Bundespolizei Trojaner

 .DDS Logfile:

	
Code: 

Alles auswählenAufklappen 
ATTFilter

  
	
DDS (Ver_2011-08-26.01) - NTFSx86 NETWORK
Internet Explorer: 9.0.8112.16421  BrowserJavaVersion: 1.6.0_29
Run by DerMax at 23:55:37 on 2012-03-05
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.2038.1639 [GMT 1:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\Explorer.EXE
C:\Windows\system32\ctfmon.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uWindows: Load=c:\users\dermax\locals~1\temp\mstezl.com
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: Ciuvo: {8da04d15-6ab2-4e6f-95eb-e53b59f84001} - c:\program files\ciuvo\internet explorer\ciuvo.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "c:\program files\microsoft\bingbar\BingExt.dll"
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "c:\program files\microsoft\bingbar\BingExt.dll"
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: DisableCAD = 1 (0x1)
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\thinkpad\bluetooth software\btsendto_ie_ctx.htm
IE: Free YouTube to MP3 Converter - c:\users\dermax\appdata\roaming\dvdvideosoftiehelpers\freeyoutubetomp3converter.htm
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\thinkpad\bluetooth software\btsendto_ie.htm
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\thinkpad\bluetooth software\btsendto_ie.htm
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{26044DFF-C790-4EE2-B7D8-708BE61C21B0} : DhcpNameServer = 192.168.2.1
TCP: Interfaces\{26044DFF-C790-4EE2-B7D8-708BE61C21B0}\47F6D6 : DhcpNameServer = 192.168.2.1
TCP: Interfaces\{26044DFF-C790-4EE2-B7D8-708BE61C21B0}\84F4453505F445D2C424 : DhcpNameServer = 192.168.0.1 217.23.50.18
TCP: Interfaces\{26044DFF-C790-4EE2-B7D8-708BE61C21B0}\C424 : DhcpNameServer = 192.168.0.2
TCP: Interfaces\{26044DFF-C790-4EE2-B7D8-708BE61C21B0}\E4544534F4E4E4543445D283237383 : DhcpNameServer = 192.168.0.1
TCP: Interfaces\{43333426-84C7-43BE-A9EA-192DFAE1FC12} : DhcpNameServer = 192.168.2.1
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~2\common~1\skype\SKYPE4~1.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
Notify: igfxcui - igfxdev.dll
Notify: psfus - c:\program files\thinkvantage fingerprint software\psqlpwd.dll
LSA: Notification Packages = scecli psqlpwd c:\program files\thinkvantage fingerprint software\psqlpwd.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\dermax\appdata\roaming\mozilla\firefox\profiles\foct8zfa.default\
FF - prefs.js: browser.startup.homepage - chrome://superstart/content/index.html
FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.3.21.99\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.1.10111.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\veetle\player\npvlc.dll
FF - plugin: c:\program files\veetle\plugins\npVeetle.dll
FF - plugin: c:\program files\veetle\vlcbroadcast\npvbp.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\programdata\zylom\zylomgamesplayer\npzylomgamesplayer.dll
.
============= SERVICES / DRIVERS ===============
.
R0 DozeHDD;DozeHDD;c:\windows\system32\drivers\DOZEHDD.SYS [2011-6-26 25968]
R3 b57nd60x;Broadcom NetXtreme-Gigabit-Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000-Serie - Adaptertreiber für Windows Vista 32 Bit;c:\windows\system32\drivers\netw5v32.sys [2009-6-10 4231168]
S1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2009-6-19 165648]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-7-13 136176]
S2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\lenovo\hotkey\micmute.exe [2009-12-6 45424]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2012-1-5 1153368]
S2 smihlp2;SMI Helper Driver (smihlp2);c:\program files\thinkvantage fingerprint software\smihlp.sys [2009-3-13 12560]
S2 TPHKSVC;Anzeige am Bildschirm;c:\program files\lenovo\hotkey\TPHKSVC.exe [2009-12-6 62320]
S3 BBSvc;Bing Bar Update Service;c:\program files\microsoft\bingbar\BBSvc.EXE [2011-4-1 183560]
S3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2011-6-26 45736]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\drivers\btwl2cap.sys [2011-6-26 29472]
S3 DozeSvc;Lenovo Doze Mode Service;c:\program files\thinkpad\utilities\DOZESVC.EXE [2012-3-3 292200]
S3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-7-13 136176]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\drivers\MpNWMon.sys [2009-6-19 43392]
S3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\drivers\nx6000.sys [2009-7-25 30560]
S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2010-10-24 65024]
S3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\microsoft security client\antimalware\NisSrv.exe [2011-4-27 208944]
S3 Power Manager DBC Service;Power Manager DBC Service;c:\program files\thinkpad\utilities\PWMDBSVC.exe [2011-6-26 89152]
S3 PwmEWSvc;Cisco EnergyWise Enabler;c:\program files\thinkpad\utilities\PWMEWSVC.exe [2011-6-26 175168]
S3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\drivers\s1018bus.sys [2010-11-30 86824]
S3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\drivers\s1018mdfl.sys [2010-11-30 15016]
S3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\drivers\s1018mdm.sys [2010-11-30 114728]
S3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s1018mgmt.sys [2010-11-30 106208]
S3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\drivers\s1018nd5.sys [2010-11-30 26024]
S3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\drivers\s1018obex.sys [2010-11-30 104744]
S3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\drivers\s1018unic.sys [2010-11-30 109864]
S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\drivers\VSTAZL3.SYS [2009-7-13 207360]
S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\drivers\VSTDPV3.SYS [2009-7-13 980992]
S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\drivers\VSTCNXT3.SYS [2009-7-13 661504]
S3 StorSvc;Speicherdienst;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-14 20992]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-4-29 52224]
S3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\drivers\tvti2c.sys [2009-7-2 38336]
S3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\wat\WatAdminSvc.exe [2010-4-20 1343400]
S3 WMZuneComm;Zune Windows Mobile Connectivity Service;c:\program files\zune\WMZuneComm.exe [2011-8-5 268512]
S4 ApRunSvc;Alps Application Launcher Service;c:\program files\apoint2k\aprunsvc.exe --> c:\program files\apoint2k\ApRunSvc.exe [?]
S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-22 51040]
.
=============== Created Last 30 ================
.
2012-03-05 22:52:11	56200	----a-w-	c:\programdata\microsoft\microsoft antimalware\definition updates\{9e517992-005c-4d50-9252-0c1e5d807735}\offreg.dll
2012-03-05 21:45:28	--------	d-----w-	c:\windows\pss
2012-03-05 12:52:51	--------	d-----w-	c:\users\dermax\appdata\roaming\Malwarebytes
2012-03-05 12:52:43	20464	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-03-05 12:52:43	--------	d-----w-	c:\programdata\Malwarebytes
2012-03-05 12:52:43	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2012-03-05 09:59:20	6552120	----a-w-	c:\programdata\microsoft\microsoft antimalware\definition updates\{9e517992-005c-4d50-9252-0c1e5d807735}\mpengine.dll
2012-03-04 23:38:15	--------	d-----w-	c:\users\dermax\appdata\roaming\kodak
2012-02-26 14:47:40	--------	d-----w-	c:\users\dermax\appdata\local\{611118D6-AF1A-4D6B-8803-C6943733C627}
2012-02-26 14:47:36	--------	d-----w-	c:\users\dermax\appdata\local\{1627D735-51B9-4DC9-9E71-8211906634F0}
2012-02-15 07:39:47	478720	----a-w-	c:\windows\system32\timedate.cpl
2012-02-15 07:39:43	690688	----a-w-	c:\windows\system32\msvcrt.dll
2012-02-15 07:39:39	442880	----a-w-	c:\windows\system32\ntshrui.dll
2012-02-15 07:39:37	2343424	----a-w-	c:\windows\system32\win32k.sys
2012-02-14 12:22:09	--------	d-----w-	c:\users\dermax\appdata\local\{97D2F013-8FC9-40A8-9F22-AC60DDB0AD7F}
2012-02-14 12:22:05	--------	d-----w-	c:\users\dermax\appdata\local\{DE9AEA4E-7B00-414C-81D2-8E0C3CD98A0F}
2012-02-13 14:20:45	--------	d-----w-	c:\users\dermax\appdata\local\{C71B96EE-3C9E-404B-B6C7-8E1CA59C2629}
2012-02-13 14:20:41	--------	d-----w-	c:\users\dermax\appdata\local\{3ABA200C-5C25-47D7-A92D-0DAB3C8BCAC9}
2012-02-10 12:07:47	713784	------w-	c:\programdata\microsoft\microsoft antimalware\definition updates\{642cadaf-a371-49c3-b939-a6abdb1a11a1}\gapaengine.dll
2012-02-09 18:15:19	98304	----a-w-	c:\windows\system32\redmonnt.dll
2012-02-09 18:15:11	--------	d-----w-	c:\program files\FoxTabPDFConverter
2012-02-09 17:28:44	7680	----a-w-	c:\windows\system32\drivers\Onsreged.sys
2012-02-09 17:28:44	60928	----a-w-	c:\windows\system32\drivers\Smplscsi.sys
2012-02-09 17:28:44	285216	----a-w-	c:\windows\system32\drivers\Onsio.sys
2012-02-09 17:28:40	--------	d-----w-	C:\Kpcms
2012-02-09 17:28:35	--------	d-----w-	c:\program files\ScanWizard 5
2012-02-09 17:28:06	212992	----a-w-	c:\program files\common files\installshield\engine\6\intel 32\ILog.dll
.
==================== Find3M  ====================
.
2012-02-21 19:01:39	414368	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-01-31 12:44:05	237072	------w-	c:\windows\system32\MpSigStub.exe
2012-01-23 02:06:00	834624	------w-	c:\windows\system32\PWMCP32V.cpl
2012-01-23 02:06:00	527424	------w-	c:\windows\PWMBTHLV.EXE
2012-01-23 02:06:00	25968	------w-	c:\windows\system32\drivers\DOZEHDD.SYS
2012-01-23 02:06:00	13424	------w-	c:\windows\system32\drivers\TPPWR32V.SYS
2011-12-14 03:04:54	1798656	----a-w-	c:\windows\system32\jscript9.dll
2011-12-14 02:57:18	1127424	----a-w-	c:\windows\system32\wininet.dll
2011-12-14 02:56:58	1427456	----a-w-	c:\windows\system32\inetcpl.cpl
2011-12-14 02:50:04	2382848	----a-w-	c:\windows\system32\mshtml.tlb
.
============= FINISH: 23:57:10,98 ===============