Hallo,
Ich habe mir gestern beim surfen den anscheinend schon recht bekannten "50 Euro Virus" eingefangen. Ich kann nicht auf windows zugreifen bzw. eine meldung blockiert den Bildschirm, dass ich 50 Euro zahlen müsste um ein tolles verbessertes antivirenprogramm herunterzuladen.
Ich habe windows 7 jetzt im abgesicherten modus mit netzwerkzugriff laufen.
hier schonmal der defogger text:
Zitat:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 21:03 on 13/02/2012 (Chris)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
HKCU AEMON Tools Lite -> Removed
Checking for services/drivers...
SPTD -> Disabled
-=E.O.F=-
|
und die DDS.txt:
Zitat:
.
DDS (Ver_2011-08-26.01) - NTFSAMD64 NETWORK
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_27
Run by Chris at 21:08:49 on 2012-02-13
Microsoft Windows 7 Professional 6.1.7600.0.1252.49.1031.18.4095.3509 [GMT 1:00]
.
AV: AntiVir Desktop *Enabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: AntiVir Desktop *Enabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
.
============== Running Processes ===============
.
D:\Windows\system32\wininit.exe
D:\Windows\system32\lsm.exe
D:\Windows\system32\svchost.exe -k DcomLaunch
D:\Windows\system32\svchost.exe -k RPCSS
D:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
D:\Windows\system32\svchost.exe -k netsvcs
D:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
D:\Windows\system32\svchost.exe -k LocalService
D:\Windows\system32\svchost.exe -k NetworkService
D:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
D:\Windows\Explorer.EXE
D:\Windows\system32\ctfmon.exe
D:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
D:\Windows\System32\svchost.exe -k secsvcs
D:\Windows\SysWOW64\cmd.exe
D:\Windows\system32\conhost.exe
D:\Windows\SysWOW64\cscript.exe
D:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: softonic-de3 Toolbar: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - D:\Program Files (x86)\softonic-de3\prxtbsof2.dll
mURLSearchHooks: softonic-de3 Toolbar: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - D:\Program Files (x86)\softonic-de3\prxtbsof2.dll
mWinlogon: Userinit=userinit.exe
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - D:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - D:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: softonic-de3 Toolbar: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - D:\Program Files (x86)\softonic-de3\prxtbsof2.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - D:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: softonic-de3 Toolbar: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - D:\Program Files (x86)\softonic-de3\prxtbsof2.dll
uRun: [Sidebar] D:\Program Files\Windows Sidebar\sidebar.exe /autoRun
uRun: [ffdwnd] D:\Users\Chris\AppData\Local\Mozilla\Firefox\firefox.exe
mRun: [avgnt] "D:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
mRun: [Adobe Reader Speed Launcher] "D:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun: [Adobe ARM] "D:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [DivXUpdate] "D:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
mRun: [QuickTime Task] "D:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [SunJavaUpdateSched] "D:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [APSDaemon] "D:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [iTunesHelper] "D:\Program Files (x86)\iTunes\iTunesHelper.exe"
StartupFolder: D:\Users\Chris\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - D:\Users\Chris\AppData\Roaming\Dropbox\bin\Dropbox.exe
StartupFolder: D:\Users\Chris\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\OPENOF~1.LNK - D:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Free YouTube to Mp3 Converter - D:\Users\Chris\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{6970BF84-60EE-41B4-9610-FDDC3378A407} : DhcpNameServer = 192.168.2.1
{18DF081C-E8AD-4283-A596-FA578C2EBDC3}
{9030D464-4C02-4ABF-8ECC-5164760863C6}
{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}
{DBC80044-A445-435b-BC74-9C25C1C588A9}
{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}
mRun-x64: [avgnt] "D:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
mRun-x64: [Adobe Reader Speed Launcher] "D:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun-x64: [Adobe ARM] "D:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun-x64: [DivXUpdate] "D:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
mRun-x64: [QuickTime Task] "D:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun-x64: [SunJavaUpdateSched] "D:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun-x64: [APSDaemon] "D:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun-x64: [iTunesHelper] "D:\Program Files (x86)\iTunes\iTunesHelper.exe"
.
================= FIREFOX ===================
.
FF - ProfilePath - D:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\874m2jf6.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2431245&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2431245&q=
FF - component: D:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\874m2jf6.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\FFExternalAlert.dll
FF - component: D:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\874m2jf6.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\RadioWMPCore.dll
FF - component: D:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\874m2jf6.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\components\FFExternalAlert.dll
FF - component: D:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\874m2jf6.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\components\RadioWMPCore.dll
FF - plugin: D:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
FF - plugin: D:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: D:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: D:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll
FF - plugin: D:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: D:\Program Files (x86)\Mozilla Firefox\plugins\np_gp.dll
FF - plugin: D:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: D:\Program Files (x86)\Mozilla Firefox\plugins\nppdf32.dll
FF - plugin: D:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
FF - plugin: D:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
FF - plugin: D:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
FF - plugin: D:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
FF - plugin: D:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
FF - plugin: D:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
FF - plugin: D:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
FF - plugin: D:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
FF - plugin: D:\Users\Chris\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: D:\Users\Chris\AppData\Roaming\Electronic Arts\Game Face\npGameFacePlugin.dll
FF - plugin: D:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
.
============= SERVICES / DRIVERS ===============
.
R3 RTL8167;Realtek 8167 NT-Treiber;D:\Windows\system32\DRIVERS\Rt64win7.sys --> D:\Windows\system32\DRIVERS\Rt64win7.sys [?]
S2 AMD External Events Utility;AMD External Events Utility;D:\Windows\system32\atiesrxx.exe --> D:\Windows\system32\atiesrxx.exe [?]
S2 AntiVirSchedulerService;Avira AntiVir Planer;D:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2010-6-10 136360]
S2 AntiVirService;Avira AntiVir Guard;D:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2010-6-10 269480]
S2 avgntflt;avgntflt;D:\Windows\system32\DRIVERS\avgntflt.sys --> D:\Windows\system32\DRIVERS\avgntflt.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;D:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;D:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google Update-Dienst (gupdate);D:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-9-16 136176]
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);D:\Windows\system32\DRIVERS\ssudbus.sys --> D:\Windows\system32\DRIVERS\ssudbus.sys [?]
S3 gupdatem;Google Update-Dienst (gupdatem);D:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-9-16 136176]
S3 SPC530;Philips SPC530NC PC Camera;D:\Windows\system32\drivers\SPC530.sys --> D:\Windows\system32\drivers\SPC530.sys [?]
S3 SPC530m;Philips SPC530NC PC Cameram;D:\Windows\system32\drivers\SPC530m.sys --> D:\Windows\system32\drivers\SPC530m.sys [?]
S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);D:\Windows\system32\DRIVERS\ssudmdm.sys --> D:\Windows\system32\DRIVERS\ssudmdm.sys [?]
S3 StorSvc;Speicherdienst;D:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-14 20992]
S3 USBAAPL64;Apple Mobile USB Driver;D:\Windows\system32\Drivers\usbaapl64.sys --> D:\Windows\system32\Drivers\usbaapl64.sys [?]
.
=============== File Associations ===============
.
regfile="regedit.exe" "%1"
.
=============== Created Last 30 ================
.
2012-02-11 20:59:49 -------- d-----w- D:\Users\Chris\AppData\Roaming\ts3overlay
2012-02-11 20:56:28 -------- d-----w- D:\Users\Chris\AppData\Roaming\TS3Client
2012-02-10 14:45:53 8602168 ----a-w- D:\ProgramData\Microsoft\Windows Defender\Definition Updates\{C055178B-A4D0-4306-A91F-D1CB408FCA45}\mpengine.dll
2012-02-02 17:47:00 -------- d-----w- D:\Users\Chris\AppData\Local\The Witcher 2
2012-01-17 19:06:41 -------- d-----w- D:\Program Files (x86)\jose
.
==================== Find3M ====================
.
2012-01-26 23:52:58 279656 ------w- D:\Windows\System32\MpSigStub.exe
2011-11-30 18:12:34 414368 ----a-w- D:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2011-11-24 21:23:32 203320 ----a-w- D:\Windows\System32\drivers\ssudmdm.sys
2011-11-24 21:23:28 98616 ----a-w- D:\Windows\System32\drivers\ssudbus.sys
2011-11-24 05:00:47 3141632 ----a-w- D:\Windows\System32\win32k.sys
2011-11-19 15:07:41 77312 ----a-w- D:\Windows\System32\packager.dll
2011-11-19 14:06:13 67072 ----a-w- D:\Windows\SysWow64\packager.dll
2011-11-17 07:17:03 152432 ----a-w- D:\Windows\System32\drivers\ksecpkg.sys
2011-11-17 07:17:02 95088 ----a-w- D:\Windows\System32\drivers\ksecdd.sys
2011-11-17 07:15:08 460296 ----a-w- D:\Windows\System32\drivers\cng.sys
2011-11-17 07:14:10 1739160 ----a-w- D:\Windows\System32\ntdll.dll
2011-11-17 07:12:02 395776 ----a-w- D:\Windows\System32\webio.dll
2011-11-17 07:11:33 28672 ----a-w- D:\Windows\System32\sspisrv.dll
2011-11-17 07:11:33 136192 ----a-w- D:\Windows\System32\sspicli.dll
2011-11-17 07:11:02 28160 ----a-w- D:\Windows\System32\secur32.dll
2011-11-17 07:10:58 340992 ----a-w- D:\Windows\System32\schannel.dll
2011-11-17 07:08:18 1446912 ----a-w- D:\Windows\System32\lsasrv.dll
2011-11-17 07:05:16 31232 ----a-w- D:\Windows\System32\lsass.exe
2011-11-17 05:41:38 1292592 ----a-w- D:\Windows\SysWow64\ntdll.dll
2011-11-17 05:39:28 314368 ----a-w- D:\Windows\SysWow64\webio.dll
2011-11-17 05:39:21 224768 ----a-w- D:\Windows\SysWow64\schannel.dll
2011-11-17 05:39:21 22016 ----a-w- D:\Windows\SysWow64\secur32.dll
2011-11-17 05:35:13 96768 ----a-w- D:\Windows\SysWow64\sspicli.dll
.
============= FINISH: 21:09:46,72 ===============
|
Ich würde mich echt freuen wenn ihr mir helfen könntet.
Danke schon mal im voraus
Gruß
ad0ntn0
13.02.2012, 21:33
Baum-Darstellung