopUp-Balloon) CF20553.cfxxe - Corrupt File The file or directory C: is corrupt and unreadable. Please run the Chkdsk utility. Hier das Log: Combofix Logfile: Code:
ATTFilter ComboFix 11-07-21.02 - u 21.07.2011 15:59:57.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.49.1033.18.511.125 [GMT 2:00]
ausgeführt von:: c:\documents and settings\u\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\documents and settings\u\Desktop\CFScript.txt
.
FILE ::
"c:\docume~1\u\LOCALS~1\Temp\DYCD.exe"
"c:\docume~1\u\LOCALS~1\Temp\KZ.exe"
"c:\docume~1\u\LOCALS~1\Temp\OFI.exe"
"c:\docume~1\u\LOCALS~1\Temp\RarSFX0\DrvSnSht.sys"
"c:\windows\system32\DRIVERS\DRHARD.SYS"
"c:\windows\system32\drivers\slxv.sys"
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\spooldr.exe
c:\windows\system32\spooldr.sys
.
.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_DYCD
-------\Legacy_KZ
-------\Legacy_R-IMAGEDISK
-------\Service_DRHARD
-------\Service_DrvSnSht
-------\Service_DYCD
-------\Service_KZ
-------\Service_R-ImageDisk
.
.
((((((((((((((((((((((( Dateien erstellt von 2011-06-21 bis 2011-07-21 ))))))))))))))))))))))))))))))
.
.
2011-07-21 11:21 . 2011-07-21 11:21 -------- d-----w- C:\TDSSKiller_Quarantine
2011-07-17 09:39 . 2011-07-17 09:39 -------- d-----w- c:\windows\$$ 14.07.2011 10,3 MB (10.898.456 bytes)
2011-07-14 11:26 . 2011-07-14 11:26 54016 ----a-w- c:\windows\system32\drivers\slxv.sys
2011-07-12 06:46 . 2011-07-12 06:52 -------- d-----w- c:\documents and settings\u\Application Data\Smarty Uninstaller
2011-07-12 06:32 . 2011-07-12 06:32 -------- d-----w- c:\documents and settings\All Users\Application Data\IsolatedStorage
2011-07-12 06:30 . 2011-04-25 08:25 4603616 ----a-w- c:\windows\system32\DevComponents.DotNetBar2.dll
2011-06-28 09:04 . 2011-06-28 09:04 -------- d-----w- c:\documents and settings\u\Application Data\Malwarebytes
2011-06-28 09:04 . 2011-07-06 17:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-06-28 09:03 . 2011-06-28 09:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-06-28 09:03 . 2011-07-06 17:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-06-26 13:21 . 2011-06-26 13:21 11 ----a-w- C:\mbrfix.bat
2011-06-26 13:20 . 2011-06-26 13:04 89088 ----a-w- C:\mbr.exe
2011-06-26 13:12 . 2011-06-26 13:04 89088 ----a-w- c:\windows\system32\mbr.exe
2011-06-26 09:57 . 2011-06-26 09:57 -------- d-----w- c:\program files\Common Files\BitDefender
2011-06-26 09:54 . 2011-06-26 10:18 47358 ----a-w- c:\documents and settings\All Users\Application Data\bdinstall.bin
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-18 19:48 . 2011-05-21 18:48 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-02 14:02 . 2009-10-10 18:10 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-05-24 07:10 . 2011-05-24 07:10 119808 ----a-r- c:\documents and settings\u\Application Data\Microsoft\Installer\{CCF298AF-9CE1-4B26-B251-486E98A34789}\icons.exe
2011-05-02 15:31 . 2009-09-23 07:51 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 17:25 . 2009-10-10 18:10 151552 ----a-w- c:\windows\system32\schannel.dll
2011-04-29 16:19 . 2009-10-10 18:10 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-26 11:07 . 2009-10-10 18:10 33280 ----a-w- c:\windows\system32\csrsrv.dll
2011-04-26 11:07 . 2004-08-03 22:56 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-04-25 16:11 . 2004-08-03 22:56 916480 ----a-w- c:\windows\system32\wininet.dll
2011-04-25 16:11 . 2004-08-03 22:56 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2011-04-25 16:11 . 2004-08-03 22:56 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-04-25 12:01 . 2004-08-03 20:59 385024 ----a-w- c:\windows\system32\html.iec
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OODIIcon]
@="{14A94384-BBED-47ed-86C0-6BF63FD892D0}"
[HKEY_CLASSES_ROOT\CLSID\{14A94384-BBED-47ed-86C0-6BF63FD892D0}]
2010-09-01 00:21 111944 ----a-w- f:\programme 03\Dateienverwaltung\IMAGE-Tools\O&O DiskImage 5 Pro PRG\oodishi.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Vidalia"="REM" [X]
"LDM"="REM" [X]
"LogitechSoftwareUpdate"="REM" [X]
"SandboxieControl"="REM" [X]
"AVMUSBRemoteConnection"="REM" [X]
"PeerBlock"="REM" [X]
"SUPERAntiSpyware"="REM" [X]
"AVMUSBFernanschluss"="c:\documents and settings\u\Local Settings\Apps\2.0\3OEW5K9B.2D6\LW0Y1VBV.G0V\frit..tion_8488884cfbcefd60_0002.0002_8541bf1f4a1c673d\AVMAutoStart.exe" [2011-01-09 147456]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RemoteControl"="REM" [X]
"VC9Player"="REM" [X]
"AudioHQ"="REM" [X]
"Dell AIO Printer A920"="REM" [X]
"MacDrive 8 application"="REM" [X]
"Getting started with MacDrive 8"="REM" [X]
"AppleSyncNotifier"="REM" [X]
"OODefragTray"="REM" [X]
"QuickTime Task"="REM" [X]
"LogitechVideoRepair"="REM" [X]
"LogitechVideoTray"="REM" [X]
"LogitechGalleryRepair"="REM" [X]
"LogitechImageStudioTray"="REM" [X]
"AVMUSBRemoteConnection"="REM" [X]
"LVCOMSX"="REM" [X]
"RAMpage"="REM" [X]
"ABBYY Community Agent"="REM" [X]
"SunJavaUpdateSched"="REM" [X]
"TomTomHOME.exe"="REM" [X]
"OODITRAY.EXE"="REM" [X]
"Malwarebytes' Anti-Malware"="REM" [X]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
c:\documents and settings\u\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\Registry\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{EC654325-1273-C2A9-2B7C-45A29BCE2FBD}"= "c:\windows\system32\regsvr32.exe" [2008-04-14 11776]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\Security\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 13:21 548352 ----a-w- c:\program files\Security\SUPERAntiSpyware\SASWINLO.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0oodbs\0pgdfgsvc C 1
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Apple Mobile Device"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\InterNet\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\DSL\\FRITZ!DSL\\IGDCTRL.EXE"=
"c:\\Program Files\\DSL\\FRITZ!DSL\\FBOXUPD.EXE"=
"c:\\Program Files\\DSL\\FRITZ!DSL\\WebwaIgd.exe"=
"c:\\Documents and Settings\\u\\Local Settings\\Apps\\2.0\\XW5471ZK.4N3\\KZVHJ9MH.BZ7\\frit..tion_8488884cfbcefd60_0002.0001_f24dc39254641428\\fritzbox-usb-fernanschluss.exe"=
"c:\\Program Files\\Media\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Brwoser\\Opera\\opera.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\helpctr.exe"=
"c:\\Documents and Settings\\u\\Local Settings\\Apps\\2.0\\XW5471ZK.4N3\\KZVHJ9MH.BZ7\\frit..tion_8488884cfbcefd60_0002.0002_9409db79b3f040fd\\fritzbox-usb-fernanschluss.exe"=
"c:\\Documents and Settings\\u\\Local Settings\\Apps\\2.0\\3OEW5K9B.2D6\\LW0Y1VBV.G0V\\frit..tion_8488884cfbcefd60_0002.0002_8541bf1f4a1c673d\\fritzbox-usb-fernanschluss.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
R0 MDFSYSNT;MacDrive file system driver;c:\windows\system32\drivers\MDFSYSNT.SYS [07.10.2010 16:36 234160]
R0 MDPMGRNT;MacDrive partition driver;c:\windows\system32\drivers\MDPMGRNT.SYS [12.05.2010 15:51 29792]
R0 oodisr;O&O DiskImage Snapshot/Restore Driver;c:\windows\system32\drivers\oodisr.sys [01.09.2010 02:24 96336]
R0 oodisrh;oodisrh;c:\windows\system32\drivers\oodisrh.sys [01.09.2010 02:24 28752]
R0 oodivd;O&O DiskImage Virtual Devices Driver;c:\windows\system32\drivers\oodivd.sys [01.09.2010 02:24 171088]
R0 oodivdh;oodivdh;c:\windows\system32\drivers\oodivdh.sys [01.09.2010 02:24 31824]
R1 CBDisk;CBDisk;c:\windows\system32\drivers\CBDisk.sys [19.02.2010 10:17 57800]
R1 SASDIFSV;SASDIFSV;c:\program files\Security\SUPERAntiSpyware\sasdifsv.sys [04.09.2009 14:50 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\Security\SUPERAntiSpyware\SASKUTIL.SYS [04.09.2009 14:49 74480]
R2 ABBYY.Licensing.FineReader.Corporate.10.0;ABBYY FineReader 10 CE Licensing Service;c:\program files\Common Files\ABBYY\FineReader\10.00\Licensing\CE\NetworkLicenseServer.exe [19.12.2009 02:06 814344]
R2 IGDCTRL;AVM IGD CTRL Service;c:\program files\DSL\FRITZ!DSL\IGDCTRL.EXE [28.07.2009 17:07 73528]
R2 MacDrive8Service;MacDrive 8 service;c:\program files\Mediafour\MacDrive 8\MacDrive8Service.exe [08.10.2010 13:11 131584]
R2 MBAMService;MBAMService;f:\programme 03\Security\Malwarebytes' Anti-Malware PRG\mbamservice.exe [28.06.2011 11:04 366640]
R2 OO DiskImage;OO DiskImage;f:\programme 03\Dateienverwaltung\IMAGE-Tools\O&O DiskImage 5 Pro PRG\oodiag.exe [01.09.2010 02:21 2811208]
R2 TomTomHOMEService;TomTomHOMEService;f:\programme 03\NaViGat\TomTom HOME 2 PRG\TomTomHOMEService.exe [22.04.2011 14:21 92592]
R2 VC9SecS;Virtual CD v9 Management Service;c:\program files\CDVD\Virtual CD v9\System\VC9SecS.exe [27.09.2009 11:08 132424]
R3 avmaudio;AVM Audio;c:\windows\system32\drivers\avmaudio.sys [15.11.2010 21:51 101248]
R3 avmaura;AVM USB-Fernanschluss;c:\windows\system32\drivers\avmaura.sys [14.12.2009 14:18 101248]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [28.06.2011 11:03 22712]
R3 SiSV;SiSV;c:\windows\system32\drivers\SiSV.sys [23.09.2009 11:46 50432]
S1 vdrv9000;vdrv9000;c:\windows\system32\drivers\vdrv9000.sys [27.09.2009 11:08 113688]
S3 EST_BusEnum;Network USB Device Bus;c:\windows\system32\DRIVERS\GenBus.sys --> c:\windows\system32\DRIVERS\GenBus.sys [?]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;f:\programme 03\System\Diagnose\everest ultimate 5.50 PRG\kerneld.wnt [08.08.2010 10:17 27760]
S3 HH9Help.sys;HH9Help.sys;c:\windows\system32\drivers\HH9Help.sys [27.09.2009 11:08 11392]
S3 NUS_Bus;Network USB Server Bus;c:\windows\system32\DRIVERS\NUS_Bus.sys --> c:\windows\system32\DRIVERS\NUS_Bus.sys [?]
S3 OFI;OFI;c:\docume~1\u\LOCALS~1\Temp\OFI.exe --> c:\docume~1\u\LOCALS~1\Temp\OFI.exe [?]
S3 SASENUM;SASENUM;c:\program files\Security\SUPERAntiSpyware\SASENUM.SYS [04.09.2009 14:50 7408]
S4 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [23.09.2009 10:06 155136]
S4 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [23.09.2009 10:06 5248]
S4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys --> c:\windows\system32\Drivers\sptd.sys [?]
.
Inhalt des "geplante Tasks" Ordners
.
2011-07-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uInternet Settings,ProxyOverride = localhost
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: Interfaces\{185678A2-0AEE-47CC-A45E-4DA946872CD5}: NameServer = 192.168.178.2,192.168.1.1
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\u\Application Data\Mozilla\Firefox\Profiles\628zcihv.default\
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2011-07-21 16:32
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet025\Services\EverestDriver]
"ImagePath"="\??\f:\programme 03\System\Diagnose\everest ultimate 5.50 PRG\kerneld.wnt"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•A~*]
"7040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•A~*]
"7040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG12.00.00.01PROFESSIONAL"="4FD49D6FF81D135EB21215C5ED4A6DEEAED657A5DE588A25C9A1AB6D011A763BB1CB5BCD2BDD65C39E66121CD8CC7FC37DAB15AF826801DE75FBC65C488D208E36EB79EDEA87CDEF18E3194091BD429B90CD1A5CE265D711EDD33FAE70C83AB2672EB0C8EB9FDDCD82845F35AF72D2B74157B6D49C135B761F0424D739A45EF9E7CE6CBBB3AE9C6A5304CB61A2C4C4817726F02AA23E4C6F89AA39313CFC985F6D4D4C889FC0837915647D8EA8912001B4DC024EB834DB00C12E7275E3306AFD3FECA2D3DF677F4E656A436BD73CDEE78C61589A7AC736D06F32FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933C038D530D6EB3452A2D97226D213B555A6A0AC4980AC7933C1CD94748BF0193B4BAE312D50697ACF33283995907088E4CC0C5C22C30C58338E8A46323715A8440CD0B1C3EC17A134B84050B9C44FE67AF92F0833FCB977500FBAF4F1F8265E96412BC950E467B3596E62704A9A8AEDDF5864898F64A5FDC6C965ADAB062A452F906C8CBF1A5BD201B70851C4BFBBF335A60FDCE315A198B67EF34F5E034D7C51D2A85E7E6094AFAB2A8C7B28D41DE25D58F353639B2304069AB6918A0D5D3881955778017F5D16A212B0CD776E903681943B0FBEF9C5935EC4DE7A37B1CEBF0C9B53EA3EB321E06E6C1AFCBA959BFE0DB8F308B22646ACAB5582686CF3366DFCD9DD96AE2C6FFE616CCE8D7EC866E431D28F8AF80C07499FD69C0C394BCFB0A7F89730530D7C760CF8BCDC50773F1F60A762B5D2878E792F0C0A692F237B0EA2D70A42ACEF9FDE46ABB497C60715FCD42D267E856C84DD14681059E259B99B47071F2BC25FD4652C53E94077D1FE5D098FF8ABD97EB82ECA1554896FC1B384344C271B9FDCBBC99C7375AFFDA233B53EAD5BD81CF91C3315ECDEF97024B2084AA1D41AD2D91ADEB941548F7ABB9191781DB2F69B8CC5CBF6822000893A277AB134C0006E40558EEBA7E4DD91D2190CFE234A4930566EE9BA1A6AC45F332342D3E4E57B09ECF9565D46ED6E6910ED585F3D4C67306FF494EDAB74C21CB35CDB5DCA230E3C2DB9C27DED96E7AE8F5B3A68184C3CF7E1D9E5E063D64E6D4F30D4C22D3C0EA847677B7FA56B458FE4CC0BAE1A4088692AC40BA822110984951C50B88CD7A47073F8B7DA28DCD3C192D3388A5A7F60E73B7EC81EFC866D978143873A97824F3A5B8DC24BE43FB8FB92A4C398A2492B5EFB7472DFBBFBC7DE88EB4484B52B60AEA163FD4EFCCAE879D19842B8F33DA4B6443A744DDA9D381A1102679A7FA4FD00585EDD28489CAF79B12CDC0E82625C63E3844C8C0B783409769362C1C22721DD89076ADFCF352B410701D101B32236D81CAD0C87B1FE06F206553C0581CD987FAF08BE4053F750979ADA"
"OOPM02.00.00.01PRO"="C01EF784985197BF2FE9927834CF903AB56B5DF2C55683AE73F4DFED3054DB8DE504291E35E4A3C7279B4A7BDDA4619A72A9295AA42653F67B7A941BF96C71F21AFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933C038D530D6EB3452A2D97226D213B555A6A0AC4980AC7933F72C947D7F9C8CAA05111E1F37AC9E7926B96B959B01106D929C4A65530A6C6253C71011DFB493B7B97F42141EEC3675E82951395377D148E886E539C9124748CCC4382A06697890EB5B7AC07CDCFE2B28AED5616892ED47C118F37EA15EA341C02B17CA93752BF9E8D5C93CB6F03285C24B93561FA3089AAF3FC7D19E3FAFE212F4DC85EEC6868E831BD9AC715773C19B754D7701B42A45455FDD66CAB97D162511DB00427FC33D92C3F3CF1BEA45739C95E634D901C11E1DCC5103F3040518E4E389F77B7283C5F1608AF45FC01081AE876992B8F6A1D3D1D2E6022A8E1FF83FC2033BCD2BC73EFD762F01349D2127441D02ABF23A7C63062F815043760B9D247906AD2E66F8121BFD9BEACFFD2871CE9C7F2D20226EA15E932E725791E93F0B46F546D717E17C2FE02B402C0F3944C63D5A571CBBF236812619FBC467C3EA6B5E5910476132922581DDA28A334D5828AD2A0088C46C9C1D811499AB37817F45665B2A409EFD376B325642EB804135728DAA12C731202663B29408F16EF2B4987B4A49475C3BA4F4BC5E6B1A4354BA29723D080329B674063C369A41B3C911EB2B9A33A85DC6E9B85BE0F81DF8AC9CD264E674A508BE80C014B536855F9CF1487861447096DFE8B03FED5AC6D35060FDE2D0FC605DA8964EA47556F0FBE5083C5AD96A72B0A855DB0BBA15A83B2DE2B65CC85AA6ECCA54EE4BFB0977CB82D8D83D642BC48A2ABA3C599CC01A4994509437BDDA322DDD30E8DAF0F0534337BBB3FE021BBFB4CD7659B3900AB6CB382C2C4C465EFCCA7F700418A3C3800B2ADEE672DA6704F465393D9BB6315EC6334E19681AD94924B0B00DBE864CC1FD64428F5FB84D7145220B7783D38932EF0161FCCC17D89A4E5761D3FB2F671BAED4BBCF808C23AFD21D441A55CDFB9B3180E2FAAEBD76380FBDC62FF05609D5614DF24C8467CDA87ED092BBEC3286C3AA7826B9B6B1E5AF640FF776355CB6008D8664308F7F4A095F1DF7F518B0361B2D10D2E581BD6A4F7ADDDF05D2400B69601862A8B632A6C5BCC44B699D1DB15440D3E22EA1CE5E2D37A03F3D452A33A83A81906608FC059297EFB438B4ED31669D34A4479A742E9FB2AEA90302E2739530A5E720FE039FEA9DA9B20987417F8D3506BC6865645DC4B5C787C06DD7A0CD894A350F110B3F0CB6E09684B8567DC728809FCC6FF67EFB428A94DFE09C2532C39A98F0240045F87BE9075C5A9020D84E41"
"OODEFRAG11.00.00.01WORKSTATION"="050A172766C93CD51A1B73499839E8B3602B36EAC1B3373819F49FE0A14422125FBC3151CC07498D44EE3A025530D08300197F69016C441D2E27EC1C0D0A95E09D82D7050978A796AC6E4DEAB793E773BD3CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B98089DB7CE019D40AA5CC038D530D6EB3452A6171C11EC38DE3DC493B4CA75EC26D2DB7F60928F63B77546440EF30497343BA9C8091C35C5CAE83E4F531B1A7225E91C838EB85F195000224AF00E8CAFC34D6BF2CB6F43726BA1482B222C0509C326D9C7D29A10F68CCC305FC573CC5688987D30BD7EBFEEC32E5B5AA68F2093FBBB176601556653872C18A1D3EFFE78DB2BD6C2376201DD11F9D5E3E84DF8878A933ACA73FC471A9FA3EC82E4C383185D484FC092A7FCF3532478A4F4DC436EF0CA8D3609983F49F56E9F4748A3DE4772E5A117314F537ACF81684CDCAED268F3B1BFBDA2A2FBF6F078080A51B6B930BEAEEF02764FC3CF8C19305EB3A2A2A69DCCE2C9A40ACF47BB6362B95519DD0DB001BE95C80FB163D6253D329310CFEEBA54EE967AB2B3F74306CD952FDB3D3074EF753895EDA8BB40175F7518419D1CDBB4BBB591F241D639E8CCB53E826A7B00C1E0A54A3AD4729A914EA56272EF1DD68E888C5A16B7C795C84883E4041DE90971B1EBDC3B06347EEBA09717575273C3B6F9D2CA5A79C291180ABB89CDB20689AC7BECC329324149B2D5F2DE15F23681B514945E740ED0AAFCC270173F2A7044D5B7E07A31F17199244EB26647228E2F47C0B4100A9F13A4CF0508FC2C27DDB704C1D180F302AB55B350A8DDF9D63BB35CD0E56437FDBD041F48BC2CDCF0962F82DA9E5A86436EA38A05F67A302A8D389AF4B2DE099B94932B691B9B8D75F5B24EA6798F713B4A708278957460DA6E28D9C2F60906107662EAA505C66E446D149B2F6B2B331264EC2C9ED00972CB55B6A53763712194514187A1B12DA31080644EDECC3D3C94F68BCACA47F7C68052573F2FFD2A4889A7C65DE4294F44B0C77B8308CC5A7035CF06D437EE072F2407449BEC1D4859F1914DFED9C935DCA26FF40A5C6F18AA06CE58F7818D7EF084A97963177065A6F23AF1B25145686D8537AF61F68A13B64369C1912ABFAAC51384B9F0B9769E795A6119EF7D22F86A9EF44EC253C8EA55C6A846B61875DCDB677688D7BF05960B94D8E666F539793B530F3997D0A8443D142B2F2E13F1685639F0B05BFDC3F18AB40AC5F6B6B87FBB3203997F35FDC516CE210973C8CD27C9E77A3FF32A31DB9AF26EE4359EA2A6BCE8E0E04BA86F1BFCBFCF22B64C7375C074AC83CDDF1D01D3A916366D714C8C024D4D40033777F382D31110DA9023B33A853894499B2C1340D723EE9BD660D343D4FE30E05165042D1B52"
"OODI05.00.00.01PRO"="AEFB99EB8688374AACF4BEF56AF43B13303EA62A4B8EA20CE8245C2A00955C4C5BC200A44D4D5E2F4A5174CBF64F3319EAF8DFE3A1E2E3CBF2B6F15C8170A745EE5485F5DA81ED35E772890652472DFBDD97BD3890C00C4114DD43EE2E67D393A2A4F2FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B98088EDD5E5BE2F6E6679DB7CE019D40AA5CC038D530D6EB3452828A876751751F709A631F29052EC0C8FBA5B3A5893D9F010A4B77D5411CD69EA6595125FE8EFBCB93CC8BEBA335D4B6D6610E30527E993BB818B23EB254D0E44E241C88C630B1B4148EAC5DC6699EBF164000EF9A64291F2CCF78245589A6A9C520E2BBCE09DAFDC1D1A0C541FC2CE45A0565E4FC48E9799FE78AE32B55A52500996819A11A1470E8D7491BC4F40A1B670263C7F3D37C0A6D696C9319289E86936D32B32F3780C5F673CD8D67ACCAC8A621E102E105830819EFE57969C665EFB88D87CDC689C32D000B97FE27CF854A225D0AB28AAEA69AC52F031148475376CE8176E1210D8949BA9AD481E161D5708AC74CAC95F892DE3CEB958A4716442456E2D01B5814FEB20231F8625BB6D87E34035C75105DF4676A7D30495DF49978F6602BD969C1D4F354F2389C3B7932AC95C930C8E9AA833761D3AA6461F4B864793B5E343910C10A54160EE38CA887A7CBE60213F78575C9D4EE222893FD88CDCA4A88F08BCBFD6AC965371BBE94058E96BA53F9F1E105899E637613934EF68EFEF78A8D0D1449FA1FC1B7DE25E35775D93A66D0F48C72D93BDBCCD866F273754BC288BAC95F6396631D54F9771033649CECC1A48122828DCC158A62F6D1F345093DEBDBB6F6138D490097EFD1E5CE580CEFB1B27C987CEE95DF5EC91221EFB1360CE28BA8F521A1A705CFF4B189E3C07772C36D2CB42B3B80A1B7DEE86D6566F46BDD14DACDDC8A7ADA0F72FB6EB102D3394C7CBE12DE239A55CAA49095D3010BA812776AC295F15F462C87F7DFF9F2B69CE239C49EEA4B13858F54034F401362A5F8695B6FA2F8191DBF84CFFA05E0DD89E1B2319DA74D4055C2D79DA034240AD84F53923EDD32904BA96E15B11C8AA87F68AB5EA470361B79E350A1E53BAC31CD96CF5B71A3A2CECE8A80B9490FA59B12591A87212406C0BA368FB3CE661C30A114B2E39D564702BDC927945DAFD8DCEADC284C4FA7B3EFF7C49DDEDFC952808650FCBFAA5C8F7FBC9104E2D8D440BAC5DC36B2C2612610A058B510EEFE27BE4318E9E2D61E5CBC89CEEBC27F58EC23F20AD322633EBB293B03C817AAA1E4AE327D6429B1888655F0B3E9B7E69A622B57D54BE7EAAC45686098792B1053C734C1560DD1A00F580656B73AA9F77D1889697893336721089D3E329E657439835B72B9B97D5CA791343394CF63"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(816)
c:\program files\Security\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
c:\documents and settings\u\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
c:\documents and settings\u\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
.
- - - - - - - > 'explorer.exe'(3884)
c:\windows\system32\WININET.dll
f:\programme 03\Dateienverwaltung\IMAGE-Tools\O&O DiskImage 5 Pro PRG\oodishi.dll
f:\programme 03\Dateienverwaltung\IMAGE-Tools\O&O DiskImage 5 Pro PRG\oodishrs.dll
c:\program files\Media\iTunes\iTunesMiniPlayer.dll
c:\program files\Media\iTunes\iTunesMiniPlayer.Resources\de.lproj\iTunesMiniPlayerLocalized.dll
c:\program files\Media\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\IEFRAME.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\msi.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\oodag.exe
c:\program files\VirtualEnvironment\Sandboxie\SbieSvc.exe
c:\windows\system32\devldr32.exe
c:\windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-07-21 16:42:31 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2011-07-21 14:42
.
Vor Suchlauf: 4.282.470.400 bytes free
Nach Suchlauf: 4.260.270.080 bytes free
.
- - End Of File - - 660B1B214462F1E0883E856E29DA3B8D
|
|
21.07.2011, 15:57
| #18 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | svchost.exe hat 100% Auslastung - vermute Trojaner Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
__________________GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen. Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst. Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM! Downloade dir bitte  aswMBR.exe und speichere die Datei auf deinem Desktop.
Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).
__________________ |
|
22.07.2011, 05:04
| #19 |
| | svchost.exe hat 100% Auslastung - vermute Trojaner GMER Logfile: Code:
ATTFilter GMER 1.0.15.15641 - GMER - Rootkit Detector and Remover
Rootkit scan 2011-07-22 04:22:47
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 ST3160215A rev.3.AAD
Running: 93xidx05.exe; Driver: C:\DOCUME~1\u\LOCALS~1\Temp\pxlcrfod.sys
---- System - GMER 1.0.15 ----
Code F8DC5C9C ZwRequestPort
Code F8DC5D3C ZwRequestWaitReplyPort
Code F8DC5BFC ZwTraceEvent
Code F8DC5C9B NtRequestPort
Code F8DC5D3B NtRequestWaitReplyPort
Code F8DC5BFB NtTraceEvent
---- Kernel code sections - GMER 1.0.15 ----
.text ntoskrnl.exe!NtTraceEvent 80545BC0 5 Bytes JMP F8DC5C00
PAGE ntoskrnl.exe!NtRequestWaitReplyPort 8056DC86 5 Bytes JMP F8DC5D40
PAGE ntoskrnl.exe!NtRequestPort 8058E3D2 5 Bytes JMP F8DC5CA0
? Combo-Fix.sys The system cannot find the file specified. !
.text win32k.sys!EngAcquireSemaphore + 20F0 BF808339 5 Bytes JMP F8DC5480
.text win32k.sys!EngFreeUserMem + 5BD7 BF80EEC5 5 Bytes JMP F8DC53E0
.text win32k.sys!EngSetLastError + 79AA BF82430B 5 Bytes JMP F8DC55C0
.text win32k.sys!FONTOBJ_pxoGetXform + 84ED BF8519C5 5 Bytes JMP F8DC5A20
.text win32k.sys!XLATEOBJ_iXlate + 2EDD BF85DEB0 5 Bytes JMP F8DC5520
.text win32k.sys!EngCreatePalette + 8A BF85F854 3 Bytes JMP F8DC58E0
.text win32k.sys!EngCreatePalette + 8E BF85F858 1 Byte [39]
.text win32k.sys!EngCopyBits + 1409 BF89A1F5 5 Bytes JMP F8DC5700
.text win32k.sys!EngCopyBits + 4DEE BF89DBDA 5 Bytes JMP F8DC5660
.text win32k.sys!EngEraseSurface + A9E0 BF8C2150 5 Bytes JMP F8DC57A0
.text win32k.sys!EngDeleteSemaphore + 3B40 BF8EC2A9 5 Bytes JMP F8DC5980
.text win32k.sys!EngCreateClip + 19DF BF9133E5 5 Bytes JMP F8DC5AC0
.text win32k.sys!EngCreateClip + 1F6F BF913975 5 Bytes JMP F8DC5B60
.text win32k.sys!EngCreateClip + 25B5 BF913FBB 5 Bytes JMP F8DC5840
? C:\ComboFix\catchme.sys The system cannot find the path specified. !
? C:\WINDOWS\system32\Drivers\PROCEXP113.SYS The system cannot find the file specified. !
---- User code sections - GMER 1.0.15 ----
.text F:\Programme 03\Dateienverwaltung\IMAGE-Tools\O&O DiskImage 5 Pro PRG\oodiag.exe[1764] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 5 Bytes JMP 0059DA6B F:\Programme 03\Dateienverwaltung\IMAGE-Tools\O&O DiskImage 5 Pro PRG\oodiag.exe
---- Kernel IAT/EAT - GMER 1.0.15 ----
IAT \WINDOWS\system32\hal.dll[ntoskrnl.exe!IoReadPartitionTable] [F8726E1C] MDPMGRNT.sys (MacDrive partition driver/Mediafour Corporation)
IAT \WINDOWS\system32\hal.dll[ntoskrnl.exe!IoWritePartitionTable] [F87267AE] MDPMGRNT.sys (MacDrive partition driver/Mediafour Corporation)
IAT ftdisk.sys[ntoskrnl.exe!IoReadPartitionTableEx] [F8726E3C] MDPMGRNT.sys (MacDrive partition driver/Mediafour Corporation)
IAT dmio.sys[ntoskrnl.exe!IoWritePartitionTableEx] [F87267D2] MDPMGRNT.sys (MacDrive partition driver/Mediafour Corporation)
IAT dmio.sys[ntoskrnl.exe!IoReadPartitionTableEx] [F8726E3C] MDPMGRNT.sys (MacDrive partition driver/Mediafour Corporation)
IAT PartMgr.sys[ntoskrnl.exe!IoReadPartitionTableEx] [F8726E3C] MDPMGRNT.sys (MacDrive partition driver/Mediafour Corporation)
IAT disk.sys[ntoskrnl.exe!IoReadPartitionTable] [F8726E1C] MDPMGRNT.sys (MacDrive partition driver/Mediafour Corporation)
IAT disk.sys[ntoskrnl.exe!IoReadPartitionTableEx] [F8726E3C] MDPMGRNT.sys (MacDrive partition driver/Mediafour Corporation)
IAT disk.sys[ntoskrnl.exe!IoWritePartitionTableEx] [F87267D2] MDPMGRNT.sys (MacDrive partition driver/Mediafour Corporation)
---- Devices - GMER 1.0.15 ----
Device \FileSystem\Ntfs \Ntfs MDFSYSNT.sys (MacDrive file system driver/Mediafour Corporation)
AttachedDevice \FileSystem\Ntfs \Ntfs oodisrh.sys (O&O DiskImage Snapshot/Restore Helper Driver (Win32)/O&O Software GmbH)
Device \FileSystem\MRxDAV \Device\WebDavRedirector MDFSYSNT.sys (MacDrive file system driver/Mediafour Corporation)
Device \Driver\rdpdr \Device\RdpDrPort MDFSYSNT.sys (MacDrive file system driver/Mediafour Corporation)
Device \Driver\rdpdr \Device\RdpDr MDFSYSNT.sys (MacDrive file system driver/Mediafour Corporation)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 snapman.sys (Acronis Snapshot API/Acronis)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 snapman.sys (Acronis Snapshot API/Acronis)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume3 snapman.sys (Acronis Snapshot API/Acronis)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume3 ntoskrnl.exe (NT Kernel & System/Microsoft Corporation)
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver MDFSYSNT.sys (MacDrive file system driver/Mediafour Corporation)
Device \FileSystem\MRxSmb \Device\LanmanRedirector MDFSYSNT.sys (MacDrive file system driver/Mediafour Corporation)
Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer MDFSYSNT.sys (MacDrive file system driver/Mediafour Corporation)
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer MDFSYSNT.sys (MacDrive file system driver/Mediafour Corporation)
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer MDFSYSNT.sys (MacDrive file system driver/Mediafour Corporation)
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer MDFSYSNT.sys (MacDrive file system driver/Mediafour Corporation)
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer MDFSYSNT.sys (MacDrive file system driver/Mediafour Corporation)
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xD1 0x4F 0x45 0xD3 ...
Reg HKLM\SYSTEM\ControlSet001\Services\vdrv9000@ServiceBinary C:\WINDOWS\system32\drivers\VDRV9000.SYS
Reg HKLM\SYSTEM\ControlSet001\Services\vdrv9000@Group SCSI Miniport
Reg HKLM\SYSTEM\ControlSet001\Services\vdrv9000@ImagePath system32\DRIVERS\vdrv9000.sys
Reg HKLM\SYSTEM\ControlSet001\Services\vdrv9000@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet001\Services\vdrv9000@Start 1
Reg HKLM\SYSTEM\ControlSet001\Services\vdrv9000@Type 1
Reg HKLM\SYSTEM\ControlSet001\Services\vdrv9000@Tag 34
Reg HKLM\SYSTEM\ControlSet001\Services\vdrv9000\Enum (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\vdrv9000\Enum@Count 1
Reg HKLM\SYSTEM\ControlSet001\Services\vdrv9000\Enum@NextInstance 1
Reg HKLM\SYSTEM\ControlSet001\Services\vdrv9000\Enum@INITSTARTFAILED 1
Reg HKLM\SYSTEM\ControlSet001\Services\vdrv9000\Enum@0 Root\SCSIADAPTER\0000
Reg HKLM\SYSTEM\ControlSet001\Services\vdrv9000\parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\vdrv9000\parameters\pnpinterface (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\vdrv9000\parameters\pnpinterface@1 1
Reg HKLM\SYSTEM\ControlSet001\Services\vdrv9000\security (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\vdrv9000\security@Security 0x01 0x00 0x14 0x80 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xD1 0x4F 0x45 0xD3 ...
Reg HKLM\SYSTEM\ControlSet002\Services\vdrv9000@ServiceBinary C:\WINDOWS\system32\drivers\VDRV9000.SYS
Reg HKLM\SYSTEM\ControlSet002\Services\vdrv9000@Group SCSI Miniport
Reg HKLM\SYSTEM\ControlSet002\Services\vdrv9000@ImagePath system32\DRIVERS\vdrv9000.sys
Reg HKLM\SYSTEM\ControlSet002\Services\vdrv9000@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\Services\vdrv9000@Start 1
Reg HKLM\SYSTEM\ControlSet002\Services\vdrv9000@Type 1
Reg HKLM\SYSTEM\ControlSet002\Services\vdrv9000@Tag 34
Reg HKLM\SYSTEM\ControlSet002\Services\vdrv9000\Enum (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\vdrv9000\Enum@Count 1
Reg HKLM\SYSTEM\ControlSet002\Services\vdrv9000\Enum@NextInstance 1
Reg HKLM\SYSTEM\ControlSet002\Services\vdrv9000\Enum@INITSTARTFAILED 1
Reg HKLM\SYSTEM\ControlSet002\Services\vdrv9000\Enum@0 Root\SCSIADAPTER\0000
Reg HKLM\SYSTEM\ControlSet002\Services\vdrv9000\parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\vdrv9000\parameters\pnpinterface (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\vdrv9000\parameters\pnpinterface@1 1
Reg HKLM\SYSTEM\ControlSet002\Services\vdrv9000\security (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\vdrv9000\security@Security 0x01 0x00 0x14 0x80 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xD1 0x4F 0x45 0xD3 ...
Reg HKLM\SYSTEM\ControlSet003\Services\vdrv9000@ServiceBinary C:\WINDOWS\system32\drivers\VDRV9000.SYS
Reg HKLM\SYSTEM\ControlSet003\Services\vdrv9000@Group SCSI Miniport
Reg HKLM\SYSTEM\ControlSet003\Services\vdrv9000@ImagePath system32\DRIVERS\vdrv9000.sys
Reg HKLM\SYSTEM\ControlSet003\Services\vdrv9000@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet003\Services\vdrv9000@Start 1
Reg HKLM\SYSTEM\ControlSet003\Services\vdrv9000@Type 1
Reg HKLM\SYSTEM\ControlSet003\Services\vdrv9000@Tag 34
Reg HKLM\SYSTEM\ControlSet003\Services\vdrv9000\Enum (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\vdrv9000\Enum@Count 1
Reg HKLM\SYSTEM\ControlSet003\Services\vdrv9000\Enum@NextInstance 1
Reg HKLM\SYSTEM\ControlSet003\Services\vdrv9000\Enum@INITSTARTFAILED 1
Reg HKLM\SYSTEM\ControlSet003\Services\vdrv9000\Enum@0 Root\SCSIADAPTER\0000
Reg HKLM\SYSTEM\ControlSet003\Services\vdrv9000\parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\vdrv9000\parameters\pnpinterface (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\vdrv9000\parameters\pnpinterface@1 1
Reg HKLM\SYSTEM\ControlSet003\Services\vdrv9000\security (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\vdrv9000\security@Security 0x01 0x00 0x14 0x80 ...
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xD1 0x4F 0x45 0xD3 ...
Reg HKLM\SYSTEM\ControlSet004\Services\vdrv9000@ServiceBinary C:\WINDOWS\system32\drivers\VDRV9000.SYS
Reg HKLM\SYSTEM\ControlSet004\Services\vdrv9000@Group SCSI Miniport
Reg HKLM\SYSTEM\ControlSet004\Services\vdrv9000@ImagePath system32\DRIVERS\vdrv9000.sys
Reg HKLM\SYSTEM\ControlSet004\Services\vdrv9000@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet004\Services\vdrv9000@Start 1
Reg HKLM\SYSTEM\ControlSet004\Services\vdrv9000@Type 1
Reg HKLM\SYSTEM\ControlSet004\Services\vdrv9000@Tag 34
Reg HKLM\SYSTEM\ControlSet004\Services\vdrv9000\Enum (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\vdrv9000\Enum@Count 1
Reg HKLM\SYSTEM\ControlSet004\Services\vdrv9000\Enum@NextInstance 1
Reg HKLM\SYSTEM\ControlSet004\Services\vdrv9000\Enum@INITSTARTFAILED 1
Reg HKLM\SYSTEM\ControlSet004\Services\vdrv9000\Enum@0 Root\SCSIADAPTER\0000
Reg HKLM\SYSTEM\ControlSet004\Services\vdrv9000\parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\vdrv9000\parameters\pnpinterface (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\vdrv9000\parameters\pnpinterface@1 1
Reg HKLM\SYSTEM\ControlSet004\Services\vdrv9000\security (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\vdrv9000\security@Security 0x01 0x00 0x14 0x80 ...
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xD1 0x4F 0x45 0xD3 ...
Reg HKLM\SYSTEM\ControlSet005\Services\vdrv9000@ServiceBinary C:\WINDOWS\system32\drivers\VDRV9000.SYS
Reg HKLM\SYSTEM\ControlSet005\Services\vdrv9000@Group SCSI Miniport
Reg HKLM\SYSTEM\ControlSet005\Services\vdrv9000@ImagePath system32\DRIVERS\vdrv9000.sys
Reg HKLM\SYSTEM\ControlSet005\Services\vdrv9000@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet005\Services\vdrv9000@Start 1
Reg HKLM\SYSTEM\ControlSet005\Services\vdrv9000@Type 1
Reg HKLM\SYSTEM\ControlSet005\Services\vdrv9000@Tag 34
Reg HKLM\SYSTEM\ControlSet005\Services\vdrv9000\Enum (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet005\Services\vdrv9000\Enum@Count 1
Reg HKLM\SYSTEM\ControlSet005\Services\vdrv9000\Enum@NextInstance 1
Reg HKLM\SYSTEM\ControlSet005\Services\vdrv9000\Enum@INITSTARTFAILED 1
Reg HKLM\SYSTEM\ControlSet005\Services\vdrv9000\Enum@0 Root\SCSIADAPTER\0000
Reg HKLM\SYSTEM\ControlSet005\Services\vdrv9000\parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet005\Services\vdrv9000\parameters\pnpinterface (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet005\Services\vdrv9000\parameters\pnpinterface@1 1
Reg HKLM\SYSTEM\ControlSet005\Services\vdrv9000\security (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet005\Services\vdrv9000\security@Security 0x01 0x00 0x14 0x80 ...
Reg HKLM\SYSTEM\ControlSet006\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet006\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet006\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xD1 0x4F 0x45 0xD3 ...
Reg HKLM\SYSTEM\ControlSet006\Services\vdrv9000@ServiceBinary C:\WINDOWS\system32\drivers\VDRV9000.SYS
Reg HKLM\SYSTEM\ControlSet006\Services\vdrv9000@Group SCSI Miniport
Reg HKLM\SYSTEM\ControlSet006\Services\vdrv9000@ImagePath system32\DRIVERS\vdrv9000.sys
Reg HKLM\SYSTEM\ControlSet006\Services\vdrv9000@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet006\Services\vdrv9000@Start 1
Reg HKLM\SYSTEM\ControlSet006\Services\vdrv9000@Type 1
Reg HKLM\SYSTEM\ControlSet006\Services\vdrv9000@Tag 34
Reg HKLM\SYSTEM\ControlSet006\Services\vdrv9000\Enum (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet006\Services\vdrv9000\Enum@Count 1
Reg HKLM\SYSTEM\ControlSet006\Services\vdrv9000\Enum@NextInstance 1
Reg HKLM\SYSTEM\ControlSet006\Services\vdrv9000\Enum@INITSTARTFAILED 1
Reg HKLM\SYSTEM\ControlSet006\Services\vdrv9000\Enum@0 Root\SCSIADAPTER\0000
Reg HKLM\SYSTEM\ControlSet006\Services\vdrv9000\parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet006\Services\vdrv9000\parameters\pnpinterface (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet006\Services\vdrv9000\parameters\pnpinterface@1 1
Reg HKLM\SYSTEM\ControlSet006\Services\vdrv9000\security (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet006\Services\vdrv9000\security@Security 0x01 0x00 0x14 0x80 ...
Reg HKLM\SYSTEM\ControlSet007\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet007\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet007\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xD1 0x4F 0x45 0xD3 ...
Reg HKLM\SYSTEM\ControlSet007\Services\vdrv9000@ServiceBinary C:\WINDOWS\system32\drivers\VDRV9000.SYS
Reg HKLM\SYSTEM\ControlSet007\Services\vdrv9000@Group SCSI Miniport
Reg HKLM\SYSTEM\ControlSet007\Services\vdrv9000@ImagePath system32\DRIVERS\vdrv9000.sys
Reg HKLM\SYSTEM\ControlSet007\Services\vdrv9000@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet007\Services\vdrv9000@Start 1
Reg HKLM\SYSTEM\ControlSet007\Services\vdrv9000@Type 1
Reg HKLM\SYSTEM\ControlSet007\Services\vdrv9000@Tag 34
Reg HKLM\SYSTEM\ControlSet007\Services\vdrv9000\Enum (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet007\Services\vdrv9000\Enum@Count 1
Reg HKLM\SYSTEM\ControlSet007\Services\vdrv9000\Enum@NextInstance 1
Reg HKLM\SYSTEM\ControlSet007\Services\vdrv9000\Enum@INITSTARTFAILED 1
Reg HKLM\SYSTEM\ControlSet007\Services\vdrv9000\Enum@0 Root\SCSIADAPTER\0000
Reg HKLM\SYSTEM\ControlSet007\Services\vdrv9000\parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet007\Services\vdrv9000\parameters\pnpinterface (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet007\Services\vdrv9000\parameters\pnpinterface@1 1
Reg HKLM\SYSTEM\ControlSet007\Services\vdrv9000\security (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet007\Services\vdrv9000\security@Security 0x01 0x00 0x14 0x80 ...
Reg HKLM\SYSTEM\ControlSet008\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet008\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet008\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xD1 0x4F 0x45 0xD3 ...
Reg HKLM\SYSTEM\ControlSet008\Services\vdrv9000@ServiceBinary C:\WINDOWS\system32\drivers\VDRV9000.SYS
Reg HKLM\SYSTEM\ControlSet008\Services\vdrv9000@Group SCSI Miniport
Reg HKLM\SYSTEM\ControlSet008\Services\vdrv9000@ImagePath system32\DRIVERS\vdrv9000.sys
Reg HKLM\SYSTEM\ControlSet008\Services\vdrv9000@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet008\Services\vdrv9000@Start 1
Reg HKLM\SYSTEM\ControlSet008\Services\vdrv9000@Type 1
Reg HKLM\SYSTEM\ControlSet008\Services\vdrv9000@Tag 34
Reg HKLM\SYSTEM\ControlSet008\Services\vdrv9000\Enum (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet008\Services\vdrv9000\Enum@Count 1
Reg HKLM\SYSTEM\ControlSet008\Services\vdrv9000\Enum@NextInstance 1
Reg HKLM\SYSTEM\ControlSet008\Services\vdrv9000\Enum@INITSTARTFAILED 1
Reg HKLM\SYSTEM\ControlSet008\Services\vdrv9000\Enum@0 Root\SCSIADAPTER\0000
Reg HKLM\SYSTEM\ControlSet008\Services\vdrv9000\parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet008\Services\vdrv9000\parameters\pnpinterface (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet008\Services\vdrv9000\parameters\pnpinterface@1 1
Reg HKLM\SYSTEM\ControlSet008\Services\vdrv9000\security (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet008\Services\vdrv9000\security@Security 0x01 0x00 0x14 0x80 ...
Reg HKLM\SYSTEM\ControlSet009\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet009\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet009\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xD1 0x4F 0x45 0xD3 ...
Reg HKLM\SYSTEM\ControlSet009\Services\vdrv9000@ServiceBinary C:\WINDOWS\system32\drivers\VDRV9000.SYS
Reg HKLM\SYSTEM\ControlSet009\Services\vdrv9000@Group SCSI Miniport
Reg HKLM\SYSTEM\ControlSet009\Services\vdrv9000@ImagePath system32\DRIVERS\vdrv9000.sys
Reg HKLM\SYSTEM\ControlSet009\Services\vdrv9000@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet009\Services\vdrv9000@Start 1
Reg HKLM\SYSTEM\ControlSet009\Services\vdrv9000@Type 1
Reg HKLM\SYSTEM\ControlSet009\Services\vdrv9000@Tag 34
Reg HKLM\SYSTEM\ControlSet009\Services\vdrv9000\Enum (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet009\Services\vdrv9000\Enum@Count 1
Reg HKLM\SYSTEM\ControlSet009\Services\vdrv9000\Enum@NextInstance 1
Reg HKLM\SYSTEM\ControlSet009\Services\vdrv9000\Enum@INITSTARTFAILED 1
Reg HKLM\SYSTEM\ControlSet009\Services\vdrv9000\Enum@0 Root\SCSIADAPTER\0000
Reg HKLM\SYSTEM\ControlSet009\Services\vdrv9000\parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet009\Services\vdrv9000\parameters\pnpinterface (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet009\Services\vdrv9000\parameters\pnpinterface@1 1
Reg HKLM\SYSTEM\ControlSet009\Services\vdrv9000\security (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet009\Services\vdrv9000\security@Security 0x01 0x00 0x14 0x80 ...
Reg HKLM\SYSTEM\ControlSet010\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet010\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet010\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xD1 0x4F 0x45 0xD3 ...
Reg HKLM\SYSTEM\ControlSet010\Services\vdrv9000@ServiceBinary C:\WINDOWS\system32\drivers\VDRV9000.SYS
Reg HKLM\SYSTEM\ControlSet010\Services\vdrv9000@Group SCSI Miniport
Reg HKLM\SYSTEM\ControlSet010\Services\vdrv9000@ImagePath system32\DRIVERS\vdrv9000.sys
Reg HKLM\SYSTEM\ControlSet010\Services\vdrv9000@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet010\Services\vdrv9000@Start 1
Reg HKLM\SYSTEM\ControlSet010\Services\vdrv9000@Type 1
Reg HKLM\SYSTEM\ControlSet010\Services\vdrv9000@Tag 34
Reg HKLM\SYSTEM\ControlSet010\Services\vdrv9000\Enum (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet010\Services\vdrv9000\Enum@Count 1
Reg HKLM\SYSTEM\ControlSet010\Services\vdrv9000\Enum@NextInstance 1
Reg HKLM\SYSTEM\ControlSet010\Services\vdrv9000\Enum@INITSTARTFAILED 1
Reg HKLM\SYSTEM\ControlSet010\Services\vdrv9000\Enum@0 Root\SCSIADAPTER\0000
Reg HKLM\SYSTEM\ControlSet010\Services\vdrv9000\parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet010\Services\vdrv9000\parameters\pnpinterface (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet010\Services\vdrv9000\parameters\pnpinterface@1 1
Reg HKLM\SYSTEM\ControlSet010\Services\vdrv9000\security (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet010\Services\vdrv9000\security@Security 0x01 0x00 0x14 0x80 ...
Reg HKLM\SYSTEM\ControlSet016\Services\vdrv9000@ServiceBinary C:\WINDOWS\system32\drivers\VDRV9000.SYS
Reg HKLM\SYSTEM\ControlSet016\Services\vdrv9000@Group SCSI Miniport
Reg HKLM\SYSTEM\ControlSet016\Services\vdrv9000@ImagePath system32\DRIVERS\vdrv9000.sys
Reg HKLM\SYSTEM\ControlSet016\Services\vdrv9000@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet016\Services\vdrv9000@Start 1
Reg HKLM\SYSTEM\ControlSet016\Services\vdrv9000@Type 1
Reg HKLM\SYSTEM\ControlSet016\Services\vdrv9000@Tag 34
Reg HKLM\SYSTEM\ControlSet016\Services\vdrv9000\Enum (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet016\Services\vdrv9000\Enum@Count 1
Reg HKLM\SYSTEM\ControlSet016\Services\vdrv9000\Enum@NextInstance 1
Reg HKLM\SYSTEM\ControlSet016\Services\vdrv9000\Enum@INITSTARTFAILED 1
Reg HKLM\SYSTEM\ControlSet016\Services\vdrv9000\Enum@0 Root\SCSIADAPTER\0000
Reg HKLM\SYSTEM\ControlSet016\Services\vdrv9000\parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet016\Services\vdrv9000\parameters\pnpinterface (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet016\Services\vdrv9000\parameters\pnpinterface@1 1
Reg HKLM\SYSTEM\ControlSet016\Services\vdrv9000\security (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet016\Services\vdrv9000\security@Security 0x01 0x00 0x14 0x80 ...
Reg HKLM\SYSTEM\ControlSet021\Services\vdrv9000@ServiceBinary C:\WINDOWS\system32\drivers\VDRV9000.SYS
Reg HKLM\SYSTEM\ControlSet021\Services\vdrv9000@Group SCSI Miniport
Reg HKLM\SYSTEM\ControlSet021\Services\vdrv9000@ImagePath system32\DRIVERS\vdrv9000.sys
Reg HKLM\SYSTEM\ControlSet021\Services\vdrv9000@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet021\Services\vdrv9000@Start 1
Reg HKLM\SYSTEM\ControlSet021\Services\vdrv9000@Type 1
Reg HKLM\SYSTEM\ControlSet021\Services\vdrv9000@Tag 34
Reg HKLM\SYSTEM\ControlSet021\Services\vdrv9000\Enum (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet021\Services\vdrv9000\Enum@Count 1
Reg HKLM\SYSTEM\ControlSet021\Services\vdrv9000\Enum@NextInstance 1
Reg HKLM\SYSTEM\ControlSet021\Services\vdrv9000\Enum@INITSTARTFAILED 1
Reg HKLM\SYSTEM\ControlSet021\Services\vdrv9000\Enum@0 Root\SCSIADAPTER\0000
Reg HKLM\SYSTEM\ControlSet021\Services\vdrv9000\parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet021\Services\vdrv9000\parameters\pnpinterface (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet021\Services\vdrv9000\parameters\pnpinterface@1 1
Reg HKLM\SYSTEM\ControlSet021\Services\vdrv9000\security (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet021\Services\vdrv9000\security@Security 0x01 0x00 0x14 0x80 ...
Reg HKLM\SYSTEM\ControlSet022\Services\vdrv9000@ServiceBinary C:\WINDOWS\system32\drivers\VDRV9000.SYS
Reg HKLM\SYSTEM\ControlSet022\Services\vdrv9000@Group SCSI Miniport
Reg HKLM\SYSTEM\ControlSet022\Services\vdrv9000@ImagePath system32\DRIVERS\vdrv9000.sys
Reg HKLM\SYSTEM\ControlSet022\Services\vdrv9000@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet022\Services\vdrv9000@Start 1
Reg HKLM\SYSTEM\ControlSet022\Services\vdrv9000@Type 1
Reg HKLM\SYSTEM\ControlSet022\Services\vdrv9000@Tag 34
Reg HKLM\SYSTEM\ControlSet022\Services\vdrv9000\Enum (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet022\Services\vdrv9000\Enum@Count 1
Reg HKLM\SYSTEM\ControlSet022\Services\vdrv9000\Enum@NextInstance 1
Reg HKLM\SYSTEM\ControlSet022\Services\vdrv9000\Enum@INITSTARTFAILED 1
Reg HKLM\SYSTEM\ControlSet022\Services\vdrv9000\Enum@0 Root\SCSIADAPTER\0000
Reg HKLM\SYSTEM\ControlSet022\Services\vdrv9000\parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet022\Services\vdrv9000\parameters\pnpinterface (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet022\Services\vdrv9000\parameters\pnpinterface@1 1
Reg HKLM\SYSTEM\ControlSet022\Services\vdrv9000\security (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet022\Services\vdrv9000\security@Security 0x01 0x00 0x14 0x80 ...
Reg HKLM\SYSTEM\ControlSet023\Services\vdrv9000@ServiceBinary C:\WINDOWS\system32\drivers\VDRV9000.SYS
Reg HKLM\SYSTEM\ControlSet023\Services\vdrv9000@Group SCSI Miniport
Reg HKLM\SYSTEM\ControlSet023\Services\vdrv9000@ImagePath system32\DRIVERS\vdrv9000.sys
Reg HKLM\SYSTEM\ControlSet023\Services\vdrv9000@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet023\Services\vdrv9000@Start 1
Reg HKLM\SYSTEM\ControlSet023\Services\vdrv9000@Type 1
Reg HKLM\SYSTEM\ControlSet023\Services\vdrv9000@Tag 34
Reg HKLM\SYSTEM\ControlSet023\Services\vdrv9000\Enum (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet023\Services\vdrv9000\Enum@Count 1
Reg HKLM\SYSTEM\ControlSet023\Services\vdrv9000\Enum@NextInstance 1
Reg HKLM\SYSTEM\ControlSet023\Services\vdrv9000\Enum@INITSTARTFAILED 1
Reg HKLM\SYSTEM\ControlSet023\Services\vdrv9000\Enum@0 Root\SCSIADAPTER\0000
Reg HKLM\SYSTEM\ControlSet023\Services\vdrv9000\parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet023\Services\vdrv9000\parameters\pnpinterface (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet023\Services\vdrv9000\parameters\pnpinterface@1 1
Reg HKLM\SYSTEM\ControlSet023\Services\vdrv9000\security (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet023\Services\vdrv9000\security@Security 0x01 0x00 0x14 0x80 ...
Reg HKLM\SYSTEM\ControlSet024\Services\vdrv9000@ServiceBinary C:\WINDOWS\system32\drivers\VDRV9000.SYS
Reg HKLM\SYSTEM\ControlSet024\Services\vdrv9000@Group SCSI Miniport
Reg HKLM\SYSTEM\ControlSet024\Services\vdrv9000@ImagePath system32\DRIVERS\vdrv9000.sys
Reg HKLM\SYSTEM\ControlSet024\Services\vdrv9000@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet024\Services\vdrv9000@Start 1
Reg HKLM\SYSTEM\ControlSet024\Services\vdrv9000@Type 1
Reg HKLM\SYSTEM\ControlSet024\Services\vdrv9000@Tag 34
Reg HKLM\SYSTEM\ControlSet024\Services\vdrv9000\Enum (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet024\Services\vdrv9000\Enum@Count 1
Reg HKLM\SYSTEM\ControlSet024\Services\vdrv9000\Enum@NextInstance 1
Reg HKLM\SYSTEM\ControlSet024\Services\vdrv9000\Enum@INITSTARTFAILED 1
Reg HKLM\SYSTEM\ControlSet024\Services\vdrv9000\Enum@0 Root\SCSIADAPTER\0000
Reg HKLM\SYSTEM\ControlSet024\Services\vdrv9000\parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet024\Services\vdrv9000\parameters\pnpinterface (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet024\Services\vdrv9000\parameters\pnpinterface@1 1
Reg HKLM\SYSTEM\ControlSet024\Services\vdrv9000\security (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet024\Services\vdrv9000\security@Security 0x01 0x00 0x14 0x80 ...
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODEFRAG12.00.00.01PROFESSIONAL 4FD49D6FF81D135EB21215C5ED4A6DEEAED657A5DE588A25C9A1AB6D011A763BB1CB5BCD2BDD65C39E66121CD8CC7FC37DAB15AF826801DE75FBC65C488D208E36EB79EDEA87CDEF18E3194091BD429B90CD1A5CE265D711EDD33FAE70C83AB2672EB0C8EB9FDDCD82845F35AF72D2B74157B6D49C135B761F0424D739A45EF9E7CE6CBBB3AE9C6A5304CB61A2C4C4817726F02AA23E4C6F89AA39313CFC985F6D4D4C889FC0837915647D8EA8912001B4DC024EB834DB00C12E7275E3306AFD3FECA2D3DF677F4E656A436BD73CDEE78C61589A7AC736D06F32FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933C038D530D6EB3452A2D97226D213B555A6A0AC4980AC7933C1CD94748BF0193B4BAE312D50697ACF33283995907088E4CC0C5C22C30C58338E8A46323715A8440CD0B1C3EC17A134B84050B9C44FE67AF92F0833FCB977500FBAF4F1F8265E96412BC950E467B3596E62704A9A8AEDDF5864898F64A5FDC6C965ADAB062A452F906C8CBF1A5BD201B70851C4BFBBF335A60FDCE315A198B67EF34F5E034D7C51D2A85E7E6094AFAB2A8C7B28D41DE25D58F353639B2304069AB6918A0D5D3881955778017F5D16A212B0CD776E903681943B0FBEF9C5935EC4DE7A37B1CEBF0C9B53EA3EB321E06E6C1AFCBA959
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OOPM02.00.00.01PRO C01EF784985197BF2FE9927834CF903AB56B5DF2C55683AE73F4DFED3054DB8DE504291E35E4A3C7279B4A7BDDA4619A72A9295AA42653F67B7A941BF96C71F21AFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933C038D530D6EB3452A2D97226D213B555A6A0AC4980AC7933F72C947D7F9C8CAA05111E1F37AC9E7926B96B959B01106D929C4A65530A6C6253C71011DFB493B7B97F42141EEC3675E82951395377D148E886E539C9124748CCC4382A06697890EB5B7AC07CDCFE2B28AED5616892ED47C118F37EA15EA341C02B17CA93752BF9E8D5C93CB6F03285C24B93561FA3089AAF3FC7D19E3FAFE212F4DC85EEC6868E831BD9AC715773C19B754D7701B42A45455FDD66CAB97D162511DB00427FC33D92C3F3CF1BEA45739C95E634D901C11E1DCC5103F3040518E4E389F77B7283C5F1608AF45FC01081AE876992B8F6A1D3D1D2E6022A8E1FF83FC2033BCD2BC73EFD762F01349D2127441D02ABF23A7C63062F815043760B9D247906AD2E66F8121BFD9BEACFFD2871CE9C7F2D20226EA15E932E725791E93F0B46F546D717E17C2FE02B402C0F3944C63D5A571CBBF236812619FBC467C3EA6B5E5910476132922581DDA28A334D5828AD2A0088C46C9C1D811499AB37817F45665B2A409EFD376B325642EB804
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODEFRAG11.00.00.01WORKSTATION 050A172766C93CD51A1B73499839E8B3602B36EAC1B3373819F49FE0A14422125FBC3151CC07498D44EE3A025530D08300197F69016C441D2E27EC1C0D0A95E09D82D7050978A796AC6E4DEAB793E773BD3CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B98089DB7CE019D40AA5CC038D530D6EB3452A6171C11EC38DE3DC493B4CA75EC26D2DB7F60928F63B77546440EF30497343BA9C8091C35C5CAE83E4F531B1A7225E91C838EB85F195000224AF00E8CAFC34D6BF2CB6F43726BA1482B222C0509C326D9C7D29A10F68CCC305FC573CC5688987D30BD7EBFEEC32E5B5AA68F2093FBBB176601556653872C18A1D3EFFE78DB2BD6C2376201DD11F9D5E3E84DF8878A933ACA73FC471A9FA3EC82E4C383185D484FC092A7FCF3532478A4F4DC436EF0CA8D3609983F49F56E9F4748A3DE4772E5A117314F537ACF81684CDCAED268F3B1BFBDA2A2FBF6F078080A51B6B930BEAEEF02764FC3CF8C19305EB3A2A2A69DCCE2C9A40ACF47BB6362B95519DD0DB001BE95C80FB163D6253D329310CFEEBA54EE967AB2B3F74306CD952FDB3D3074EF753895EDA8BB40175F7518419D1CDBB4BBB591F241D639E8CCB53E826A7B00C1E0A54A3AD4729A914EA56272EF1DD68E888C5A16B7C795C84883E4041DE90971B1EBDC3B063
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODI05.00.00.01PRO AEFB99EB8688374AACF4BEF56AF43B13303EA62A4B8EA20CE8245C2A00955C4C5BC200A44D4D5E2F4A5174CBF64F3319EAF8DFE3A1E2E3CBF2B6F15C8170A745EE5485F5DA81ED35E772890652472DFBDD97BD3890C00C4114DD43EE2E67D393A2A4F2FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B98088EDD5E5BE2F6E6679DB7CE019D40AA5CC038D530D6EB3452828A876751751F709A631F29052EC0C8FBA5B3A5893D9F010A4B77D5411CD69EA6595125FE8EFBCB93CC8BEBA335D4B6D6610E30527E993BB818B23EB254D0E44E241C88C630B1B4148EAC5DC6699EBF164000EF9A64291F2CCF78245589A6A9C520E2BBCE09DAFDC1D1A0C541FC2CE45A0565E4FC48E9799FE78AE32B55A52500996819A11A1470E8D7491BC4F40A1B670263C7F3D37C0A6D696C9319289E86936D32B32F3780C5F673CD8D67ACCAC8A621E102E105830819EFE57969C665EFB88D87CDC689C32D000B97FE27CF854A225D0AB28AAEA69AC52F031148475376CE8176E1210D8949BA9AD481E161D5708AC74CAC95F892DE3CEB958A4716442456E2D01B5814FEB20231F8625BB6D87E34035C75105DF4676A7D30495DF49978F6602BD969C1D4F354F2389C3B7932AC95C930C8E9AA833761D3AA6461F4B864793B5E343910C10A54160EE38
---- EOF - GMER 1.0.15 ----
Code:
ATTFilter Report of OSAM: Autorun Manager v5.0.11926.0 Online Solutions. Complex Protection for Information Systems Saved at 04:48:45 on 22.07.2011 OS: Windows XP Professional Service Pack 3 (Build 2600) Default Browser: Mozilla Corporation Firefox 5.0 Scanner Settings [x] Rootkits detection (hidden registry) [x] Rootkits detection (hidden files) [x] Retrieve files information [x] Check Microsoft signatures Filters [ ] Trusted entries [ ] Empty entries [x] Hidden registry entries (rootkit activity) [x] Exclusively opened files [x] Not found files [x] Files without detailed information [x] Existing files [ ] Non-startable services [ ] Non-startable drivers [x] Active entries [x] Disabled entries [Boot Execute] -----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager )----- "BootExecute" - "O&O Software GmbH" - C:\WINDOWS\system32\oodbs.exe "BootExecute" - "Sysinternals - www.sysinternals.com" - C:\WINDOWS\system32\pgdfgsvc.exe [Common] -----( %SystemRoot%\Tasks )----- "AppleSoftwareUpdate.job" - "Apple Inc." - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [Control Panel Objects] -----( %SystemRoot%\system32 )----- "Audiohq.cpl" - "Creative Technology Ltd." - C:\WINDOWS\system32\Audiohq.cpl "camcpl.cpl" - "Logitech Inc." - C:\WINDOWS\system32\camcpl.cpl "FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\WINDOWS\system32\FlashPlayerCPLApp.cpl "infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl "javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )----- "Mediafour.MacDriveCpl" - "Mediafour Corporation" - C:\Program Files\Mediafour\MacDrive 8\MDOptions.dll "QuickTime" - "Apple Inc." - F:\Programme 03\Media\QuickTime PRG\QTSystem\QuickTime.cpl [Drivers] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "Acronis Snapshots Manager" (snapman) - "Acronis" - C:\WINDOWS\System32\DRIVERS\snapman.sys "Acronis True Image FS Filter" (tifsfilter) - "Acronis" - C:\WINDOWS\System32\DRIVERS\tifsfilt.sys "AVM Audio" (avmaudio) - "AVM Berlin" - C:\WINDOWS\System32\DRIVERS\avmaudio.sys "AVM USB-Fernanschluss" (avmaura) - "AVM Berlin" - C:\WINDOWS\System32\DRIVERS\avmaura.sys "BootScreen" (BootScreen) - ? - C:\WINDOWS\System32\drivers\vidstub.sys (File found, but it contains no detailed information) "catchme" (catchme) - ? - C:\ComboFix\catchme.sys (File not found) "CBDisk" (CBDisk) - "EldoS Corporation" - C:\WINDOWS\system32\drivers\CBDisk.sys "Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys (File not found) "cpuz132" (cpuz132) - ? - C:\DOCUME~1\u\LOCALS~1\Temp\cpuz132\cpuz132_x32.sys (File not found) "GMSIPCI" (GMSIPCI) - ? - F:\INSTALL\GMSIPCI.SYS (File not found) "HH9Help.sys" (HH9Help.sys) - "H+H Software GmbH" - C:\WINDOWS\system32\drivers\HH9Help.sys "i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys (File not found) "ISO DVD/CD-ROM Device Driver" (ISODrive) - ? - C:\Program Files\CDVD\UltraISO\drivers\ISODrive.sys (File not found) "Lavalys EVEREST Kernel Driver" (EverestDriver) - ? - F:\Programme 03\System\Diagnose\everest ultimate 5.50 PRG\kerneld.wnt (File found, but it contains no detailed information) "lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys (File not found) "MacDrive file system driver" (MDFSYSNT) - "Mediafour Corporation" - C:\WINDOWS\system32\drivers\MDFSYSNT.sys "MacDrive partition driver" (MDPMGRNT) - "Mediafour Corporation" - C:\WINDOWS\system32\drivers\MDPMGRNT.sys "MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\WINDOWS\system32\drivers\mbam.sys "mbr" (mbr) - ? - C:\DOCUME~1\u\LOCALS~1\Temp\mbr.sys (Hidden registry entry, rootkit activity | File not found) "Network USB Device Bus" (EST_BusEnum) - ? - C:\WINDOWS\System32\DRIVERS\GenBus.sys (File not found) "Network USB Server Bus" (NUS_Bus) - ? - C:\WINDOWS\System32\DRIVERS\NUS_Bus.sys (File not found) "O&O DiskImage Snapshot/Restore Driver" (oodisr) - "O&O Software GmbH" - C:\WINDOWS\System32\DRIVERS\oodisr.sys "O&O DiskImage Virtual Devices Driver" (oodivd) - "O&O Software GmbH" - C:\WINDOWS\System32\DRIVERS\oodivd.sys "oodisrh" (oodisrh) - "O&O Software GmbH" - C:\WINDOWS\System32\DRIVERS\oodisrh.sys "oodivdh" (oodivdh) - "O&O Software GmbH" - C:\WINDOWS\System32\DRIVERS\oodivdh.sys "PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys (File not found) "PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys (File not found) "PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys (File not found) "PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys (File not found) "PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys (File not found) "PfModNT" (PfModNT) - "Creative Technology Ltd." - C:\WINDOWS\system32\PfModNT.sys "PQNTDrv" (PQNTDrv) - "PowerQuest Corporation" - C:\WINDOWS\system32\drivers\PQNTDrv.sys "pxlcrfod" (pxlcrfod) - ? - C:\DOCUME~1\u\LOCALS~1\Temp\pxlcrfod.sys (Hidden registry entry, rootkit activity | File not found) "SANDRA" (SANDRA) - ? - C:\Program Files\System\Sandra Professional Home 2009.SP4\WNt500x86\Sandra.sys (File not found) "SASDIFSV" (SASDIFSV) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Program Files\Security\SUPERAntiSpyware\SASDIFSV.SYS "SASENUM" (SASENUM) - " SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Program Files\Security\SUPERAntiSpyware\SASENUM.SYS "SASKUTIL" (SASKUTIL) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Program Files\Security\SUPERAntiSpyware\SASKUTIL.sys "SbieDrv" (SbieDrv) - "SANDBOXIE L.T.D" - C:\Program Files\VirtualEnvironment\Sandboxie\SbieDrv.sys "TVICHW32" (TVICHW32) - ? - C:\WINDOWS\system32\DRIVERS\TVICHW32.SYS (File not found) "WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys (File not found) "WINIO" (WINIO) - ? - D:\Dateien\Hardware\Netzteile\Netzteil Berechnung\Power Supply Calculator 2.071 PRG\winio.sys (File found, but it contains no detailed information) [Explorer] -----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )----- {89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install -----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )----- {11C3CCDE-3BE1-4840-95BC-8063AE5CCE88} "ColExt Class" - ? - C:\Program Files\Dateienverwaltung\Explorer\FastFolders PRG\FolderSize32.dll (File found, but it contains no detailed information) {A454F2F5-BB5F-4ACE-AD9A-CC33353C7341} "Mediafour Mac file columns" - "Mediafour Corporation" - C:\Program Files\Common Files\Mediafour\MACFPROP.DLL -----( HKLM\Software\Classes\Protocols\Filter )----- {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll {807553E5-5146-11D5-A672-00B0D022E945} "text/xml" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL -----( HKLM\Software\Classes\Protocols\Handler )----- {32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL {3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )----- {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "SABShellExecuteHook Class" - "SuperAdBlocker.com" - C:\Program Files\Security\SUPERAntiSpyware\SASSEH.DLL -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )----- {42071714-76d4-11d1-8b24-00a0c9068ff3} "Display Panning CPL Extension" - ? - deskpan.dll (File not found) {400CFEE2-39D0-46DC-96DF-E0BB5A4324B3} "Eigene Logitech-Bilder" - "Logitech Inc." - F:\Dateien\Hardware\WebCam\Video\Namespc2.dll {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Encryption Context Menu" - ? - (File not found | COM-object registry key not found) {FB0F57E0-09D0-11D2-9ADC-7CEC09C10000} "FastFolders32" - "DeskSoft" - C:\Program Files\Dateienverwaltung\Explorer\FastFolders PRG\FastFolders32.dll {1984DD45-52CF-49cd-AB77-18F378FEA264} "FencesShellExt" - "Stardock" - C:\Program Files\DeskTop\Fences\FencesMenu.dll {bc5e1455-02ca-4b30-8eed-91d52a38da75} "FineReader10.FRContextMenu.1" - "ABBYY." - F:\Programme 03\Text\FineReader\FineReader 10 Corporate Edition PRG\FRIntegration.dll {1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll {FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? - (File not found | COM-object registry key not found) {2BB59FC0-31E8-42DA-9D3C-E9A52953853B} "ImageResizer Shell Extension" - ? - (File not found | COM-object registry key not found) {B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\Media\iTunes\iTunesMiniPlayer.dll {B446400D-0030-457b-8F64-422A19605186} "Logitech Gallery" - "Logitech Inc." - F:\Dateien\Hardware\WebCam\ImageStudio (Logitech) PRG\NameSpc.dll {A454F2F5-BB5F-4ACE-AD9A-CC33353C7341} "Mediafour Mac file columns" - "Mediafour Corporation" - C:\Program Files\Common Files\Mediafour\MACFPROP.DLL {E452F45B-DD18-4ADC-9C9A-2B26F85DABC0} "Mediafour Mac file properties" - "Mediafour Corporation" - C:\Program Files\Common Files\Mediafour\MACFPROP.DLL {42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\OFFICE11\msohev.dll {993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll {00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL {C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll {84ECF479-BB35-4e8a-B376-2F37758D1312} "O&O DiskImage PropertyPage" - ? - (File not found | COM-object registry key not found) {5B036813-4E35-4421-ADCB-E06925C7A7ED} "OODIDismount Class" - "O&O Software GmbH" - F:\Programme 03\Dateienverwaltung\IMAGE-Tools\O&O DiskImage 5 Pro PRG\oodishd.dll {E5EE7DC9-D673-434a-86E1-306EAFD4A4CF} "OODIMount Class" - "O&O Software GmbH" - F:\Programme 03\Dateienverwaltung\IMAGE-Tools\O&O DiskImage 5 Pro PRG\oodishm.dll {48EAD1E1-ECF2-4a85-AA09-1C44FBEED451} "OODShellExtObj Class" - "O&O Software GmbH" - C:\PROGRA~1\FESTPL~1\OOSOFT~1\DEFRAG~1\oodsh.dll {0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL {764BF0E1-F219-11ce-972D-00AA00A14F56} "Shell extensions for file compression" - ? - (File not found | COM-object registry key not found) {E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll {e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll {2F603045-309F-11CF-9774-0020AFD0CFF6} "Synaptics Control Panel" - ? - (File not found | COM-object registry key not found) {AD392E40-428C-459F-961E-9B147782D099} "UltraISO" - ? - (File not found | COM-object registry key not found) {DDE4BEEB-DDE6-48fd-8EB5-035C09923F83} "UnlockerShellExtension" - ? - F:\Programme 03\Dateienverwaltung\Unlocker 1.9.0\Unlocker 1.9.0 PRG\UnlockerCOM.dll (File found, but it contains no detailed information) {BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL {B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\Dateienverwaltung\Packer\WinRAR PRG\rarext.dll [Internet Explorer] -----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )----- ITBar7Height "ITBar7Height" - ? - (File not found | COM-object registry key not found) <binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found) -----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )----- {0067DBFC-A752-458C-AE6E-B9C7E63D4824} "Device Detection" - "Logitech, Inc." - C:\WINDOWS\DOWNLO~1\LOGITE~1.OCX / hxxp://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab {8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_24.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_24.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_24.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab Microsoft XML Parser for Java "Microsoft XML Parser for Java" - ? - (File not found | COM-object registry key not found) / file://C:\WINDOWS\Java\classes\xmldso.cab {D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Macromed\Flash\Flash10l.ocx / hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )----- {FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Recherchieren" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )----- {DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll {E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [Logon] -----( %AllUsersProfile%\Start Menu\Programs\Startup )----- "desktop.ini" - ? - C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini -----( %UserProfile%\Start Menu\Programs\Startup )----- "desktop.ini" - ? - C:\Documents and Settings\u\Start Menu\Programs\Startup\desktop.ini "ERUNT AutoBackup.lnk" - ? - C:\Program Files\Registry\ERUNT\AUTOBACK.EXE (Shortcut exists | File found, but it contains no detailed information | File exists) -----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )----- "AVMUSBFernanschluss" - "AVM Berlin" - "C:\Documents and Settings\u\Local Settings\Apps\2.0\3OEW5K9B.2D6\LW0Y1VBV.G0V\frit..tion_8488884cfbcefd60_0002.0002_8541bf1f4a1c673d\AVMAutoStart.exe" "AVMUSBRemoteConnection" - "LAB1.DE" - REM C:\Documents and Settings\u\Local Settings\Apps\2.0\XW5471ZK.4N3\KZVHJ9MH.BZ7\frit..tion_8488884cfbcefd60_0002.0001_f24dc39254641428\AVMAutoStart.exe "LDM" - "LAB1.DE" - REM C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe "LogitechSoftwareUpdate" - "LAB1.DE" - REM F:\Dateien\Hardware\WebCam\Video\ManifestEngine.exe boot "PeerBlock" - "LAB1.DE" - REM C:\Program Files\Security\peerblock\peerblock.exe "SandboxieControl" - "LAB1.DE" - REM "C:\Program Files\VirtualEnvironment\Sandboxie\SbieCtrl.exe" "SUPERAntiSpyware" - "LAB1.DE" - REM C:\Program Files\Security\SUPERAntiSpyware\SUPERAntiSpyware.exe "Vidalia" - "LAB1.DE" - REM "C:\Program Files\Security\Vidalia Bundle\vidalia.exe" -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )----- "ABBYY Community Agent" - "LAB1.DE" - REM F:\2\Programme 03\Text\FineReader Pro\FineReader v5.0 PRG\CAgent.exe "AppleSyncNotifier" - "LAB1.DE" - REM C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe "AudioHQ" - "LAB1.DE" - REM C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE "AVMUSBRemoteConnection" - "LAB1.DE" - REM C:\Documents and Settings\u\Local Settings\Apps\2.0\XW5471ZK.4N3\KZVHJ9MH.BZ7\frit..tion_8488884cfbcefd60_0002.0001_f24dc39254641428\AVMAutoStart.exe "Dell AIO Printer A920" - "LAB1.DE" - REM "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe" "Getting started with MacDrive 8" - "LAB1.DE" - REM "C:\Program Files\Mediafour\MacDrive 8\MDGetStarted.exe" /auto "LogitechGalleryRepair" - "LAB1.DE" - REM F:\Dateien\Hardware\WebCam\ImageStudio (Logitech) PRG\ISStart.exe "LogitechImageStudioTray" - "LAB1.DE" - REM F:\Dateien\Hardware\WebCam\ImageStudio (Logitech) PRG\LogiTray.exe "LogitechVideoRepair" - "LAB1.DE" - REM F:\Dateien\Hardware\WebCam\Video\ISStart.exe "LogitechVideoTray" - "LAB1.DE" - REM F:\Dateien\Hardware\WebCam\Video\LogiTray.exe "LVCOMSX" - "LAB1.DE" - REM C:\WINDOWS\system32\LVCOMSX.EXE "MacDrive 8 application" - "LAB1.DE" - REM "C:\Program Files\Mediafour\MacDrive 8\MacDrive.exe" "Malwarebytes' Anti-Malware" - "LAB1.DE" - REM "F:\Programme 03\Security\Malwarebytes' Anti-Malware PRG\mbamgui.exe" /starttray "OODefragTray" - "LAB1.DE" - REM C:\WINDOWS\system32\oodtray.exe "OODITRAY.EXE" - "LAB1.DE" - REM F:\Programme 03\Dateienverwaltung\IMAGE-Tools\O&O DiskImage 5 Pro PRG\ooditray.exe "QuickTime Task" - "LAB1.DE" - REM "F:\Programme 03\Media\QuickTime PRG\QTTask.exe" -atboottime "RAMpage" - "LAB1.DE" - REM "C:\Program Files\System\RAMpage PRG\RAMpage.exe" M=28 T=4 P="C:\Program Files\System\RAMpage PRG\RAMpageConfig.exe" "RemoteControl" - "LAB1.DE" - REM "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" "SunJavaUpdateSched" - "LAB1.DE" - REM "C:\Program Files\Common Files\Java\Java Update\jusched.exe" "TomTomHOME.exe" - "LAB1.DE" - REM "F:\Programme 03\NaViGat\TomTom HOME 2 PRG\TomTomHOMERunner.exe" "VC9Player" - "LAB1.DE" - REM C:\Program Files\CDVD\Virtual CD v9\System\VC9Play.exe [Print Monitors] -----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )----- "Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\mdimon.dll "PDF-XChange" - "Tracker Software" - C:\WINDOWS\system32\pxc25pm.dll [Services] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- ".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe "ABBYY FineReader 10 CE Licensing Service" (ABBYY.Licensing.FineReader.Corporate.10.0) - "ABBYY" - C:\Program Files\Common Files\ABBYY\FineReader\10.00\Licensing\CE\NetworkLicenseServer.exe "ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe "AVM IGD CTRL Service" (IGDCTRL) - "AVM Berlin" - C:\Program Files\DSL\FRITZ!DSL\IGDCTRL.EXE "iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe "Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jqs.exe "MacDrive 8 service" (MacDrive8Service) - "Mediafour Corporation" - C:\Program Files\Mediafour\MacDrive 8\MacDrive8Service.exe "Macromedia Licensing Service" (Macromedia Licensing Service) - ? - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe "MBAMService" (MBAMService) - "Malwarebytes Corporation" - F:\Programme 03\Security\Malwarebytes' Anti-Malware PRG\mbamservice.exe "O&O Defrag" (O&O Defrag) - "O&O Software GmbH" - C:\WINDOWS\system32\oodag.exe "Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE "OFI" (OFI) - ? - C:\DOCUME~1\u\LOCALS~1\Temp\OFI.exe (File not found) "OO DiskImage" (OO DiskImage) - ? - F:\Programme 03\Dateienverwaltung\IMAGE-Tools\O&O DiskImage 5 Pro PRG\oodiag.exe "Sandboxie Service" (SbieSvc) - "SANDBOXIE L.T.D" - C:\Program Files\VirtualEnvironment\Sandboxie\SbieSvc.exe "TomTomHOMEService" (TomTomHOMEService) - "TomTom" - F:\Programme 03\NaViGat\TomTom HOME 2 PRG\TomTomHOMEService.exe "Virtual CD v9 Management Service" (VC9SecS) - "H+H Software GmbH" - C:\Program Files\CDVD\Virtual CD v9\System\VC9SecS.exe "Windows CardSpace" (idsvc) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe "Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [Winlogon] -----( HKCU\Control Panel\IOProcs )----- "MVB" - ? - mvfs32.dll (File not found) -----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )----- "!SASWinLogon" - "SUPERAntiSpyware.com" - C:\Program Files\Security\SUPERAntiSpyware\SASWINLO.dll "WgaLogon" - "Microsoft Corporation" - C:\WINDOWS\system32\WgaLogon.dll ===[ Logfile end ]=========================================[ Logfile end ]=== If You have questions or want to get some help, You can visit Online Solutions :: Index aswMBR version 0.9.8.945 Copyright(c) 2011 AVAST Software Run date: 2011-07-22 04:52:59 ----------------------------- 04:52:59.529 OS Version: Windows 5.1.2600 Service Pack 3 04:52:59.529 Number of processors: 1 586 0x80A 04:52:59.529 ComputerName: STUDIO-CUSL2 UserName: u 04:53:00.200 Initialize success 04:55:33.581 AVAST engine defs: 11072101 04:56:27.458 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 04:56:27.458 Disk 0 Vendor: ST3160215A 3.AAD Size: 152627MB BusType: 3 04:56:27.468 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP1T1L0-e 04:56:27.468 Disk 1 Vendor: SAMSUNG_SP1213N TL100-30 Size: 114498MB BusType: 3 04:56:27.709 Disk 0 MBR read successfully 04:56:27.709 Disk 0 MBR scan 04:56:27.869 Disk 0 Windows XP default MBR code 04:56:28.069 Disk 0 scanning sectors +312576705 04:56:28.750 Disk 0 scanning C:\WINDOWS\system32\drivers 05:00:00.114 Service scanning 05:00:08.616 Modules scanning 05:02:53.503 Disk 0 trace - called modules: 05:02:53.594 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys intelide.sys 05:02:53.614 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x83725ab8] 05:02:53.614 3 CLASSPNP.SYS[f8743fd7] -> nt!IofCallDriver -> \Device\00000074[0x83759170] 05:02:53.614 5 ACPI.sys[f8662620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x8375b940] 05:02:54.174 AVAST engine scan C:\WINDOWS 05:03:43.255 AVAST engine scan C:\WINDOWS\system32 05:26:50.319 File: C:\WINDOWS\system32\srvewin.exe **INFECTED** Win32:Malware-gen 05:32:38.750 AVAST engine scan C:\WINDOWS\system32\drivers 05:35:12.842 AVAST engine scan C:\Documents and Settings\u 05:51:25.801 File: C:\Documents and Settings\u\Password\john16\run\john.exe **INFECTED** Win32:Trojan-gen 05:51:27.323 File: C:\Documents and Settings\u\Password\LsaExt.dll **INFECTED** Win32:Trojan-gen 05:51:28.325 File: C:\Documents and Settings\u\Password\PwDump3.exe **INFECTED** Win32:Trojan-gen 05:52:13.620 AVAST engine scan C:\Documents and Settings\All Users 05:58:02.201 Scan finished successfully 05:59:14.836 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\u\Desktop\MBR.dat" 05:59:14.856 The log file has been saved successfully to "C:\Documents and Settings\u\Desktop\aswMBR.txt" Gruß, Tiger |
|
22.07.2011, 10:17
| #20 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | svchost.exe hat 100% Auslastung - vermute Trojaner Bitte mal den Avenger anwenden: 1.) Lade Dir von hier Avenger: Swandog46's Public Anti-Malware Tools (Download, linksseitig) 2.) Entpack das zip-Archiv, führe die Datei "avenger.exe" aus (unter Vista per Rechtsklick => als Administrator ausführen). Die Haken unten wie abgebildet setzen:  3.) Kopiere Dir exakt die Zeilen aus dem folgenden Code-Feld: Code:
ATTFilter Files to delete:
C:\WINDOWS\system32\srvewin.exe
C:\Documents and Settings\u\Password\john16\run\john.exe
C:\Documents and Settings\u\Password\LsaExt.dll
C:\Documents and Settings\u\Password\PwDump3.exe
5.) Der Code-Text hier aus meinem Beitrag müsste nun unter "Input Script here" in "The Avenger" zu sehen sein. 6.) Falls dem so ist, klick unten rechts auf "Execute". Bestätige die nächste Abfrage mit "Ja", die Frage zu "Reboot now" (Neustart des Systems) ebenso. 7.) Nach dem Neustart erhältst Du ein LogFile von Avenger eingeblendet. Kopiere dessen Inhalt und poste ihn hier. 8.) Die Datei c:\avenger\backup.zip bei File-Upload.net - Ihr kostenloser File Hoster! hochladen und hier verlinken
__________________ Logfiles bitte immer in CODE-Tags posten |
|
22.07.2011, 13:03
| #21 |
| | svchost.exe hat 100% Auslastung - vermute Trojaner Hallo Arne, hier das Log. Logfile of The Avenger Version 2.0, (c) by Swandog46 Swandog46's Public Anti-Malware Tools Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! File "C:\WINDOWS\system32\srvewin.exe" deleted successfully. File "C:\Documents and Settings\u\Password\john16\run\john.exe" deleted successfully. File "C:\Documents and Settings\u\Password\LsaExt.dll" deleted successfully. File "C:\Documents and Settings\u\Password\PwDump3.exe" deleted successfully. Completed script processing. ******************* Finished! Terminate. Der Link; File-Upload.net - backup.zip Kannst Du mir mitteilen, um was es sich handelt? Gruß, Tiger |
|
22.07.2011, 13:12
| #22 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | svchost.exe hat 100% Auslastung - vermute TrojanerZitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
22.07.2011, 13:45
| #23 |
| | svchost.exe hat 100% Auslastung - vermute Trojaner Sorry, könnte von Eurem Server eleminiert sein, hier einen ohne Vorzeichen: file-upload.net/download-3604912/backup.zip_html (Unterstrich durch Punkt ersetzen, funzt mit Firefox) Gruß, Tiger |
|
22.07.2011, 13:58
| #24 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | svchost.exe hat 100% Auslastung - vermute Trojaner Ok. Führe bitte nochmal aswmbr aus.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
22.07.2011, 14:39
| #25 |
| | svchost.exe hat 100% Auslastung - vermute Trojaner aswMBR version 0.9.8.945 Copyright(c) 2011 AVAST Software Run date: 2011-07-22 15:19:30 ----------------------------- 15:19:30.126 OS Version: Windows 5.1.2600 Service Pack 3 15:19:30.126 Number of processors: 1 586 0x80A 15:19:30.136 ComputerName: STUDIO-CUSL2 UserName: u 15:19:30.807 Initialize success 15:20:03.985 AVAST engine defs: 11072101 15:20:09.112 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 15:20:09.122 Disk 0 Vendor: ST3160215A 3.AAD Size: 152627MB BusType: 3 15:20:09.122 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP1T1L0-e 15:20:09.122 Disk 1 Vendor: SAMSUNG_SP1213N TL100-30 Size: 114498MB BusType: 3 15:20:09.132 Disk 0 MBR read successfully 15:20:09.132 Disk 0 MBR scan 15:20:09.293 Disk 0 Windows XP default MBR code 15:20:09.313 Disk 0 scanning sectors +312576705 15:20:09.433 Disk 0 scanning C:\WINDOWS\system32\drivers 15:20:51.043 Service scanning 15:20:59.755 Modules scanning 15:21:25.252 Disk 0 trace - called modules: 15:21:25.272 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys intelide.sys 15:21:25.292 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8378eab8] 15:21:25.302 3 CLASSPNP.SYS[f8726fd7] -> nt!IofCallDriver -> \Device\0000006f[0x83763310] 15:21:25.302 5 ACPI.sys[f8645620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x83765940] 15:21:25.813 AVAST engine scan C:\WINDOWS 15:21:34.345 AVAST engine scan C:\WINDOWS\system32 15:31:11.885 AVAST engine scan C:\WINDOWS\system32\drivers 15:32:08.477 AVAST engine scan C:\Documents and Settings\u 15:35:38.118 AVAST engine scan C:\Documents and Settings\All Users 15:37:01.528 Scan finished successfully 15:37:50.999 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\u\Desktop\MBR.dat" 15:37:51.009 The log file has been saved successfully to "C:\Documents and Settings\u\Desktop\aswMBR.txt" Gruß. Tiger |
|
22.07.2011, 14:43
| #26 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | svchost.exe hat 100% Auslastung - vermute Trojaner Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs. Denk dran beide Tools zu updaten vor dem Scan!! Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt: ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten |
|
25.07.2011, 19:11
| #27 |
| | svchost.exe hat 100% Auslastung - vermute Trojaner Hallo Arne, der Scan mit ESET dauerte zwei Tage. Hier die Logs: Malwarebytes' Anti-Malware 1.51.1.1800 Malwarebytes : Free anti-malware, anti-virus and spyware removal download Datenbank Version: 7249 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 23.07.2011 18:02:46 mbam-log-2011-07-23 (17-51-39).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|F:\|) Durchsuchte Objekte: 321544 Laufzeit: 3 Stunde(n), 38 Minute(n), 56 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 38 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: c:\system volume information\_restore{5fd3e795-2577-4dee-8b74-edb408c75373}\RP613\A0231240.exe (Trojan.AVKiller) -> No action taken. d:\Dateien\Computer\system - betriebssystem\ms_windows\xp\XP_sn\3.wga-patcher permanent edition!\keyfinder.exe (Application.FindKey) -> No action taken. d:\Dateien\Computer\system - betriebssystem\ms_windows\xp\XP_sn\3.wga-patcher permanent edition!\wga-fix.exe (Hacktool.WGAFix) -> No action taken. d:\Dateien\Computer\system - betriebssystem\ms_windows\xp\XP_sn\3.wga-patcher permanent edition!\windows xp keygen.exe (Malware.Tool) -> No action taken. d:\Dateien\Computer\system - betriebssystem\ms_windows\xp\XP_sn\serial key change\windows xp serial key changer for sp1[1]\windowsxp product key viewer.exe (Hacktool.KeySteal) -> No action taken. d:\system volume information\_restore{5fd3e795-2577-4dee-8b74-edb408c75373}\RP607\A0226767.exe (Riskware.Tool.CK) -> No action taken. d:\system volume information\_restore{d7dcc8d6-4a84-47af-9726-0ec76bf9f420}\RP127\A0058904.exe (Riskware.Tool.CK) -> No action taken. d:\system volume information\_restore{d7dcc8d6-4a84-47af-9726-0ec76bf9f420}\RP127\A0060091.exe (Trojan.Dropper) -> No action taken. d:\system volume information\_restore{d7dcc8d6-4a84-47af-9726-0ec76bf9f420}\RP128\A0060140.exe (Riskware.Tool.CK) -> No action taken. d:\system volume information\_restore{ff33c502-16fb-468a-b65b-163afc481b7e}\RP78\A0017629.exe (RiskWare.Tool.CK) -> No action taken. d:\system volume information\_restore{ff33c502-16fb-468a-b65b-163afc481b7e}\RP96\A0022989.exe (RiskWare.Tool.CK) -> No action taken. d:\system volume information\_restore{ff33c502-16fb-468a-b65b-163afc481b7e}\RP96\A0022991.exe (Malware.Packer.Gen) -> No action taken. d:\system volume information\_restore{ff33c502-16fb-468a-b65b-163afc481b7e}\RP96\A0022992.exe (RiskWare.Tool.CK) -> No action taken. d:\system volume information\_restore{ff33c502-16fb-468a-b65b-163afc481b7e}\RP96\A0022997.exe (Riskware.Tool.CK) -> No action taken. d:\programme 03\dateienverwaltung\brennsoft\easy cd cretaor\all_roxio_products [07-04-2003]_sn\application.exe (Malware.Packer.Gen) -> No action taken. d:\programme 03\dateienverwaltung\brennsoft\Nero\Nero 6.x\nero burning rom 6.6.0.8a_sn\nero burning rom v6.6.0.8a_sn\Keygen.exe (Trojan.Agent) -> No action taken. d:\programme 03\dateienverwaltung\brennsoft\Nero\Nero 6.x\nero burning rom v6.6.0.16 ultra edition_sn\keygen.exe (Malware.Packer.Gen) -> No action taken. d:\programme 03\dateienverwaltung\brennsoft\Nero\nero 7.0.8.2\nero 7.0.8.2 all products_sn\nero7082keygenupdated.exe (Trojan.Downloader) -> No action taken. d:\programme 03\dateienverwaltung\brennsoft\Nero\nero 7.0.8.2\nero 7.0.8.2 all products_sn\nero7keygen.exe (Trojan.Downloader) -> No action taken. d:\programme 03\dateienverwaltung\brennsoft\Nero\nero 7.0.8.2\nero 7.0.x_sn\nero premium edition v7.0.5.4_sn\Keygen.exe (Trojan.Downloader) -> No action taken. d:\programme 03\dateienverwaltung\brennsoft\Nero\nero 7.0.8.2\nero 7.0.x_sn\nero v7.0.ultra.edition.incl.keymaker_sn\keygen.exe (RiskWare.Tool.CK) -> No action taken. d:\programme 03\dateienverwaltung\image-tools\driveimage\drive image 7.01_sn\drive image 7.01_sn\keygen.exe (Malware.Packer.Gen) -> No action taken. d:\programme 03\dateienverwaltung\image-tools\norton programme\norton ghost v10.0\norton ghost v10.0_sn\patch (worm.mytob.fn).exe (Trojan.Dropper) -> No action taken. d:\programme 03\dateienverwaltung\image-tools\trueimage\acronis all_sn\keygen.exe (Riskware.Tool.CK) -> No action taken. d:\programme 03\dateienverwaltung\image-tools\trueimage\true image v9\keygen.exe (Riskware.Tool.CK) -> No action taken. d:\programme 03\dateienverwaltung\image-tools\trueimage\true image v9\true image enterprise server v9.1\true image enterprise server v9.1 universal restore_sn\keygen.exe (Malware.Packer.Gen) -> No action taken. d:\programme 03\dateienverwaltung\image-tools\trueimage\true image v9\true image enterprise server v9.1\true image enterprise server v9.1.3534_sn\keygen v9.1.3534.exe (Malware.Packer.Gen) -> No action taken. d:\programme 03\dateienverwaltung\ISO\isobuster\isobuster 1.9.1\isobuster pro v1.9.1_sn\KeyMaker.exe (Trojan.Downloader) -> No action taken. d:\programme 03\_virtuelle laufwerke\virtualcd\virtual cd_sn\virtual cd v6.0.0.0 network management server\virtual.cd.v6.0.0.0.network.management.server.win2kxp2k3.incl.keygen-tsz\keygen.exe (Malware.Packer.Gen) -> No action taken. d:\programme 03\Recovery\floppy zip disk rescue\floppy.zip.disk.rescue.1.1.5.keygen.exe (Rootkit.TDSS) -> No action taken. d:\programme 03\Security\internet u network\hide ip platinum\hide ip platinum v2.31\keygen.exe (Trojan.Agent.CK) -> No action taken. d:\programme 03\Security\Sniffer\z_passwortcracker cain\cain + dnld´s +\cain20.exe +virenanzeige via bitdefennder+\cain20.exe (PSWTool.Cain) -> No action taken. d:\programme 03\Security\Sniffer\z_passwortcracker cain\cain 2.5.45_prg\Cain.exe (PUP.Passwordtool.Cain) -> No action taken. d:\programme 03\Security\hijackthis prg\backups\backup-20100518-051203-294.dll (PUP.Dealio.TB) -> No action taken. d:\programme 03\softwareverwaltung\advanced uninstaller pro\advanced uninstaller pro_sn\advanced uninstaller pro 2004 6.7.x\advanced uninstaller pro 2004 v6.7.2_funzt\patch.exe (Trojan.Bancos) -> No action taken. d:\programme 03\softwareverwaltung\advanced uninstaller pro\advanced uninstaller pro_sn\advanced uninstaller pro 2004 6.7.x\advanced.uninstaller.pro.2004.v6.7.4 nix funzen bei 6.7.2\Patch.exe (RiskWare.Tool.CK) -> No action taken. f:\programme 03\Security\hijackthis prg\backups\backup-20100518-051203-294.dll (PUP.Dealio.TB) -> No action taken. f:\DNLD\Temp\Rar$EX62.277\Patch\Patch.exe (PUP.Hacktool.Patcher) -> No action taken. SUPERAntiSpyware Scan Log SUPERAntiSpyware.com | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware! Generated 07/23/2011 at 01:20 PM Application Version : 4.28.1010 Core Rules Database Version : 7450 Trace Rules Database Version: 5262 Scan type : Custom Scan Total Scan Time : 03:57:38 Memory items scanned : 493 Memory threats detected : 0 Registry items scanned : 5621 Registry threats detected : 0 File items scanned : 66715 File threats detected : 133 Trojan.Agent/Gen-OnlineGames C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\65IRQR41\MAPN[1].EXE Adware.Tracking Cookie .belnk.com [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .2o7.net [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .2o7.net [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .2o7.net [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .2o7.net [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .2o7.net [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .adopt.euroclick.com [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .adtech.de [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .adtech.de [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .amsterdamlivexxx.com [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .apmebf.com [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .atwola.com [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .clickbank.net [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .hmt.connexpromotions.de [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .hypertracker.com [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .imrworldwide.com [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .imrworldwide.com [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .komtrack.com [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .komtrack.com [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .mediavantage.de [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .microsofteup.112.2o7.net [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .sexerror.com [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .statcounter.com [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .statcounter.com [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .statcounter.com [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .tradedoubler.com [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .xiti.com [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] banner.t-online.de [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] crack.polivar.net [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] de.sitestat.com [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] de.sitestat.com [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] server.iad.liveperson.net [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] stat.onestat.com [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] stat.onestat.com [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] etracker Home - forget log-file analysis, this is real-time Web Analytics and online market research [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] etracker Home - forget log-file analysis, this is real-time Web Analytics and online market research [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] etracker Home - forget log-file analysis, this is real-time Web Analytics and online market research [ D:\Firefox\Firefox - extensions dnld, INFO\Bookmark Backup 0.4\Mozilla_SAVE\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .2o7.net [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .2o7.net [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .2o7.net [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .2o7.net [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .2o7.net [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .adopt.euroclick.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .adtech.de [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .adtech.de [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .amsterdamlivexxx.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .apmebf.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .atwola.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .clickbank.net [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .hmt.connexpromotions.de [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .hypertracker.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .imrworldwide.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .imrworldwide.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .komtrack.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .komtrack.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .mediavantage.de [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .microsofteup.112.2o7.net [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .sexerror.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .statcounter.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .statcounter.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .statcounter.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .tradedoubler.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .xiti.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] banner.t-online.de [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] crack.polivar.net [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] de.sitestat.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] de.sitestat.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] server.iad.liveperson.net [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] stat.onestat.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] stat.onestat.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] etracker Home - forget log-file analysis, this is real-time Web Analytics and online market research [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] etracker Home - forget log-file analysis, this is real-time Web Analytics and online market research [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] etracker Home - forget log-file analysis, this is real-time Web Analytics and online market research [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen a Anwendungsdaten)\Firefox\Profiles\99qc0dl6.default\cookies.txt ] .adultfriendfinder.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)\Firefox\Profiles\hty5j81b.default\cookies.txt ] .adultfriendfinder.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)\Firefox\Profiles\hty5j81b.default\cookies.txt ] .cs.sexcounter.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)\Firefox\Profiles\hty5j81b.default\cookies.txt ] .cs.sexcounter.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)\Firefox\Profiles\hty5j81b.default\cookies.txt ] .cz4.clickzs.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)\Firefox\Profiles\hty5j81b.default\cookies.txt ] .cz4.clickzs.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)\Firefox\Profiles\hty5j81b.default\cookies.txt ] .cz4.clickzs.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)\Firefox\Profiles\hty5j81b.default\cookies.txt ] .hereistheporn.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)\Firefox\Profiles\hty5j81b.default\cookies.txt ] .hereistheporn.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)\Firefox\Profiles\hty5j81b.default\cookies.txt ] Google [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)\Firefox\Profiles\hty5j81b.default\cookies.txt ] m1.webstats4u.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)\Firefox\Profiles\hty5j81b.default\cookies.txt ] .doubleclick.net [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)\Firefox\Profiles\hty5j81b.default\cookies.txt ] .247realmedia.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)\Firefox\Profiles\hty5j81b.default\cookies.txt ] .amsterdamlivexxx.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)\Firefox\Profiles\hty5j81b.default\cookies.txt ] .as-eu.falkag.net [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)\Firefox\Profiles\hty5j81b.default\cookies.txt ] .as-us.falkag.net [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)\Firefox\Profiles\hty5j81b.default\cookies.txt ] .komtrack.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)\Firefox\Profiles\hty5j81b.default\cookies.txt ] .macromedia.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)\Firefox\Profiles\hty5j81b.default\cookies.txt ] .macromedia.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)\Firefox\Profiles\hty5j81b.default\cookies.txt ] .sexerror.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)\Firefox\Profiles\hty5j81b.default\cookies.txt ] .tradedoubler.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)\Firefox\Profiles\hty5j81b.default\cookies.txt ] .tradedoubler.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)\Firefox\Profiles\hty5j81b.default\cookies.txt ] ad.zanox.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)\Firefox\Profiles\hty5j81b.default\cookies.txt ] Adobe [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)\Firefox\Profiles\hty5j81b.default\cookies.txt ] Adobe [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)\Firefox\Profiles\hty5j81b.default\cookies.txt ] .2o7.net [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)\Profiles\default\op00gtgf.slt\cookies.txt ] .2o7.net [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)\Profiles\default\op00gtgf.slt\cookies.txt ] .atwola.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)\Profiles\default\op00gtgf.slt\cookies.txt ] .247realmedia.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)_02\Firefox\Profiles\6xmb5mft.default\cookies.txt ] .adultfriendfinder.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)_02\Firefox\Profiles\6xmb5mft.default\cookies.txt ] .adultfriendfinder.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)_02\Firefox\Profiles\6xmb5mft.default\cookies.txt ] .amsterdamlivexxx.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)_02\Firefox\Profiles\6xmb5mft.default\cookies.txt ] .as-eu.falkag.net [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)_02\Firefox\Profiles\6xmb5mft.default\cookies.txt ] .as-us.falkag.net [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)_02\Firefox\Profiles\6xmb5mft.default\cookies.txt ] .cs.sexcounter.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)_02\Firefox\Profiles\6xmb5mft.default\cookies.txt ] .cs.sexcounter.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)_02\Firefox\Profiles\6xmb5mft.default\cookies.txt ] .cz4.clickzs.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)_02\Firefox\Profiles\6xmb5mft.default\cookies.txt ] .hereistheporn.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)_02\Firefox\Profiles\6xmb5mft.default\cookies.txt ] .hereistheporn.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)_02\Firefox\Profiles\6xmb5mft.default\cookies.txt ] .komtrack.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)_02\Firefox\Profiles\6xmb5mft.default\cookies.txt ] .macromedia.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)_02\Firefox\Profiles\6xmb5mft.default\cookies.txt ] .macromedia.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)_02\Firefox\Profiles\6xmb5mft.default\cookies.txt ] .sexerror.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)_02\Firefox\Profiles\6xmb5mft.default\cookies.txt ] .tradedoubler.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)_02\Firefox\Profiles\6xmb5mft.default\cookies.txt ] .tradedoubler.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)_02\Firefox\Profiles\6xmb5mft.default\cookies.txt ] ad.zanox.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)_02\Firefox\Profiles\6xmb5mft.default\cookies.txt ] taboorevenue.com [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)_02\Firefox\Profiles\6xmb5mft.default\cookies.txt ] Google [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)_02\Firefox\Profiles\6xmb5mft.default\cookies.txt ] Adobe [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)_02\Firefox\Profiles\6xmb5mft.default\cookies.txt ] Adobe [ D:\Firefox\Firefox - Profiles\Mozilla (C Dokumente und Einstellungen y Anwendungsdaten)_02\Firefox\Profiles\6xmb5mft.default\cookies.txt ] Unclassified.Unknown Origin D:\PROGRAMME 03\DATEIENVERWALTUNG\BRENNSOFT\NERO\NERO 6.X\NERO BURNING ROM 6.6.0.8A_SN\NERO BURNING ROM V6.6.0.8A_SN\KEYGEN.EXE Trojan.Agent/Gen-FSG D:\PROGRAMME 03\DATEIENVERWALTUNG\BRENNSOFT\NERO\NERO 6.X\NERO BURNING ROM V6.6.0.16 ULTRA EDITION_SN\KEYGEN.EXE D:\PROGRAMME 03\DATEIENVERWALTUNG\BRENNSOFT\NERO\NERO 7.0.8.2\NERO 7.0.X_SN\NERO PREMIUM EDITION V7.0.5.4_SN\KEYGEN.EXE D:\PROGRAMME 03\DATEIENVERWALTUNG\IMAGE-TOOLS\DRIVEIMAGE\DRIVE IMAGE 7.01_SN\DRIVE IMAGE 7.01_SN\KEYGEN.EXE D:\PROGRAMME 03\_VIRTUELLE LAUFWERKE\VIRTUALCD\VIRTUAL CD_SN\VIRTUAL CD V6.0.0.0 NETWORK MANAGEMENT SERVER\VIRTUAL.CD.V6.0.0.0.NETWORK.MANAGEMENT.SERVER.WIN2KXP2K3.INCL.KEYGEN-TSZ\KEYGEN.EXE Trojan.Agent/Gen D:\PROGRAMME 03\SECURITY\STEGANOS SECURITY SUITE 7.0.7\STEGANOS SECURITY SUITE 7.0.7_SN\STEGANOS.SECURITY.SUITE.V7.0.7.WINALL.INCL.KEYMAKER\KEYGEN.EXE Adware.Avenue Media/Web Rebates (TopRebates) D:\PROGRAMME 03\SECURITY\__PESTS\BLUBSTER 2.5 - AUDIOGALAXY ALTERNATIVE [SHARING]\WEBHANCER - KOMMT VIA BLUBSTER\WEBREBATES4\WEBREBATES.EXE Trojan.Agent/Gen-Krpytik D:\SYSTEM VOLUME INFORMATION\_RESTORE{D7DCC8D6-4A84-47AF-9726-0EC76BF9F420}\RP127\A0060116.EXE Trojan.Agent/Gen-HackPatch F:\DNLD\TEMP\RAR$EX62.277\PATCH\PATCH.EXE ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6528 # api_version=3.0.2 # EOSSerial=41986e0b5208e34fac3567ae48685cfc # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-07-25 12:54:18 # local_time=2011-07-25 02:54:18 (+0100, W. Europe Daylight Time) # country="Germany" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=512 16777215 100 0 0 0 0 0 # compatibility_mode=768 16777215 100 0 0 0 0 0 # compatibility_mode=8192 67108863 100 0 245 245 0 0 # scanned=166987 # found=144 # cleaned=0 # scan_time=72969 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\0XYP2VY9\mapg[1].exe Win32/Spy.Bebloh.H trojan (unable to clean) 00000000000000000000000000000000 I C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\0XYP2VY9\mapl[1].exe Win32/Spy.Bebloh.H trojan (unable to clean) 00000000000000000000000000000000 I C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\0XYP2VY9\mapp[1].exe a variant of Win32/Kryptik.QHO trojan (unable to clean) 00000000000000000000000000000000 I C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\65IRQR41\mapj[1].exe Win32/Spy.Bebloh.H trojan (unable to clean) 00000000000000000000000000000000 I C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\65IRQR41\mapn[1].exe a variant of Win32/Kryptik.PXN trojan (unable to clean) 00000000000000000000000000000000 I C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\65IRQR41\wueu[1].exe probably a variant of Win32/Kryptik.PDJ trojan (unable to clean) 00000000000000000000000000000000 I C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8F2X69WF\maph[1].exe a variant of Win32/Kryptik.QER trojan (unable to clean) 00000000000000000000000000000000 I C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\C3ETOJEX\mapk[1].exe a variant of Win32/Kryptik.QDF trojan (unable to clean) 00000000000000000000000000000000 I C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\C3ETOJEX\mapo[1].exe a variant of Win32/Kryptik.QHO trojan (unable to clean) 00000000000000000000000000000000 I C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\C3ETOJEX\wuev[1].exe Win32/Spy.Bebloh.H trojan (unable to clean) 00000000000000000000000000000000 I D:\Dateien\Computer\Boot-CD\ALKiD LiVE CD DVD USB 2008 10 10 - MiGEL\alkid.live.cd.usb.2008.10.10.iso multiple threats (unable to clean) 00000000000000000000000000000000 I D:\Dateien\Computer\Boot-CD\Hiren's BootCD\Hirens.BootCD.9.7.zip probably unknown NewHeur_PE virus (unable to clean) 00000000000000000000000000000000 I D:\Dateien\Computer\SYSTEM - Betriebssystem\ms_Windows\Server 2003\Windows Server 2003 R2 SP2 PL Enterprise Edition - appl.rar Win32/HackTool.Wpakill.A trojan (unable to clean) 00000000000000000000000000000000 I D:\Dateien\Computer\SYSTEM - Betriebssystem\ms_Windows\Windows 7\64Bit\bie764411g.iso a variant of Win32/HackKMS.A application (unable to clean) 00000000000000000000000000000000 I D:\Dateien\Computer\SYSTEM - Betriebssystem\ms_Windows\xp\xp Corporate Edition\MS Windows XP SP2 Audio Bundle v1 by JayAudio\WinAudioXPProSP2.iso probably a variant of Win32/Agent.IOCKSGQ trojan (unable to clean) 00000000000000000000000000000000 I D:\Dateien\Hardware\Speicher\USB\U3\USB Hacksaw.rar multiple threats (unable to clean) 00000000000000000000000000000000 I D:\Dateien\Hardware\Speicher\USB\U3\USB Switchblade.rar multiple threats (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Astrologie\[Astrology Software] Janus 4.1 + crack tsrh read nfo (VERY GOOD_WORKS FINE).rar probably a variant of Win32/Hupigon.HWUOGIX trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\CDVD\AnyDVD.rar probably a variant of Win32/Adware.Agent.GXIGJWO application (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\CDVD\CDCheck 3.1.11.0.rar probably a variant of Win32/SdBot.MZABKDA trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\CDVD\CD_COVER.rar a variant of Win32/Adware.NavExcel.AA application (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\CDVD\CloneDVD.rar multiple threats (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\CDVD\DAEMON Tools 3.47.rar probably a variant of Win32/Agent.CCLFVGJ trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\CDVD\BRENNSOFT\Nero\nero 7 keygen.rar a variant of Win32/Keygen.AW application (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\CDVD\Virtual CD 9.x\Virtual CD 9.1.rar probably a variant of Win32/Agent.KOUBGAH trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Dateienverwaltung\BRENNSOFT\Easy CD Cretaor\All_Roxio_Products [07-04-2003]_sn.zip probably a variant of Win32/Agent.HEOSFRE trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Dateienverwaltung\BRENNSOFT\Easy CD Cretaor\All_Roxio_Products [07-04-2003]_sn\application.exe probably a variant of Win32/Agent.HEOSFRE trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Dateienverwaltung\BRENNSOFT\Nero\Nero 7.0.8.2\Nero 7.0.8.2 All Products_sn\Nero7082KeygenUpdated.exe a variant of Win32/Keygen.AW application (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Dateienverwaltung\BRENNSOFT\Nero\Nero 7.0.8.2\Nero 7.0.8.2 All Products_sn\nero7keygen.exe a variant of Win32/Keygen.AW application (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Dateienverwaltung\BRENNSOFT\Nero\Nero 7.0.8.2\Nero 7.0.x_sn\Nero Premium Edition v7.0.5.4_sn\Keygen.exe probably a variant of Win32/Agent.HZREFUA trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Dateienverwaltung\EXPLORER\Captain Nemo Pro\Captain Nemo Pro 4.x.rar a variant of Win32/Keygen.AS application (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Dateienverwaltung\EXPLORER\Captain Nemo Pro\Captain Nemo Pro 5.rar a variant of Win32/Keygen.AS application (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Dateienverwaltung\EXPLORER\fastfolder\FastFolders v3.3.7_sn\ethff37a.exe a variant of Win32/TrojanDownloader.Small.NRS trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Dateienverwaltung\EXPLORER\fastfolder\FastFolders v3.3.7_sn\1\ethff37a.exe a variant of Win32/TrojanDownloader.Small.NRS trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Dateienverwaltung\IMAGE-Tools\DriveImage\Drive Image 7.01_sn\Drive Image 7.01_sn\keygen.exe probably a variant of Win32/Agent.FRJYSCV trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Dateienverwaltung\IMAGE-Tools\Norton Ghost 15\Norton Ghost 15 [PC ~ Multi]\Norton Ghost 15.iso a variant of Win32/Keygen.AC application (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Dateienverwaltung\IMAGE-Tools\Norton Ghost 15\Symantec Norton Ghost 15 Incl. Keymaker\ NGH150_AllWin_EnglishTryBuy30.exe Win32/TrojanDownloader.VB.PDW trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Dateienverwaltung\IMAGE-Tools\Norton Ghost 15\Symantec Norton Ghost 15 Incl. Keymaker\Symantec Norton Ghost 15 Incl. Keymaker - info.rar a variant of Win32/Keygen.AC application (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Dateienverwaltung\IMAGE-Tools\Norton Programme\Norton Ghost v10.0\Zwerg.zip probably a variant of Win32/Adware.Agent.GFRJHWV application (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Dateienverwaltung\IMAGE-Tools\Norton Programme\Norton Ghost v10.0\Norton Ghost v10.0_sn\patch (Worm.Mytob.FN).exe probably a variant of Win32/Adware.Agent.GFRJHWV application (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Dateienverwaltung\ISO\ISObuster\IsoBuster 1.9.1\IsoBuster Pro v1.9.1_sn\KeyMaker.exe probably a variant of Win32/Agent.DUPUPIA trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Dateienverwaltung\Migration-Tools\Migrate Easy - Acronis Migrate Easy.rar a variant of Win32/TrojanDownloader.Small.CJG trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Desktop\HyperSnap-DX.rar multiple threats (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\InterNet\SHARING\Get-Torrent-2.0.0.0-setup-0350.rar multiple threats (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\LernTools\Vokabeltrainer\VocProf - Vokabelarchiv.rar Win32/TrojanDownloader.Small.AOD trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Media\BS-Player.rar Win32/Adware.WhenU.SaveNow application (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Media\SAM Broadcaster.rar probably a variant of Win32/Agent.CVVGCYT trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Media\DFX\DFX Audio Enhancer 9.211 Plus • Incl New keygen CORE !! avast !!.rar probably a variant of Win32/Agent.IEXQNYI trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Media\Joiner\Quick AVI Joiner 2.0.rar probably a variant of Win32/Agent.SCGLOK trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Media\QuickTime\QuickTime 7.62.14 for Windows.rar a variant of Win32/Keygen.AR application (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Media\Video\Ulead Systems\VideoStudio 7.rar probably a variant of Win32/Agent.NCLTXKI trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Office\Office XP 2003\ms-Office XP 2003 - info & sn.rar probably a variant of Win32/Hupigon.DHMBFEX trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Recovery\GetDataBack (Runtime).rar multiple threats (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Recovery\Floppy Zip Disk Rescue\Floppy.Zip.Disk.Rescue.1.1.5.keygen.exe a variant of Win32/Kryptik.OOR trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Recovery\Floppy Zip Disk Rescue\Floppy.Zip.Disk.Rescue.1.1.5.keygen.zip a variant of Win32/Kryptik.OOR trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Security\HijackThis PRG\backups\backup-20100518-051203-294.dll Win32/Adware.Toolbar.Dealio application (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Security\HijackThis PRG\backups\backup-20100518-051203-934.dll Win32/Adware.Toolbar.Dealio application (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Security\InterNet u NETWORK\Hide IP Platinum\Hide IP Platinum v2.31\keygen.exe probably a variant of Win32/Agent.FHNLIHS trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Security\Online-Virenscanner von Spy-Shredder !! Vorsicht !!\Install1532.exe probably a variant of Win32/Adware.MalwareAlarm application (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Security\Passwortmanager\Password Finder\Password Finder 2.1\password.exe probably a variant of Win32/Adware.Agent.JNFXONZ application (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Security\Sniffer\z_PasswortCracker cain\Cain + DNLD´s +\cain20.exe +Virenanzeige via BitDefennder+\cain20.exe probably a variant of Win32/TrojanDropper.Agent.HZCMTKQ trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Security\Steganos Security Suite 7.0.7\Steganos Security Suite 7.0.7_sn\Steganos.Security.Suite.v7.0.7.WinALL.Incl.zip probably a variant of Win32/Keygen.BH application (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Security\Steganos Security Suite 7.0.7\Steganos Security Suite 7.0.7_sn\Steganos.Security.Suite.v7.0.7.WinALL.Incl.Keymaker\keygen.exe probably a variant of Win32/Keygen.BH application (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Security\Testvirus\eicar.0om.mwt Eicar test file (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Security\VIRENSCANNER\eScan\4.0.0.0_sn - nix funzen -\MicroWorld.eScan.v2003e.Anti-Virus.for.Windows.Incl.Keygen-SSG\kg.exe probably a variant of Win32/TrojanDropper.Small.MVLAJZA trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Security\VIRENSCANNER\eScan\eScan 2003_sn - invalid for v.6.4.1\MicroWorld eScan v2003e Internet Security for_Windows - invalid v.6.4.1\kg.exe probably a variant of Win32/TrojanDropper.Small.HBEDJRB trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Security\VIRENSCANNER\Testvirus\eicar.0om.mwt Eicar test file (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Security\__Pests\Blubster 2.5 - Audiogalaxy alternative [Sharing]\webHancer - kommt via Blubster\WebRebates4\webrebates.exe probably a variant of Win32/Adware.Agent.MKRNRKY application (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Serials\180 SERIALS, KEYS, KEYGENS\180 SERIALS, KEYS, KEYGENS.rar multiple threats (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Serials\Serials 2000\s2k.7.1.plus.zip probably a variant of Win32/Agent.LASNIHG trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\SoftwareVerwaltung\Total Uninstall\Total Uninstall 3.32_sn\WarezP2P_ADR.exe probably a variant of Win32/Downloader.Agent.EKFGZUY application (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Studio\Music-Tools\VST - Bundles\OhmForce VST Bundle pack.rar a variant of Win32/Keygen.AD application (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Studio\Music-Tools\VST - Bundles\Sonalksis All Plugins Bundle VST DX RTAS 2.0.rar probably a variant of Win32/Agent.HXZTDWX trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Studio\Music-Tools\VST - Bundles\T-Racks Delux-Sonnox Oxford-Namd Blue Tube.zip.zip probably a variant of Win32/Agent.CQKCWJE trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Studio\Music-Tools\vst Steinberg Cubase VST\Steinberg\Steinberg.VST.Plugin\Cubase VST\Cubase VST plugin pack (50 plugins).rar probably a variant of Win32/Agent.EZQICSC trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Studio\Music-Tools\vst Steinberg Cubase VST\Steinberg\Steinberg.VST.Plugin\Cubase VST\Cubase VST plugin pack (50 plugins).zip probably a variant of Win32/Agent.EZQICSC trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Studio\TonStudio\SteinbergClean[ALL]\Steinberg Clean v4.0\Clean.v4.0.iso Win32/Virut.NBP virus (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\System\Diagnose\PerformanceTest.rar probably a variant of Win32/Agent.NXFRVPQ trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\System\Diagnose\Sisoft Sandra\SiSoftware Sandra Enterprise 2007 Multilingual Retail Incl Keymaker.rar probably a variant of Win32/Agent.BIDOUIY trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\System\Driver\DriverGenius 9 Professional.rar multiple threats (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\System\Driver\DriverGenius Pro Portable 9.0 (Met Serial) Nlt-Release.rar probably a variant of Win32/Agent.BJSCQS trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\System\Festplatten\Defragmentierung\O&O\O&O Defrag 11_sn.rar probably a variant of Win32/Agent.GEVVWVR trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\System\Festplatten\Defragmentierung\O&O\OO.Defrag.Pro.v11.0.3265.x64.Incl.Keymaker.rar probably a variant of Win32/Agent.GEVVWVR trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\System\Festplatten\Defragmentierung\O&O\OODefrag11Professional64Ger.build3265.rar probably a variant of Win32/Agent.GEVVWVR trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\System\Monitoring\WirelessMon 3.1.0.1004 (passmark).rar probably a variant of Win32/Agent.DVXZJJC trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\System\RAM-Tools\Clean Ram.rar Win32/Adware.ErrorRepairPro application (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\System\RAM-Tools\O&O CleverCache 6.1 Ger.rar probably a variant of Win32/Agent.GEVVWVR trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\System\Testprogramme\BurnInTest Professional edition 32 & 64-bit) - passmark.rar probably a variant of Win32/Agent.KZDDHON trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\System\Testprogramme\KeyboardTest 3.0 - passmark.rar probably a variant of Win32/Agent.LZYMXJR trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\System\Testprogramme\ModemTest 1.3 - PassMark.rar probably a variant of Win32/Agent.GNDZGCD trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\System\Testprogramme\TestLog - passmark.rar probably a variant of Win32/Agent.GTWUJKM trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\System\Testprogramme\3DMark - Der PC-Stresstest\3DMark06 (Build 1.1.0)\3DMark06 (Build 1.1.0) - info & sn.rar probably a variant of Win32/Agent.CCFADEX trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\System\Tuning\Tweak ui.rar probably a variant of Win32/IRCBot.BUQXPNA trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\System\Tuning\WinTools.net Ultimate Edition.rar probably a variant of Win32/SdBot.NLWLSTZ trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\System\Uninstaller\Revo Uninstaller Pro 2.1.0 !! cant get it to work properly !!.rar Win32/Packed.Autoit.E.Gen application (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\System\Unlocker 1.9.5 (heisig-it)\Unlocker 1.9.5 (heisig-it).rar Win32/Adware.ADON application (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Text\Foxit\Foxit.Reader.Pro.v3.1.4.1125.rar probably a variant of Win32/Rbot.HLRIYWE trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\Wohnen\Einrichtungsplaner\Room Arranger.rar probably a variant of Win32/Agent.BBRKFQS trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\z_acking\_dn dnlds_Bladez'99 Collection\Adobe Audition 1.0 sn.rar probably a variant of Win32/Agent.EDXHRHH trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\z_acking\_dn dnlds_Bladez'99 Collection\Bandwidth Monitor Pro v1.x sn.rar probably a variant of Win32/Agent.FDGVGKU trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\z_acking\_dn dnlds_Bladez'99 Collection\Borland xxx sn.rar probably a variant of Win32/Agent.JAKXYLX trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\z_acking\_dn dnlds_Bladez'99 Collection\CyberLink xxx sn.rar multiple threats (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\z_acking\_dn dnlds_Bladez'99 Collection\Extensis xxx sn.rar probably a variant of Win32/Agent.LGQXPUN trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\z_acking\_dn dnlds_Bladez'99 Collection\Flash - Tools sn.rar probably a variant of Win32/Agent.EANYPSH trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\z_acking\_dn dnlds_Bladez'99 Collection\Hex Workshop 4.23 sn.rar probably a variant of Win32/Agent.FNXSJAB trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\z_acking\_dn dnlds_Bladez'99 Collection\InstallShield xxx sn.rar probably a variant of Win32/Spy.Banker.EAXOSLG trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\z_acking\_dn dnlds_Bladez'99 Collection\Macromedia xxx sn.rar multiple threats (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\z_acking\_dn dnlds_Bladez'99 Collection\Microsoft Office 2003 Generic Fix (v2) sn.rar probably a variant of Win32/Hupigon.DHMBFEX trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\z_acking\_dn dnlds_Bladez'99 Collection\Pinnacle xxx sn.rar a variant of Win32/Keygen.BH application (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\z_acking\_dn dnlds_Bladez'99 Collection\Sony Sound Forge 7.0a sn.rar a variant of Win32/Keygen.AQ application (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\z_acking\_dn dnlds_Bladez'99 Collection\Total Commander 6.02 sn.rar probably a variant of Win32/Agent.KIDJZMA trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\z_acking\_dn dnlds_Bladez'99 Collection\Ulead xxx sn.rar probably a variant of Win32/Agent.LAIIWSA trojan (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\z_acking\_dn dnlds_Bladez'99 Collection\DVD xxx sn\ag-dxxxpa.zip a variant of Win32/Keygen.AF application (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\_Virtuelle Laufwerke\VirtualCD\Virtual CD_sn\Virtual CD File Server v7.1.0.3_sn\keygen.exe a variant of Win32/Keygen.AG application (unable to clean) 00000000000000000000000000000000 I D:\Programme 03\_Virtuelle Laufwerke\VirtualCD\Virtual CD_sn\Virtual CD Terminal Server v7.1.0.2_sn\Virtual.CD.Terminal.Server.v7.1.0.2.Win2K2K3.Incl.Keymaker-CORE\keygen.exe a variant of Win32/Keygen.AG application (unable to clean) 00000000000000000000000000000000 I F:\Dateien\Computer\System - Betriebssystem\ms_Windows\Windows 7\64Bit\Enterprise\Windows.7.Enterprise.x64.SP1.Integrated.April.2011.GERMAN-BIE (bitreactor.to)\bie764411g.iso a variant of Win32/HackKMS.A application (unable to clean) 00000000000000000000000000000000 I F:\Dateien\Computer\System - Betriebssystem\ms_Windows\XP\xp Corporate Edition\Retestrak.XP.SP2.Final.iso multiple threats (unable to clean) 00000000000000000000000000000000 I F:\Dateien\Computer\System - Betriebssystem\ms_Windows\XP\xp Corporate Edition\Black XP Full\BLACK_XP_81 GLASS_LITE_.iso multiple threats (unable to clean) 00000000000000000000000000000000 I F:\DNLD\u-torrent complete\RobbingHood\Norton TrialReset 2010 v2.6NE (Nsane Edition by BOX!) [RH]\NTR2010.v2.6NE_[RH].rar Win32/Packed.Autoit.E.Gen application (unable to clean) 00000000000000000000000000000000 I F:\MACx\Programme 03 (red - SEA15_01)\Virtual Environment\Parallels Workstation2.2\Parallels.Workstation.v2.2.2222+KeyGen.rar a variant of Win32/Keygen.BN application (unable to clean) 00000000000000000000000000000000 I F:\Programme 03\Dateienverwaltung\MacDrive 8_x.rar multiple threats (unable to clean) 00000000000000000000000000000000 I F:\Programme 03\Dateienverwaltung\IMAGE-Tools\Norton Ghost\Norton Ghost 15 [PC ~ Multi]\Norton Ghost 15.iso a variant of Win32/Keygen.AC application (unable to clean) 00000000000000000000000000000000 I F:\Programme 03\Dateienverwaltung\IMAGE-Tools\Norton Ghost\Symantec Norton Ghost 15 Incl. Keymaker-CORE\ NGH150_AllWin_EnglishTryBuy30.exe Win32/TrojanDownloader.VB.PDW trojan (unable to clean) 00000000000000000000000000000000 I F:\Programme 03\Dateienverwaltung\IMAGE-Tools\Norton Ghost\Symantec Norton Ghost 15 Incl. Keymaker-CORE\Symantec Norton Ghost 15 Incl. Keymaker-CORE - info & sn.rar a variant of Win32/Keygen.AC application (unable to clean) 00000000000000000000000000000000 I F:\Programme 03\Dateienverwaltung\IMAGE-Tools\Norton Ghost\Symantec Norton Ghost v15.0 Incl. Keymaker-CORE\ NGH150_AllWin_EnglishTryBuy30.exe probably a variant of Win32/TrojanDownloader.VB.OIY trojan (unable to clean) 00000000000000000000000000000000 I F:\Programme 03\Dateienverwaltung\Unlocker 1.9.0\Unlocker 1.9.0.rar Win32/Adware.ADON application (unable to clean) 00000000000000000000000000000000 I F:\Programme 03\Security\HijackThis PRG\backups\backup-20100518-051203-294.dll Win32/Adware.Toolbar.Dealio application (unable to clean) 00000000000000000000000000000000 I F:\Programme 03\Security\HijackThis PRG\backups\backup-20100518-051203-934.dll Win32/Adware.Toolbar.Dealio application (unable to clean) 00000000000000000000000000000000 I F:\Programme 03\Security\Password Recovery\John the Ripper password cracker.rar HackTool.John application (unable to clean) 00000000000000000000000000000000 I F:\Programme 03\Security\Password Recovery\Elcomsoft\Advanced Instant Messengers Password Recovery.rar probably a variant of Win32/Agent.NQTKWMV trojan (unable to clean) 00000000000000000000000000000000 I F:\Programme 03\Security\Password Recovery\Elcomsoft\Advanced Photo Recovery.rar multiple threats (unable to clean) 00000000000000000000000000000000 I F:\Programme 03\Security\Password Recovery\Elcomsoft\Advanced Registry Tracer.rar probably a variant of Win32/Agent.HYNVKHP trojan (unable to clean) 00000000000000000000000000000000 I F:\Programme 03\Security\Password Recovery\Elcomsoft\Advanced VBA Password Recovery.rar probably a variant of Win32/PSW.IM.TFFBGP trojan (unable to clean) 00000000000000000000000000000000 I F:\Programme 03\Security\Password Recovery\Elcomsoft\ElcomSoft Distributed Password Recovery.rar probably a variant of Win32/Agent.GWJOFKZ trojan (unable to clean) 00000000000000000000000000000000 I F:\Programme 03\Security\Password Recovery\Elcomsoft\Proactive Password Auditor.rar multiple threats (unable to clean) 00000000000000000000000000000000 I F:\Programme 03\Security\Password Recovery\Elcomsoft\ElcomSoft DreamPack Collection\ElcomSoft Password Recovery Studio 2008.exe probably a variant of Win32/Agent.JMQUQV trojan (unable to clean) 00000000000000000000000000000000 I F:\Programme 03\Security\_eeyebootroot\eeyebootroot.rar multiple threats (unable to clean) 00000000000000000000000000000000 I F:\Programme 03\Serials\180 SERIALS, KEYS, KEYGENS\180 SERIALS, KEYS, KEYGENS.rar multiple threats (unable to clean) 00000000000000000000000000000000 I F:\Programme 03\Serials\Serials 2000\s2k.7.1.plus.zip probably a variant of Win32/Agent.LASNIHG trojan (unable to clean) 00000000000000000000000000000000 I F:\Programme 03\System\Cleaning\Uniblue PowerSuite 2009 v2.0.1.4 (All Products) + Serial.zip a variant of Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I F:\Programme 03\Virtual Environment\Sandboxie_sn.rar a variant of Win32/Keygen.BN application (unable to clean) 00000000000000000000000000000000 I F:\red - SEA15_01\VST & Co (red - SEA15_01)\Helium Music Manager\Helium Music Manager.rar a variant of Win32/Keygen.AF application (unable to clean) 00000000000000000000000000000000 I F:\red - SEA15_01\VST & Co (red - SEA15_01)\iDrum\Izotope.iDrum.VSTi.RTAS.v1.7.1.Incl.Keygen-AiR.rar a variant of Win32/Keygen.AD application (unable to clean) 00000000000000000000000000000000 I F:\red - SEA15_01\VST & Co (red - SEA15_01)\Spectrasonics.Omnisphere.VSTi.AU.RTAS.v1.03f.PC.MAC.UPDATE.Incl.Keygen-AiR\Spectrasonics.Omnisphere.VSTi.AU.RTAS.v1.03f.PC.MAC.UPDATE.Incl.Keygen-AiR - info & sn.rar probably a variant of Win32/Agent.NLXQFGU trojan (unable to clean) 00000000000000000000000000000000 I Gruß, Tiger |
|
25.07.2011, 19:37
| #28 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | svchost.exe hat 100% Auslastung - vermute Trojaner Du hast ja ne "hübsche" Crack/Keygen Sammlung   Cracks/Keygens sind zu 99,9% gefährliche Schädlinge, mit denen man nicht spaßen sollte. Ausserdem sind diese illegal und wir unterstützen die Verwendung von geklauter Software nicht. Somit beschränkt sich der Support auf Anleitung zur kompletten Neuinstallation!! Dass illegale Cracks und Keygens im Wesentlichen dazu dienen, Malware zu verbreiten ist kein Geheimnis und muss jedem klar sein!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
25.07.2011, 23:14
| #29 |
| | svchost.exe hat 100% Auslastung - vermute Trojaner Keygens sind ausschließlich snadboxed ausgeführt worden, um Software zu testen, meistens auch sandboxed, und danach deinstalliert bzw. gelöscht. Mich insteressiert, wie bei aller Vorsicht sich diese Pest auf meinen Rechner plazieren konnte. Also: Welche Maleware hat wie seinen Weg gefuden, was gemacht, und was beabsichtigt. Gurß, Tiger |
|
26.07.2011, 08:47
| #30 | ||
| /// Winkelfunktion /// TB-Süch-Tiger™ | svchost.exe hat 100% Auslastung - vermute TrojanerZitat:
Zitat:
Sry aber wenn man Tonnen von stinkendem Müll absichtlich ausführt muss man sich nicht wundern, wenn irgendwann das System hinüber ist. Offensichtlich ist dir auch bewusst, welche Gefahr von illegaler Software ausgeht, sonst hätetst du ja nicht mit der Sandbox gearbeitet.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu svchost.exe hat 100% Auslastung - vermute Trojaner |
| .exe, 100%, 100% auslastung, auslastung, autostart, defogger, defogger_disable.log, disabled, reboot, required, svchost.exe, svchost.exe gmer rootkit, troja, trojane, trojaner, vermute, zunächst |
Linear-Darstellung
