| |
| |||||||
Log-Analyse und Auswertung: svchost.exe hat 100% Auslastung - vermute TrojanerWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
21.07.2011, 14:00
| #1 |
 |  svchost.exe hat 100% Auslastung - vermute Trojaner ComboFix bleibt mit folgender Meldung stehen: ComboFix - Find3M - Konsolenmeldung: Bereite Logdatei vor. Starte keine anderen Programme, bevor ComboFix fertig ist. Ferner noch drei weitere Events: 1. (PopUp) CF26674.cfxxe - Corrupt File The file or directory C:\Qoobox is corrupt and unreadable. Please run the Chkdsk utility. 2. (Message) Cannot export C:\Qoobox\Quarantine\Registry_backups\AddRemove-Proactive System Password Recovery.reg.dat: Error opening the file. There may be a disk or file system error. 3. (Application Install - Security Warning) Name: AVM Fritz!Box USB-Fernanschluss From clickonce.avm.de Publisher: AVM ... GmbH [Instal] [Don't Install] Gruß Tiger |
|
21.07.2011, 14:13
| #2 | |
| | svchost.exe hat 100% Auslastung - vermute TrojanerZitat:
Combofix Logfile: Code:
ATTFilter ComboFix 11-07-21.02 - u 21.07.2011 13:46:45.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.49.1033.18.511.116 [GMT 2:00]
ausgeführt von:: c:\documents and settings\u\Desktop\ComboFix.exe
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\u\WINDOWS
c:\windows\explorer(2).exe
c:\windows\explorer(3).exe
c:\windows\IsUn0407.exe
c:\windows\system32\ctfmon(2).exe
c:\windows\system32\ctfmon(3).exe
c:\windows\system32\linkinfo(2).dll
c:\windows\system32\linkinfo(3).dll
c:\windows\system32\regsvr32(2).exe
c:\windows\system32\regsvr32(3).exe
c:\windows\system32\usp10(2).dll
c:\windows\unin0407.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2011-06-21 bis 2011-07-21 ))))))))))))))))))))))))))))))
.
.
2011-07-21 11:21 . 2011-07-21 11:21 -------- d-----w- C:\TDSSKiller_Quarantine
2011-07-17 09:39 . 2011-07-17 09:39 -------- d-----w- c:\windows\$$ 14.07.2011 10,3 MB (10.898.456 bytes)
2011-07-14 11:26 . 2011-07-14 11:26 54016 ----a-w- c:\windows\system32\drivers\slxv.sys
2011-07-12 06:46 . 2011-07-12 06:52 -------- d-----w- c:\documents and settings\u\Application Data\Smarty Uninstaller
2011-07-12 06:32 . 2011-07-12 06:32 -------- d-----w- c:\documents and settings\All Users\Application Data\IsolatedStorage
2011-07-12 06:30 . 2011-04-25 08:25 4603616 ----a-w- c:\windows\system32\DevComponents.DotNetBar2.dll
2011-06-28 09:04 . 2011-06-28 09:04 -------- d-----w- c:\documents and settings\u\Application Data\Malwarebytes
2011-06-28 09:04 . 2011-07-06 17:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-06-28 09:03 . 2011-06-28 09:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-06-28 09:03 . 2011-07-06 17:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-06-26 13:21 . 2011-06-26 13:21 11 ----a-w- C:\mbrfix.bat
2011-06-26 13:20 . 2011-06-26 13:04 89088 ----a-w- C:\mbr.exe
2011-06-26 13:12 . 2011-06-26 13:04 89088 ----a-w- c:\windows\system32\mbr.exe
2011-06-26 09:57 . 2011-06-26 09:57 -------- d-----w- c:\program files\Common Files\BitDefender
2011-06-26 09:54 . 2011-06-26 10:18 47358 ----a-w- c:\documents and settings\All Users\Application Data\bdinstall.bin
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-18 19:48 . 2011-05-21 18:48 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-02 14:02 . 2009-10-10 18:10 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-05-24 07:10 . 2011-05-24 07:10 119808 ----a-r- c:\documents and settings\u\Application Data\Microsoft\Installer\{CCF298AF-9CE1-4B26-B251-486E98A34789}\icons.exe
2011-05-02 15:31 . 2009-09-23 07:51 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 17:25 . 2009-10-10 18:10 151552 ----a-w- c:\windows\system32\schannel.dll
2011-04-29 16:19 . 2009-10-10 18:10 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-26 11:07 . 2009-10-10 18:10 33280 ----a-w- c:\windows\system32\csrsrv.dll
2011-04-26 11:07 . 2004-08-03 22:56 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-04-25 16:11 . 2004-08-03 22:56 916480 ----a-w- c:\windows\system32\wininet.dll
2011-04-25 16:11 . 2004-08-03 22:56 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2011-04-25 16:11 . 2004-08-03 22:56 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-04-25 12:01 . 2004-08-03 20:59 385024 ----a-w- c:\windows\system32\html.iec
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OODIIcon]
@="{14A94384-BBED-47ed-86C0-6BF63FD892D0}"
[HKEY_CLASSES_ROOT\CLSID\{14A94384-BBED-47ed-86C0-6BF63FD892D0}]
2010-09-01 00:21 111944 ----a-w- f:\programme 03\Dateienverwaltung\IMAGE-Tools\O&O DiskImage 5 Pro PRG\oodishi.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Vidalia"="REM" [X]
"LDM"="REM" [X]
"LogitechSoftwareUpdate"="REM" [X]
"SandboxieControl"="REM" [X]
"AVMUSBRemoteConnection"="REM" [X]
"PeerBlock"="REM" [X]
"SUPERAntiSpyware"="REM" [X]
"AVMUSBFernanschluss"="c:\documents and settings\u\Local Settings\Apps\2.0\3OEW5K9B.2D6\LW0Y1VBV.G0V\frit..tion_8488884cfbcefd60_0002.0002_8541bf1f4a1c673d\AVMAutoStart.exe" [2011-01-09 147456]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RemoteControl"="REM" [X]
"VC9Player"="REM" [X]
"AudioHQ"="REM" [X]
"Dell AIO Printer A920"="REM" [X]
"MacDrive 8 application"="REM" [X]
"Getting started with MacDrive 8"="REM" [X]
"AppleSyncNotifier"="REM" [X]
"OODefragTray"="REM" [X]
"QuickTime Task"="REM" [X]
"LogitechVideoRepair"="REM" [X]
"LogitechVideoTray"="REM" [X]
"LogitechGalleryRepair"="REM" [X]
"LogitechImageStudioTray"="REM" [X]
"AVMUSBRemoteConnection"="REM" [X]
"LVCOMSX"="REM" [X]
"RAMpage"="REM" [X]
"ABBYY Community Agent"="REM" [X]
"SunJavaUpdateSched"="REM" [X]
"TomTomHOME.exe"="REM" [X]
"OODITRAY.EXE"="REM" [X]
"Malwarebytes' Anti-Malware"="REM" [X]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
c:\documents and settings\u\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\Registry\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{EC654325-1273-C2A9-2B7C-45A29BCE2FBD}"= "c:\windows\system32\regsvr32.exe" [2008-04-14 11776]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\Security\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 13:21 548352 ----a-w- c:\program files\Security\SUPERAntiSpyware\SASWINLO.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0oodbs\0pgdfgsvc C 1
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Apple Mobile Device"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\InterNet\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\DSL\\FRITZ!DSL\\IGDCTRL.EXE"=
"c:\\Program Files\\DSL\\FRITZ!DSL\\FBOXUPD.EXE"=
"c:\\Program Files\\DSL\\FRITZ!DSL\\WebwaIgd.exe"=
"c:\\Documents and Settings\\u\\Local Settings\\Apps\\2.0\\XW5471ZK.4N3\\KZVHJ9MH.BZ7\\frit..tion_8488884cfbcefd60_0002.0001_f24dc39254641428\\fritzbox-usb-fernanschluss.exe"=
"c:\\Program Files\\Media\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Brwoser\\Opera\\opera.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\helpctr.exe"=
"c:\\Documents and Settings\\u\\Local Settings\\Apps\\2.0\\XW5471ZK.4N3\\KZVHJ9MH.BZ7\\frit..tion_8488884cfbcefd60_0002.0002_9409db79b3f040fd\\fritzbox-usb-fernanschluss.exe"=
"c:\\Documents and Settings\\u\\Local Settings\\Apps\\2.0\\3OEW5K9B.2D6\\LW0Y1VBV.G0V\\frit..tion_8488884cfbcefd60_0002.0002_8541bf1f4a1c673d\\fritzbox-usb-fernanschluss.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
R0 MDFSYSNT;MacDrive file system driver;c:\windows\system32\drivers\MDFSYSNT.SYS [07.10.2010 16:36 234160]
R0 MDPMGRNT;MacDrive partition driver;c:\windows\system32\drivers\MDPMGRNT.SYS [12.05.2010 15:51 29792]
R0 oodisr;O&O DiskImage Snapshot/Restore Driver;c:\windows\system32\drivers\oodisr.sys [01.09.2010 02:24 96336]
R0 oodisrh;oodisrh;c:\windows\system32\drivers\oodisrh.sys [01.09.2010 02:24 28752]
R0 oodivd;O&O DiskImage Virtual Devices Driver;c:\windows\system32\drivers\oodivd.sys [01.09.2010 02:24 171088]
R0 oodivdh;oodivdh;c:\windows\system32\drivers\oodivdh.sys [01.09.2010 02:24 31824]
R1 CBDisk;CBDisk;c:\windows\system32\drivers\CBDisk.sys [19.02.2010 10:17 57800]
R1 SASDIFSV;SASDIFSV;c:\program files\Security\SUPERAntiSpyware\sasdifsv.sys [04.09.2009 14:50 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\Security\SUPERAntiSpyware\SASKUTIL.SYS [04.09.2009 14:49 74480]
R1 vdrv9000;vdrv9000;c:\windows\system32\drivers\vdrv9000.sys [27.09.2009 11:08 113688]
R2 ABBYY.Licensing.FineReader.Corporate.10.0;ABBYY FineReader 10 CE Licensing Service;c:\program files\Common Files\ABBYY\FineReader\10.00\Licensing\CE\NetworkLicenseServer.exe [19.12.2009 02:06 814344]
R2 IGDCTRL;AVM IGD CTRL Service;c:\program files\DSL\FRITZ!DSL\IGDCTRL.EXE [28.07.2009 17:07 73528]
R2 MacDrive8Service;MacDrive 8 service;c:\program files\Mediafour\MacDrive 8\MacDrive8Service.exe [08.10.2010 13:11 131584]
R2 MBAMService;MBAMService;f:\programme 03\Security\Malwarebytes' Anti-Malware PRG\mbamservice.exe [28.06.2011 11:04 366640]
R2 OO DiskImage;OO DiskImage;f:\programme 03\Dateienverwaltung\IMAGE-Tools\O&O DiskImage 5 Pro PRG\oodiag.exe [01.09.2010 02:21 2811208]
R2 TomTomHOMEService;TomTomHOMEService;f:\programme 03\NaViGat\TomTom HOME 2 PRG\TomTomHOMEService.exe [22.04.2011 14:21 92592]
R2 VC9SecS;Virtual CD v9 Management Service;c:\program files\CDVD\Virtual CD v9\System\VC9SecS.exe [27.09.2009 11:08 132424]
R3 avmaudio;AVM Audio;c:\windows\system32\drivers\avmaudio.sys [15.11.2010 21:51 101248]
R3 avmaura;AVM USB-Fernanschluss;c:\windows\system32\drivers\avmaura.sys [14.12.2009 14:18 101248]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [28.06.2011 11:03 22712]
R3 SiSV;SiSV;c:\windows\system32\drivers\SiSV.sys [23.09.2009 11:46 50432]
S3 DRHARD;DRHARD;\??\c:\windows\system32\DRIVERS\DRHARD.SYS --> c:\windows\system32\DRIVERS\DRHARD.SYS [?]
S3 DrvSnSht;DrvSnSht;\??\c:\docume~1\u\LOCALS~1\Temp\RarSFX0\DrvSnSht.sys --> c:\docume~1\u\LOCALS~1\Temp\RarSFX0\DrvSnSht.sys [?]
S3 DYCD;DYCD;c:\docume~1\u\LOCALS~1\Temp\DYCD.exe --> c:\docume~1\u\LOCALS~1\Temp\DYCD.exe [?]
S3 EST_BusEnum;Network USB Device Bus;c:\windows\system32\DRIVERS\GenBus.sys --> c:\windows\system32\DRIVERS\GenBus.sys [?]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;f:\programme 03\System\Diagnose\everest ultimate 5.50 PRG\kerneld.wnt [08.08.2010 10:17 27760]
S3 HH9Help.sys;HH9Help.sys;c:\windows\system32\drivers\HH9Help.sys [27.09.2009 11:08 11392]
S3 KZ;KZ;c:\docume~1\u\LOCALS~1\Temp\KZ.exe --> c:\docume~1\u\LOCALS~1\Temp\KZ.exe [?]
S3 NUS_Bus;Network USB Server Bus;c:\windows\system32\DRIVERS\NUS_Bus.sys --> c:\windows\system32\DRIVERS\NUS_Bus.sys [?]
S3 OFI;OFI;c:\docume~1\u\LOCALS~1\Temp\OFI.exe --> c:\docume~1\u\LOCALS~1\Temp\OFI.exe [?]
S3 R-ImageDisk;R-ImageDisk;\??\c:\docume~1\u\LOCALS~1\Temp\RarSFX0\R-ImageDisk.sys --> c:\docume~1\u\LOCALS~1\Temp\RarSFX0\R-ImageDisk.sys [?]
S3 SASENUM;SASENUM;c:\program files\Security\SUPERAntiSpyware\SASENUM.SYS [04.09.2009 14:50 7408]
S4 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [23.09.2009 10:06 155136]
S4 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [23.09.2009 10:06 5248]
S4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys --> c:\windows\system32\Drivers\sptd.sys [?]
.
Inhalt des "geplante Tasks" Ordners
.
2011-07-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uInternet Settings,ProxyOverride = localhost
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: Interfaces\{185678A2-0AEE-47CC-A45E-4DA946872CD5}: NameServer = 192.168.178.2,192.168.1.1
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\u\Application Data\Mozilla\Firefox\Profiles\628zcihv.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1700389&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://web.de/
.
Supplementary scan did not complete!
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
ShellIconOverlayIdentifiers-MacDrive volume icons - (no file)
HKCU-Run-fsm - (no file)
HKU-Default-Run-FRITZ!protect - FwebProt.exe
AddRemove-Proactive System Password Recovery - f:\programme 03\Security\Password Recovery\Proactive System Password Recovery 6.3 PRG\uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-07-21 14:20
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet025\Services\EverestDriver]
"ImagePath"="\??\f:\programme 03\System\Diagnose\everest ultimate 5.50 PRG\kerneld.wnt"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•A~*]
"7040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•A~*]
"7040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG12.00.00.01PROFESSIONAL"="4FD49D6FF81D135EB21215C5ED4A6DEEAED657A5DE588A25C9A1AB6D011A763BB1CB5BCD2BDD65C39E66121CD8CC7FC37DAB15AF826801DE75FBC65C488D208E36EB79EDEA87CDEF18E3194091BD429B90CD1A5CE265D711EDD33FAE70C83AB2672EB0C8EB9FDDCD82845F35AF72D2B74157B6D49C135B761F0424D739A45EF9E7CE6CBBB3AE9C6A5304CB61A2C4C4817726F02AA23E4C6F89AA39313CFC985F6D4D4C889FC0837915647D8EA8912001B4DC024EB834DB00C12E7275E3306AFD3FECA2D3DF677F4E656A436BD73CDEE78C61589A7AC736D06F32FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933C038D530D6EB3452A2D97226D213B555A6A0AC4980AC7933C1CD94748BF0193B4BAE312D50697ACF33283995907088E4CC0C5C22C30C58338E8A46323715A8440CD0B1C3EC17A134B84050B9C44FE67AF92F0833FCB977500FBAF4F1F8265E96412BC950E467B3596E62704A9A8AEDDF5864898F64A5FDC6C965ADAB062A452F906C8CBF1A5BD201B70851C4BFBBF335A60FDCE315A198B67EF34F5E034D7C51D2A85E7E6094AFAB2A8C7B28D41DE25D58F353639B2304069AB6918A0D5D3881955778017F5D16A212B0CD776E903681943B0FBEF9C5935EC4DE7A37B1CEBF0C9B53EA3EB321E06E6C1AFCBA959BFE0DB8F308B22646ACAB5582686CF3366DFCD9DD96AE2C6FFE616CCE8D7EC866E431D28F8AF80C07499FD69C0C394BCFB0A7F89730530D7C760CF8BCDC50773F1F60A762B5D2878E792F0C0A692F237B0EA2D70A42ACEF9FDE46ABB497C60715FCD42D267E856C84DD14681059E259B99B47071F2BC25FD4652C53E94077D1FE5D098FF8ABD97EB82ECA1554896FC1B384344C271B9FDCBBC99C7375AFFDA233B53EAD5BD81CF91C3315ECDEF97024B2084AA1D41AD2D91ADEB941548F7ABB9191781DB2F69B8CC5CBF6822000893A277AB134C0006E40558EEBA7E4DD91D2190CFE234A4930566EE9BA1A6AC45F332342D3E4E57B09ECF9565D46ED6E6910ED585F3D4C67306FF494EDAB74C21CB35CDB5DCA230E3C2DB9C27DED96E7AE8F5B3A68184C3CF7E1D9E5E063D64E6D4F30D4C22D3C0EA847677B7FA56B458FE4CC0BAE1A4088692AC40BA822110984951C50B88CD7A47073F8B7DA28DCD3C192D3388A5A7F60E73B7EC81EFC866D978143873A97824F3A5B8DC24BE43FB8FB92A4C398A2492B5EFB7472DFBBFBC7DE88EB4484B52B60AEA163FD4EFCCAE879D19842B8F33DA4B6443A744DDA9D381A1102679A7FA4FD00585EDD28489CAF79B12CDC0E82625C63E3844C8C0B783409769362C1C22721DD89076ADFCF352B410701D101B32236D81CAD0C87B1FE06F206553C0581CD987FAF08BE4053F750979ADA"
"OOPM02.00.00.01PRO"="C01EF784985197BF2FE9927834CF903AB56B5DF2C55683AE73F4DFED3054DB8DE504291E35E4A3C7279B4A7BDDA4619A72A9295AA42653F67B7A941BF96C71F21AFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933C038D530D6EB3452A2D97226D213B555A6A0AC4980AC7933F72C947D7F9C8CAA05111E1F37AC9E7926B96B959B01106D929C4A65530A6C6253C71011DFB493B7B97F42141EEC3675E82951395377D148E886E539C9124748CCC4382A06697890EB5B7AC07CDCFE2B28AED5616892ED47C118F37EA15EA341C02B17CA93752BF9E8D5C93CB6F03285C24B93561FA3089AAF3FC7D19E3FAFE212F4DC85EEC6868E831BD9AC715773C19B754D7701B42A45455FDD66CAB97D162511DB00427FC33D92C3F3CF1BEA45739C95E634D901C11E1DCC5103F3040518E4E389F77B7283C5F1608AF45FC01081AE876992B8F6A1D3D1D2E6022A8E1FF83FC2033BCD2BC73EFD762F01349D2127441D02ABF23A7C63062F815043760B9D247906AD2E66F8121BFD9BEACFFD2871CE9C7F2D20226EA15E932E725791E93F0B46F546D717E17C2FE02B402C0F3944C63D5A571CBBF236812619FBC467C3EA6B5E5910476132922581DDA28A334D5828AD2A0088C46C9C1D811499AB37817F45665B2A409EFD376B325642EB804135728DAA12C731202663B29408F16EF2B4987B4A49475C3BA4F4BC5E6B1A4354BA29723D080329B674063C369A41B3C911EB2B9A33A85DC6E9B85BE0F81DF8AC9CD264E674A508BE80C014B536855F9CF1487861447096DFE8B03FED5AC6D35060FDE2D0FC605DA8964EA47556F0FBE5083C5AD96A72B0A855DB0BBA15A83B2DE2B65CC85AA6ECCA54EE4BFB0977CB82D8D83D642BC48A2ABA3C599CC01A4994509437BDDA322DDD30E8DAF0F0534337BBB3FE021BBFB4CD7659B3900AB6CB382C2C4C465EFCCA7F700418A3C3800B2ADEE672DA6704F465393D9BB6315EC6334E19681AD94924B0B00DBE864CC1FD64428F5FB84D7145220B7783D38932EF0161FCCC17D89A4E5761D3FB2F671BAED4BBCF808C23AFD21D441A55CDFB9B3180E2FAAEBD76380FBDC62FF05609D5614DF24C8467CDA87ED092BBEC3286C3AA7826B9B6B1E5AF640FF776355CB6008D8664308F7F4A095F1DF7F518B0361B2D10D2E581BD6A4F7ADDDF05D2400B69601862A8B632A6C5BCC44B699D1DB15440D3E22EA1CE5E2D37A03F3D452A33A83A81906608FC059297EFB438B4ED31669D34A4479A742E9FB2AEA90302E2739530A5E720FE039FEA9DA9B20987417F8D3506BC6865645DC4B5C787C06DD7A0CD894A350F110B3F0CB6E09684B8567DC728809FCC6FF67EFB428A94DFE09C2532C39A98F0240045F87BE9075C5A9020D84E41"
"OODEFRAG11.00.00.01WORKSTATION"="050A172766C93CD51A1B73499839E8B3602B36EAC1B3373819F49FE0A14422125FBC3151CC07498D44EE3A025530D08300197F69016C441D2E27EC1C0D0A95E09D82D7050978A796AC6E4DEAB793E773BD3CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B98089DB7CE019D40AA5CC038D530D6EB3452A6171C11EC38DE3DC493B4CA75EC26D2DB7F60928F63B77546440EF30497343BA9C8091C35C5CAE83E4F531B1A7225E91C838EB85F195000224AF00E8CAFC34D6BF2CB6F43726BA1482B222C0509C326D9C7D29A10F68CCC305FC573CC5688987D30BD7EBFEEC32E5B5AA68F2093FBBB176601556653872C18A1D3EFFE78DB2BD6C2376201DD11F9D5E3E84DF8878A933ACA73FC471A9FA3EC82E4C383185D484FC092A7FCF3532478A4F4DC436EF0CA8D3609983F49F56E9F4748A3DE4772E5A117314F537ACF81684CDCAED268F3B1BFBDA2A2FBF6F078080A51B6B930BEAEEF02764FC3CF8C19305EB3A2A2A69DCCE2C9A40ACF47BB6362B95519DD0DB001BE95C80FB163D6253D329310CFEEBA54EE967AB2B3F74306CD952FDB3D3074EF753895EDA8BB40175F7518419D1CDBB4BBB591F241D639E8CCB53E826A7B00C1E0A54A3AD4729A914EA56272EF1DD68E888C5A16B7C795C84883E4041DE90971B1EBDC3B06347EEBA09717575273C3B6F9D2CA5A79C291180ABB89CDB20689AC7BECC329324149B2D5F2DE15F23681B514945E740ED0AAFCC270173F2A7044D5B7E07A31F17199244EB26647228E2F47C0B4100A9F13A4CF0508FC2C27DDB704C1D180F302AB55B350A8DDF9D63BB35CD0E56437FDBD041F48BC2CDCF0962F82DA9E5A86436EA38A05F67A302A8D389AF4B2DE099B94932B691B9B8D75F5B24EA6798F713B4A708278957460DA6E28D9C2F60906107662EAA505C66E446D149B2F6B2B331264EC2C9ED00972CB55B6A53763712194514187A1B12DA31080644EDECC3D3C94F68BCACA47F7C68052573F2FFD2A4889A7C65DE4294F44B0C77B8308CC5A7035CF06D437EE072F2407449BEC1D4859F1914DFED9C935DCA26FF40A5C6F18AA06CE58F7818D7EF084A97963177065A6F23AF1B25145686D8537AF61F68A13B64369C1912ABFAAC51384B9F0B9769E795A6119EF7D22F86A9EF44EC253C8EA55C6A846B61875DCDB677688D7BF05960B94D8E666F539793B530F3997D0A8443D142B2F2E13F1685639F0B05BFDC3F18AB40AC5F6B6B87FBB3203997F35FDC516CE210973C8CD27C9E77A3FF32A31DB9AF26EE4359EA2A6BCE8E0E04BA86F1BFCBFCF22B64C7375C074AC83CDDF1D01D3A916366D714C8C024D4D40033777F382D31110DA9023B33A853894499B2C1340D723EE9BD660D343D4FE30E05165042D1B52"
"OODI05.00.00.01PRO"="AEFB99EB8688374AACF4BEF56AF43B13303EA62A4B8EA20CE8245C2A00955C4C5BC200A44D4D5E2F4A5174CBF64F3319EAF8DFE3A1E2E3CBF2B6F15C8170A745EE5485F5DA81ED35E772890652472DFBDD97BD3890C00C4114DD43EE2E67D393A2A4F2FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B98088EDD5E5BE2F6E6679DB7CE019D40AA5CC038D530D6EB3452828A876751751F709A631F29052EC0C8FBA5B3A5893D9F010A4B77D5411CD69EA6595125FE8EFBCB93CC8BEBA335D4B6D6610E30527E993BB818B23EB254D0E44E241C88C630B1B4148EAC5DC6699EBF164000EF9A64291F2CCF78245589A6A9C520E2BBCE09DAFDC1D1A0C541FC2CE45A0565E4FC48E9799FE78AE32B55A52500996819A11A1470E8D7491BC4F40A1B670263C7F3D37C0A6D696C9319289E86936D32B32F3780C5F673CD8D67ACCAC8A621E102E105830819EFE57969C665EFB88D87CDC689C32D000B97FE27CF854A225D0AB28AAEA69AC52F031148475376CE8176E1210D8949BA9AD481E161D5708AC74CAC95F892DE3CEB958A4716442456E2D01B5814FEB20231F8625BB6D87E34035C75105DF4676A7D30495DF49978F6602BD969C1D4F354F2389C3B7932AC95C930C8E9AA833761D3AA6461F4B864793B5E343910C10A54160EE38CA887A7CBE60213F78575C9D4EE222893FD88CDCA4A88F08BCBFD6AC965371BBE94058E96BA53F9F1E105899E637613934EF68EFEF78A8D0D1449FA1FC1B7DE25E35775D93A66D0F48C72D93BDBCCD866F273754BC288BAC95F6396631D54F9771033649CECC1A48122828DCC158A62F6D1F345093DEBDBB6F6138D490097EFD1E5CE580CEFB1B27C987CEE95DF5EC91221EFB1360CE28BA8F521A1A705CFF4B189E3C07772C36D2CB42B3B80A1B7DEE86D6566F46BDD14DACDDC8A7ADA0F72FB6EB102D3394C7CBE12DE239A55CAA49095D3010BA812776AC295F15F462C87F7DFF9F2B69CE239C49EEA4B13858F54034F401362A5F8695B6FA2F8191DBF84CFFA05E0DD89E1B2319DA74D4055C2D79DA034240AD84F53923EDD32904BA96E15B11C8AA87F68AB5EA470361B79E350A1E53BAC31CD96CF5B71A3A2CECE8A80B9490FA59B12591A87212406C0BA368FB3CE661C30A114B2E39D564702BDC927945DAFD8DCEADC284C4FA7B3EFF7C49DDEDFC952808650FCBFAA5C8F7FBC9104E2D8D440BAC5DC36B2C2612610A058B510EEFE27BE4318E9E2D61E5CBC89CEEBC27F58EC23F20AD322633EBB293B03C817AAA1E4AE327D6429B1888655F0B3E9B7E69A622B57D54BE7EAAC45686098792B1053C734C1560DD1A00F580656B73AA9F77D1889697893336721089D3E329E657439835B72B9B97D5CA791343394CF63"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(844)
c:\program files\Security\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
c:\documents and settings\u\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
c:\documents and settings\u\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
.
- - - - - - - > 'explorer.exe'(3820)
c:\windows\system32\WININET.dll
f:\programme 03\Dateienverwaltung\IMAGE-Tools\O&O DiskImage 5 Pro PRG\oodishi.dll
f:\programme 03\Dateienverwaltung\IMAGE-Tools\O&O DiskImage 5 Pro PRG\oodishrs.dll
c:\program files\Mediafour\MacDrive 8\MDVolumeIcons.dll
c:\program files\Mediafour\MacDrive 8\MACDRAPI.DLL
c:\program files\Media\iTunes\iTunesMiniPlayer.dll
c:\program files\Media\iTunes\iTunesMiniPlayer.Resources\de.lproj\iTunesMiniPlayerLocalized.dll
c:\program files\Media\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\IEFRAME.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\msi.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
f:\programme 03\Dateienverwaltung\Unlocker 1.9.0\Unlocker 1.9.0 PRG\UnlockerCOM.dll
f:\programme 03\Security\Malwarebytes' Anti-Malware PRG\mbamext.dll
c:\program files\CDVD\Virtual CD v9\System\vc9extse.dll
c:\program files\CDVD\Virtual CD v9\System\vc9fwd.dll
c:\program files\CDVD\Virtual CD v9\System\vc9job.dll
c:\program files\CDVD\Virtual CD v9\System\VC9Env.dll
c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_b77cec8e\MFC80.DLL
c:\program files\CDVD\Virtual CD v9\System\vc9cvt.dll
c:\program files\CDVD\Virtual CD v9\System\VC9Scsi.dll
c:\program files\CDVD\Virtual CD v9\System\vc9perm.dll
c:\program files\CDVD\Virtual CD v9\System\vc9comm.dll
c:\program files\CDVD\Virtual CD v9\System\vc9prop.dll
c:\program files\CDVD\Virtual CD v9\System\hhfiledlg.dll
c:\program files\CDVD\Virtual CD v9\System\vc9op.dll
c:\program files\Dateienverwaltung\Packer\WinRAR PRG\rarext.dll
c:\progra~1\FESTPL~1\OOSOFT~1\DEFRAG~1\oodsh.dll
c:\progra~1\FESTPL~1\OOSOFT~1\DEFRAG~1\OODSHRS.DLL
f:\programme 03\Text\FineReader\FineReader 10 Corporate Edition PRG\FRIntegration.dll
c:\program files\DeskTop\Fences\FencesMenu.dll
c:\program files\Dateienverwaltung\Explorer\FastFolders PRG\FastFolders32.dll
c:\program files\Microsoft Office\OFFICE11\msohev.dll
c:\program files\Dateienverwaltung\Explorer\FastFolders PRG\FolderSize32.dll
c:\program files\Common Files\Mediafour\MACFPROP.DLL
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\oodag.exe
c:\program files\VirtualEnvironment\Sandboxie\SbieSvc.exe
c:\windows\system32\devldr32.exe
c:\windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-07-21 15:08:20 - PC wurde neu gestartet
.
Vor Suchlauf: 4.279.001.088 bytes free
Nach Suchlauf: 4.267.352.064 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - F34F9AE0DABFADCDF445161F0021C590
Gruß Tiger |
|
| Themen zu svchost.exe hat 100% Auslastung - vermute Trojaner |
| .exe, 100%, 100% auslastung, auslastung, autostart, defogger, defogger_disable.log, disabled, reboot, required, svchost.exe, svchost.exe gmer rootkit, troja, trojane, trojaner, vermute, zunächst |
Hybrid-Darstellung
