| |
| |||||||
Log-Analyse und Auswertung: Suche Hilfe für Logauswertung "weißer Bildschirm mit Verbindungs-Meldung"Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
22.04.2012, 19:55
| #1 |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  Suche Hilfe für Logauswertung "weißer Bildschirm mit Verbindungs-Meldung" Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen. Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst. Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM! Downloade dir bitte  aswMBR.exe und speichere die Datei auf deinem Desktop.
Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none). Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes: Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
23.04.2012, 18:56
| #2 |
 | Suche Hilfe für Logauswertung "weißer Bildschirm mit Verbindungs-Meldung" Hi,
__________________also der GMER Scanner ist immer abgestürzt, da gibts also kein log. hier ist die log datei vom OSAM Scanner: Code:
ATTFilter Report of OSAM: Autorun Manager v5.0.11926.0 hxxp://www.online-solutions.ru/en/ Saved at 19:22:30 on 23.04.2012 OS: Windows XP Professional Service Pack 3 (Build 2600) Default Browser: Microsoft Corporation Internet Explorer 7.00.6000.17109 Scanner Settings [x] Rootkits detection (hidden registry) [x] Rootkits detection (hidden files) [x] Retrieve files information [x] Check Microsoft signatures Filters [ ] Trusted entries [ ] Empty entries [x] Hidden registry entries (rootkit activity) [x] Exclusively opened files [x] Not found files [x] Files without detailed information [x] Existing files [ ] Non-startable services [ ] Non-startable drivers [x] Active entries [x] Disabled entries [Boot Execute] -----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager )----- "BootExecute" - ? - C:\WINDOWS\system32\lsdelete.exe (File found, but it contains no detailed information) [Common] -----( %SystemRoot%\Tasks )----- "Ad-Aware Update (Weekly).job" - "Lavasoft Limited " - C:\Programme\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe "GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe "GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe [Control Panel Objects] -----( %SystemRoot%\system32 )----- "CMDVDPak.cpl" - "Sonic Solutions" - C:\WINDOWS\system32\CMDVDPak.cpl "infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl "javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl "stac97.cpl" - "SigmaTel, Inc." - C:\WINDOWS\system32\stac97.cpl -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )----- "Avira AntiVir Personal" - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl "QuickTime" - "Apple Computer, Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl [Drivers] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "AEGIS Protocol (IEEE 802.1x) v3.4.5.0" (AegisP) - "Meetinghouse Data Communications" - C:\WINDOWS\System32\DRIVERS\AegisP.sys (Hidden registry entry, rootkit activity) "AFD" (AFD) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\afd.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Asynchroner RAS -Medientreiber" (AsyncMac) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\asyncmac.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "ati2mtag" (ati2mtag) - "ATI Technologies Inc." - C:\WINDOWS\System32\DRIVERS\ati2mtag.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Audiostubtreiber" (audstub) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\audstub.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys (Hidden registry entry, rootkit activity) "avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys (Hidden registry entry, rootkit activity) "avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys (Hidden registry entry, rootkit activity) "Beep" (Beep) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Beep.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Bereitstellungspunkt-Manager" (MountMgr) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\MountMgr.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Brother MFC Serial Port Interface WDM Driver" (BrSerIf) - "Brother Industries Ltd." - C:\WINDOWS\System32\Drivers\BrSerIf.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Brother MFC USB Serial WDM Driver" (BrUsbSer) - "Brother Industries Ltd." - C:\WINDOWS\System32\Drivers\BrUsbSer.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Brother USB Still Image driver" (BrScnUsb) - "Brother Industries Ltd." - C:\WINDOWS\System32\DRIVERS\BrScnUsb.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "catchme" (catchme) - ? - C:\ComboFix\catchme.sys (Hidden registry entry, rootkit activity | File not found) "CD-ROM-Laufwerktreiber" (Cdrom) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\cdrom.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Cdaudio" (Cdaudio) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Cdaudio.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Cdfs" (Cdfs) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Cdfs.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "cercsr6" (cercsr6) - "Adaptec, Inc." - C:\WINDOWS\system32\drivers\cercsr6.sys (Hidden registry entry, rootkit activity) "Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys (Hidden registry entry, rootkit activity | File not found) "Creative AC3 Software Decoder" (ctac32k) - ? - C:\WINDOWS\System32\drivers\ctac32k.sys (Hidden registry entry, rootkit activity | File not found) "Creative DVD-Audio Device Driver" (ctdvda2k) - "Creative Technology Ltd" - C:\WINDOWS\System32\drivers\ctdvda2k.sys (Hidden registry entry, rootkit activity) "Creative OS Services Driver" (ossrv) - ? - C:\WINDOWS\System32\drivers\ctoss2k.sys (Hidden registry entry, rootkit activity | File not found) "Creative Proxy Driver" (ctprxy2k) - ? - C:\WINDOWS\System32\drivers\ctprxy2k.sys (Hidden registry entry, rootkit activity | File not found) "Creative SoundFont Management Device Driver" (ctsfm2k) - ? - C:\WINDOWS\System32\drivers\ctsfm2k.sys (Hidden registry entry, rootkit activity | File not found) "dmload" (dmload) - "Microsoft Corp., Veritas Software." - C:\WINDOWS\System32\drivers\dmload.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "E-mu Plug-in Architecture Driver" (emupia) - ? - C:\WINDOWS\System32\drivers\emupia2k.sys (Hidden registry entry, rootkit activity | File not found) "Fdc" (Fdc) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Fdc.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Filtertreiber für CD-Brennen" (Imapi) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\imapi.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Filtertreiber für digitale CD-Audiowiedergabe" (redbook) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\redbook.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Filtertreiber für IP-Verkehr" (IpFilterDriver) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ipfltdrv.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Filtertreiber für IPX-Verkehr" (NwlnkFlt) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\nwlnkflt.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Filtertreiber für Systemwiederherstellung" (sr) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\sr.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Fips" (Fips) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Fips.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Flpydisk" (Flpydisk) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Flpydisk.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "FltMgr" (FltMgr) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\fltmgr.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Fs_Rec" (Fs_Rec) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Fs_Rec.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "HTTP" (HTTP) - "Microsoft Corporation" - C:\WINDOWS\System32\Drivers\HTTP.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys (Hidden registry entry, rootkit activity | File not found) "Intel AHCI Controller" (iastor) - "Intel Corporation" - C:\WINDOWS\System32\DRIVERS\iaStor.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Intel(R) PRO/1000 PCI Express Network Connection Driver" (e1express) - "Intel Corporation" - C:\WINDOWS\System32\DRIVERS\e1e5132.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Intel-Prozessortreiber" (intelppm) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\intelppm.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "IP/IP-Tunneltreiber" (IpInIp) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ipinip.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "IPSEC-Treiber" (IPSec) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ipsec.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "IPv6-Windows-Firewalltreiber" (Ip6Fw) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\ip6fw.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "IR-Enumeratordienst" (IRENUM) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\irenum.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "KSecDD" (KSecDD) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\KSecDD.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Laufwerktreiber" (Disk) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\disk.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Lavasoft helper driver" (Lavasoft Kernexplorer) - ? - C:\Programme\Lavasoft\Ad-Aware\KernExplorer.sys (Hidden registry entry, rootkit activity | File found, but it contains no detailed information) "Lbd" (Lbd) - "Lavasoft AB" - C:\WINDOWS\System32\DRIVERS\Lbd.sys (Hidden registry entry, rootkit activity) "lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys (Hidden registry entry, rootkit activity | File not found) "Maus-HID-Treiber" (mouhid) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\mouhid.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Mausklassentreiber" (Mouclass) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\mouclass.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\WINDOWS\system32\drivers\mbam.sys (Hidden registry entry, rootkit activity) "MHN-Treiber" (MHNDRV) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\mhndrv.sys (Hidden registry entry, rootkit activity) "Microcode Updatetreiber" (Update) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\update.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Microsoft ACPI-Treiber" (ACPI) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ACPI.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Microsoft HID Class-Treiber" (hidusb) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\hidusb.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Microsoft Kernel GS Wavetablesynthesizer" (swmidi) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\swmidi.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Microsoft Kernel-Audiosplitter" (splitter) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\splitter.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Microsoft Kernel-DLS-Synthesizer" (DMusic) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\DMusic.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Microsoft Kernel-DRM-Audioentschlüsselung" (drmkaud) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\drmkaud.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Microsoft Kernel-Echounterdrückung" (aec) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\aec.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Microsoft Kernel-Systemaudiogerät" (sysaudio) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\sysaudio.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Microsoft Kernel-Waveaudiomixer" (kmixer) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\kmixer.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Microsoft Proxy für Streaming Clock" (MSPCLOCK) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\MSPCLOCK.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Microsoft Proxy für Streaming Quality Manager" (MSPQM) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\MSPQM.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Microsoft Standard-USB-Haupttreiber" (usbccgp) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\usbccgp.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Microsoft Streaming Service Proxy" (MSKSSRV) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\MSKSSRV.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Microsoft UAA-Bustreiber für High Definition Audio" (HDAudBus) - "Windows (R) Server 2003 DDK provider" - C:\WINDOWS\System32\DRIVERS\HDAudBus.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Microsoft USB-Druckerklasse" (usbprint) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\usbprint.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Microsoft USB-Standardhubtreiber" (usbhub) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\usbhub.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Microsoft-Systemverwaltungs-BIOS-Treiber" (mssmbios) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\mssmbios.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller" (usbehci) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\usbehci.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Miniporttreiber für universellen Microsoft USB-Hostcontroller" (usbuhci) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\usbuhci.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "mnmdd" (mnmdd) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\mnmdd.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Modem" (Modem) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Modem.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "MRXSMB" (MRxSmb) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\mrxsmb.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Msfs" (Msfs) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Msfs.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Mup" (Mup) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Mup.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "NDIS-Benutzermodus-E/A-Protokoll" (Ndisuio) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ndisuio.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "NDIS-Systemtreiber" (NDIS) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\NDIS.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "NDProxy" (NDProxy) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\NDProxy.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "NetBios über TCP/IP" (NetBT) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\netbt.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "NetBIOS-Schnittstelle" (NetBIOS) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\netbios.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver" (RTLWUSB) - "NETGEAR Inc." - C:\WINDOWS\System32\DRIVERS\wg111v2.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Npfs" (Npfs) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Npfs.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Ntfs" (Ntfs) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Ntfs.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Null" (Null) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Null.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Parallelanschluss (direkt)" (Raspti) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\raspti.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Parport" (Parport) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Parport.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Partitions-Manager" (PartMgr) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\PartMgr.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "ParVdm" (ParVdm) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\ParVdm.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "PCI-Bus-Treiber" (PCI) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\pci.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys (Hidden registry entry, rootkit activity | File not found) "PCIIde" (PCIIde) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\pciide.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys (Hidden registry entry, rootkit activity | File not found) "PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys (Hidden registry entry, rootkit activity | File not found) "PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys (Hidden registry entry, rootkit activity | File not found) "PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys (Hidden registry entry, rootkit activity | File not found) "PnP-ISA/EISA-Bus-Treiber" (isapnp) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\isapnp.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Protokoll für ATM ARP-Client" (Atmarpc) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\atmarpc.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "QoS-Paketplaner" (PSched) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\psched.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "RAS-IP-ARP-Treiber" (Wanarp) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\wanarp.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "RAS-NDIS-TAPI-Treiber" (NdisTapi) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ndistapi.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "RAS-NDIS-WAN-Treiber" (NdisWan) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ndiswan.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Rdbss" (Rdbss) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\rdbss.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "RDPCDD" (RDPCDD) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\RDPCDD.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "RDPWD" (RDPWD) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\RDPWD.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Redirector für WebDav-Client" (MRxDAV) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\mrxdav.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Remotezugriff-PPPOE-Treiber" (RasPppoe) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\raspppoe.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Secdrv" (Secdrv) - "Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K." - C:\WINDOWS\System32\DRIVERS\secdrv.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Serial" (Serial) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Serial.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Sfloppy" (Sfloppy) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\Sfloppy.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "SigmaTel High Definition Audio CODEC" (STHDA) - "SigmaTel, Inc." - C:\WINDOWS\System32\drivers\sthda.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Software-Bus-Treiber" (swenum) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\swenum.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Srv" (Srv) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\srv.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys (Hidden registry entry, rootkit activity) "Standard-IDE/ESDI-Festplattencontroller" (atapi) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\atapi.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Standardpaketklassifizierung" (Gpc) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\msgpc.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Tastatur-HID-Treiber" (kbdhid) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\kbdhid.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Tastaturklassentreiber" (Kbdclass) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\kbdclass.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "TCP/IP-Protokolltreiber" (Tcpip) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\tcpip.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "TDPIPE" (TDPIPE) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\TDPIPE.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "TDTCP" (TDTCP) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\TDTCP.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Terminal-Gerätetreiber" (TermDD) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\termdd.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Treiber für automatische RAS-Verbindung" (RasAcd) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\rasacd.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Treiber für die Verwaltung logischer Datenträger" (dmio) - "Microsoft Corp., Veritas Software" - C:\WINDOWS\System32\drivers\dmio.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Treiber für direkte Parallelverbindung" (Ptilink) - "Parallel Technologies, Inc." - C:\WINDOWS\System32\DRIVERS\ptilink.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Treiber für IPX-Verkehrsweiterleitung" (NwlnkFwd) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\nwlnkfwd.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Treiber für Microsoft WINMM-WDM-Audiokompatibilität" (wdmaud) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\wdmaud.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Treiber für Terminalserver-Geräteumleitung" (rdpdr) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\rdpdr.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Treiber für Volume-Manager" (Ftdisk) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ftdisk.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "ufqorfob" (ufqorfob) - ? - C:\DOKUME~1\THOMAS~1\LOKALE~1\Temp\ufqorfob.sys (Hidden registry entry, rootkit activity | File not found) "ufqorfod" (ufqorfod) - ? - C:\DOKUME~1\THOMAS~1\LOKALE~1\Temp\ufqorfod.sys (Hidden registry entry, rootkit activity | File not found) "USB-Massenspeichertreiber" (usbstor) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS (Hidden registry entry, rootkit activity | File signed by Microsoft) "VGA-Anzeigecontroller." (VgaSave) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\vga.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "VolSnap" (VolSnap) - "Microsoft Corporation" - C:\WINDOWS\system32\drivers\VolSnap.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "WAN-Miniport (L2TP)" (Rasl2tp) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\rasl2tp.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "WAN-Miniport (PPTP)" (PptpMiniport) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\raspptp.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys (Hidden registry entry, rootkit activity | File not found) "Windows Socket 2.0 Non-IFS Service Provider Support Environment" (WS2IFSL) - "Microsoft Corporation" - C:\WINDOWS\System32\drivers\ws2ifsl.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "WpdUsb" (WpdUsb) - "Microsoft Corporation" - C:\WINDOWS\System32\Drivers\wpdusb.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "Übersetzer für IP-Netzwerkadressen" (IpNat) - "Microsoft Corporation" - C:\WINDOWS\System32\DRIVERS\ipnat.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) [Explorer] -----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )----- >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} "Microsoft Windows Media Player" - "Microsoft Corporation" - C:\WINDOWS\inf\unregmp2.exe /ShowWMP {89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install -----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )----- {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll -----( HKLM\Software\Classes\Protocols\Filter )----- {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll {807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\MSOXMLMF.DLL -----( HKLM\Software\Classes\Protocols\Handler )----- {314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )----- {42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - (File not found | COM-object registry key not found) {1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? - (File not found | COM-object registry key not found) {42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office12\msohevi.dll {993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll {5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL {C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll {640167b4-59b0-47a6-b335-a6b3c0695aea} "Portable Media Devices" - "Microsoft Corporation" - C:\WINDOWS\system32\audiodev.dll {cc86590a-b60a-48e6-996b-41d25ed39a1e} "Portable Media Devices Menu" - "Microsoft Corporation" - C:\WINDOWS\system32\audiodev.dll {45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\shlext.dll {E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll {764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? - (File not found | COM-object registry key not found) {e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll {BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Web Folders" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\MSONSEXT.DLL {B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Programme\WinRAR\rarext.dll {F1B9284F-E9DC-4e68-9D7E-42362A59F0FD} "WMP Add To Playlist Launcher" - "Microsoft Corporation" - C:\WINDOWS\system32\wmpshell.dll {8DD448E6-C188-4aed-AF92-44956194EB1F} "WMP Burn Audio CD Launcher" - "Microsoft Corporation" - C:\WINDOWS\system32\wmpshell.dll {CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C} "WMP Play As Playlist Launcher" - "Microsoft Corporation" - C:\WINDOWS\system32\wmpshell.dll [Internet Explorer] -----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )----- <binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found) <binary data> "ITBarLayout" - ? - (File not found | COM-object registry key not found) -----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )----- {8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_27" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_27.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} "Java Plug-in 1.6.0_27" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_27.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_27" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_27.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab {D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Macromed\Flash\Flash10l.ocx / hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )----- {48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll {FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )----- {18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll {DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll {E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [Logon] -----( %AllUsersProfile%\Startmenü\Programme\Autostart )----- "desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini "NETGEAR WG111v2 Smart Wizard.lnk" - ? - C:\Programme\NETGEAR\WG111v2\WG111v2.exe (Shortcut exists | File exists) "NkbMonitor.exe.lnk" - "Nikon Corporation" - C:\Programme\Nikon\PictureProject\NkbMonitor.exe (Shortcut exists | File exists) -----( %UserProfile%\Startmenü\Programme\Autostart )----- "desktop.ini" - ? - C:\Dokumente und Einstellungen\T****\Startmenü\Programme\Autostart\desktop.ini -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )----- "Adobe ARM" - "Adobe Systems Incorporated" - "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" "ATIPTA" - "ATI Technologies, Inc." - "C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe" "avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min "DMXLauncher" - ? - C:\Programme\Dell\Media Experience\DMXLauncher.exe (File found, but it contains no detailed information) "Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray "QuickTime Task" - "Apple Computer, Inc." - "C:\Programme\QuickTime\qttask.exe" -atboottime "SigmatelSysTrayApp" - "SigmaTel, Inc." - stsystra.exe "SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [Print Monitors] -----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )----- "CUSTPDF Writer Monitor x86" - ? - C:\WINDOWS\system32\custmon32.dll (File found, but it contains no detailed information) "Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\msonpmon.dll [Services] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- ".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Hidden registry entry, rootkit activity) "Ablagemappe" (ClipSrv) - "Microsoft Corporation" - C:\WINDOWS\system32\clipsrv.exe (Hidden registry entry, rootkit activity | File signed by Microsoft) "Anmeldedienst" (Netlogon) - "Microsoft Corporation" - C:\WINDOWS\system32\lsass.exe (Hidden registry entry, rootkit activity | File signed by Microsoft) "Anwendungsverwaltung" (AppMgmt) - "Microsoft Corporation" - C:\WINDOWS\System32\appmgmts.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Arbeitsstationsdienst" (lanmanworkstation) - "Microsoft Corporation" - C:\WINDOWS\System32\wkssvc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Hidden registry entry, rootkit activity) "Ati HotKey Poller" (Ati HotKey Poller) - "ATI Technologies Inc." - C:\WINDOWS\system32\Ati2evxx.exe (Hidden registry entry, rootkit activity | File signed by Microsoft) "ATI Smart" (ATI Smart) - ? - C:\WINDOWS\system32\ati2sgag.exe (Hidden registry entry, rootkit activity) "Automatic Updates" (wuauserv) - "Microsoft Corporation" - C:\WINDOWS\system32\wuauserv.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Automatische Konfiguration (verkabelt)" (Dot3svc) - "Microsoft Corporation" - C:\WINDOWS\System32\dot3svc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Hidden registry entry, rootkit activity) "Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe (Hidden registry entry, rootkit activity) "COM+-Ereignissystem" (EventSystem) - "Microsoft Corporation" - C:\WINDOWS\system32\es.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "COM+-Systemanwendung" (COMSysApp) - "Microsoft Corporation" - C:\WINDOWS\system32\dllhost.exe (Hidden registry entry, rootkit activity | File signed by Microsoft) "Computerbrowser" (Browser) - "Microsoft Corporation" - C:\WINDOWS\System32\browser.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "CryptSvc" (CryptSvc) - "Microsoft Corporation" - C:\WINDOWS\System32\cryptsvc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "DCOM-Server-Prozessstart" (DcomLaunch) - "Microsoft Corporation" - C:\WINDOWS\system32\rpcss.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Designs" (Themes) - "Microsoft Corporation" - C:\WINDOWS\System32\shsvcs.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "DHCP-Client" (Dhcp) - "Microsoft Corporation" - C:\WINDOWS\System32\dhcpcsvc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Dienst für Seriennummern der tragbaren Medien" (WmdmPmSN) - "Microsoft Corporation" - C:\WINDOWS\system32\MsPMSNSv.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Distributed Transaction Coordinator" (MSDTC) - "Microsoft Corporation" - C:\WINDOWS\system32\msdtc.exe (Hidden registry entry, rootkit activity | File signed by Microsoft) "DNS-Client" (Dnscache) - "Microsoft Corporation" - C:\WINDOWS\System32\dnsrslvr.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Druckwarteschlange" (Spooler) - "Microsoft Corporation" - C:\WINDOWS\system32\spoolsv.exe (Hidden registry entry, rootkit activity | File signed by Microsoft) "Ereignisprotokoll" (Eventlog) - "Microsoft Corporation" - C:\WINDOWS\system32\services.exe (Hidden registry entry, rootkit activity | File signed by Microsoft) "Extensible Authentication-Protokolldienst" (EapHost) - "Microsoft Corporation" - C:\WINDOWS\System32\eapsvc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Fehlerberichterstattungsdienst" (ERSvc) - "Microsoft Corporation" - C:\WINDOWS\System32\ersvc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Gatewaydienst auf Anwendungsebene" (ALG) - "Microsoft Corporation" - C:\WINDOWS\System32\alg.exe (Hidden registry entry, rootkit activity | File signed by Microsoft) "Geschützter Speicher" (ProtectedStorage) - "Microsoft Corporation" - C:\WINDOWS\system32\lsass.exe (Hidden registry entry, rootkit activity | File signed by Microsoft) "Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe (Hidden registry entry, rootkit activity) "Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe (Hidden registry entry, rootkit activity) "Gupta SQLBase Advoware" (Gupta SQLBase Advoware) - "Gupta Technologies, LLC" - C:\AdvoWeb\Advoware\Server\dbntsrv.exe (Hidden registry entry, rootkit activity) "HID Input Service" (HidServ) - "Microsoft Corporation" - C:\WINDOWS\System32\hidserv.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Hilfe und Support" (helpsvc) - "Microsoft Corporation" - C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "HTTP-SSL" (HTTPFilter) - "Microsoft Corporation" - C:\WINDOWS\System32\w3ssl.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "IMAPI-CD-Brenn-COM-Dienste" (ImapiService) - "Microsoft Corporation" - C:\WINDOWS\system32\imapi.exe (Hidden registry entry, rootkit activity | File signed by Microsoft) "Indexdienst" (CiSvc) - "Microsoft Corporation" - C:\WINDOWS\system32\cisvc.exe (Hidden registry entry, rootkit activity | File signed by Microsoft) "InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe (Hidden registry entry, rootkit activity) "Integritätsschlüssel- und Zertifikatverwaltungsdienst" (hkmsvc) - "Microsoft Corporation" - C:\WINDOWS\System32\kmsvc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Intelligenter Hintergrundübertragungsdienst" (BITS) - "Microsoft Corporation" - C:\WINDOWS\system32\qmgr.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "IPSEC-Dienste" (PolicyAgent) - "Microsoft Corporation" - C:\WINDOWS\system32\lsass.exe (Hidden registry entry, rootkit activity | File signed by Microsoft) "Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe (Hidden registry entry, rootkit activity) "Kompatibilität für schnelle Benutzerumschaltung" (FastUserSwitchingCompatibility) - "Microsoft Corporation" - C:\WINDOWS\System32\shsvcs.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Konfigurationsfreie drahtlose Verbindung" (WZCSVC) - "Microsoft Corporation" - C:\WINDOWS\System32\wzcsvc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Lavasoft Ad-Aware Service" (Lavasoft Ad-Aware Service) - "Lavasoft Limited" - C:\Programme\Lavasoft\Ad-Aware\AAWService.exe (Hidden registry entry, rootkit activity) "Leistungsdatenprotokolle und Warnungen" (SysmonLog) - "Microsoft Corporation" - C:\WINDOWS\system32\smlogsvc.exe (Hidden registry entry, rootkit activity | File signed by Microsoft) "MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Hidden registry entry, rootkit activity) "Media Center Extender Service" (McrdSvc) - "Microsoft Corporation" - C:\WINDOWS\ehome\mcrdsvc.exe (Hidden registry entry, rootkit activity | File signed by Microsoft) "Media Center Receiver Service" (ehRecvr) - "Microsoft Corporation" - C:\WINDOWS\eHome\ehRecvr.exe (Hidden registry entry, rootkit activity | File signed by Microsoft) "Media Center-Planerdienst" (ehSched) - "Microsoft Corporation" - C:\WINDOWS\eHome\ehSched.exe (Hidden registry entry, rootkit activity | File signed by Microsoft) "MHN" (MHN) - "Microsoft Corporation" - C:\WINDOWS\System32\mhn.dll (Hidden registry entry, rootkit activity) "Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE (Hidden registry entry, rootkit activity) "MS Software Shadow Copy Provider" (SwPrv) - "Microsoft Corporation" - C:\WINDOWS\system32\dllhost.exe (Hidden registry entry, rootkit activity | File signed by Microsoft) "NAP-Agent (Network Access Protection)" (napagent) - "Microsoft Corporation" - C:\WINDOWS\System32\qagentrt.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "NetMeeting-Remotedesktop-Freigabe" (mnmsrvc) - "Microsoft Corporation" - C:\WINDOWS\system32\mnmsrvc.exe (Hidden registry entry, rootkit activity | File signed by Microsoft) "Netzwerkverbindungen" (Netman) - "Microsoft Corporation" - C:\WINDOWS\System32\netman.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Netzwerkversorgungsdienst" (xmlprov) - "Microsoft Corporation" - C:\WINDOWS\System32\xmlprov.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "NLA (Network Location Awareness)" (Nla) - "Microsoft Corporation" - C:\WINDOWS\System32\mswsock.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "NT-LM-Sicherheitsdienst" (NtLmSsp) - "Microsoft Corporation" - C:\WINDOWS\system32\lsass.exe (Hidden registry entry, rootkit activity | File signed by Microsoft) "Office Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Hidden registry entry, rootkit activity) "Plug & Play" (PlugPlay) - "Microsoft Corporation" - C:\WINDOWS\system32\services.exe (Hidden registry entry, rootkit activity | File signed by Microsoft) "QoS-RSVP" (RSVP) - "Microsoft Corporation" - C:\WINDOWS\system32\rsvp.exe (Hidden registry entry, rootkit activity | File signed by Microsoft) "RAS-Verbindungsverwaltung" (RasMan) - "Microsoft Corporation" - C:\WINDOWS\System32\rasmans.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Remote-Registrierung" (RemoteRegistry) - "Microsoft Corporation" - C:\WINDOWS\system32\regsvc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Remoteprozeduraufruf (RPC)" (RpcSs) - "Microsoft Corporation" - C:\WINDOWS\System32\rpcss.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "RPC-Locator" (RpcLocator) - "Microsoft Corporation" - C:\WINDOWS\system32\locator.exe (Hidden registry entry, rootkit activity | File signed by Microsoft) "Secondary Logon" (seclogon) - "Microsoft Corporation" - C:\WINDOWS\System32\seclogon.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Server" (lanmanserver) - "Microsoft Corporation" - C:\WINDOWS\System32\srvsvc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Shellhardwareerkennung" (ShellHWDetection) - "Microsoft Corporation" - C:\WINDOWS\System32\shsvcs.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Sicherheitscenter" (wscsvc) - "Microsoft Corporation" - C:\WINDOWS\system32\wscsvc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Sicherheitskontenverwaltung" (SamSs) - "Microsoft Corporation" - C:\WINDOWS\system32\lsass.exe (Hidden registry entry, rootkit activity | File signed by Microsoft) "Sitzungs-Manager für Remotedesktophilfe" (RDSessMgr) - "Microsoft Corporation" - C:\WINDOWS\system32\sessmgr.exe (Hidden registry entry, rootkit activity | File signed by Microsoft) "Smartcard" (SCardSvr) - "Microsoft Corporation" - C:\WINDOWS\System32\SCardSvr.exe (Hidden registry entry, rootkit activity | File signed by Microsoft) "SSDP Discovery Service" (SSDPSRV) - "Microsoft Corporation" - C:\WINDOWS\System32\ssdpsrv.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Systemereignisbenachrichtigung" (SENS) - "Microsoft Corporation" - C:\WINDOWS\system32\sens.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Systemwiederherstellungsdienst" (srservice) - "Microsoft Corporation" - C:\WINDOWS\system32\srsvc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Taskplaner" (Schedule) - "Microsoft Corporation" - C:\WINDOWS\system32\schedsvc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "TCP/IP-NetBIOS-Hilfsprogramm" (LmHosts) - "Microsoft Corporation" - C:\WINDOWS\System32\lmhsvc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Telefonie" (TapiSrv) - "Microsoft Corporation" - C:\WINDOWS\System32\tapisrv.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Telnet" (TlntSvr) - "Microsoft Corporation" - C:\WINDOWS\system32\tlntsvr.exe (Hidden registry entry, rootkit activity | File signed by Microsoft) "Terminaldienste" (TermService) - "Microsoft Corporation" - C:\WINDOWS\System32\termsrv.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Treibererweiterungen für Windows-Verwaltungsinstrumentation" (Wmi) - "Microsoft Corporation" - C:\WINDOWS\System32\advapi32.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Universeller Plug & Play-Gerätehost" (upnphost) - "Microsoft Corporation" - C:\WINDOWS\System32\upnphost.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Unterbrechungsfreie Stromversorgung" (UPS) - "Microsoft Corporation" - C:\WINDOWS\System32\ups.exe (Hidden registry entry, rootkit activity | File signed by Microsoft) "Verwaltung für automatische RAS-Verbindung" (RasAuto) - "Microsoft Corporation" - C:\WINDOWS\System32\rasauto.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Verwaltung logischer Datenträger" (dmserver) - "Microsoft Corp." - C:\WINDOWS\System32\dmserver.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Verwaltungsdienst für die Verwaltung logischer Datenträger" (dmadmin) - "Microsoft Corp., Veritas Software" - C:\WINDOWS\System32\dmadmin.exe (Hidden registry entry, rootkit activity | File signed by Microsoft) "Volumeschattenkopie" (VSS) - "Microsoft Corporation" - C:\WINDOWS\System32\vssvc.exe (Hidden registry entry, rootkit activity | File signed by Microsoft) "Webclient" (WebClient) - "Microsoft Corporation" - C:\WINDOWS\System32\webclnt.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Wechselmedien" (NtmsSvc) - "Microsoft Corporation" - C:\WINDOWS\system32\ntmssvc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Windows Audio" (AudioSrv) - "Microsoft Corporation" - C:\WINDOWS\System32\audiosrv.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Windows CardSpace" (idsvc) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (Hidden registry entry, rootkit activity) "Windows Installer" (MSIServer) - "Microsoft Corporation" - C:\WINDOWS\system32\msiexec.exe (Hidden registry entry, rootkit activity | File signed by Microsoft) "Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (Hidden registry entry, rootkit activity) "Windows User Mode Driver Framework" (UMWdf) - "Microsoft Corporation" - C:\WINDOWS\system32\wdfmgr.exe (Hidden registry entry, rootkit activity | File signed by Microsoft) "Windows-Bilderfassung (WIA)" (stisvc) - "Microsoft Corporation" - C:\WINDOWS\system32\wiaservc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Windows-Firewall/Gemeinsame Nutzung der Internetverbindung" (SharedAccess) - "Microsoft Corporation" - C:\WINDOWS\System32\ipnathlp.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Windows-Verwaltungsinstrumentation" (winmgmt) - "Microsoft Corporation" - C:\WINDOWS\system32\wbem\WMIsvc.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "Windows-Zeitgeber" (W32Time) - "Microsoft Corporation" - C:\WINDOWS\system32\w32time.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) "WMI-Leistungsadapter" (WmiApSrv) - "Microsoft Corporation" - C:\WINDOWS\system32\wbem\wmiapsrv.exe (Hidden registry entry, rootkit activity | File signed by Microsoft) "Überwachung verteilter Verknüpfungen (Client)" (TrkWks) - "Microsoft Corporation" - C:\WINDOWS\system32\trkwks.dll (Hidden registry entry, rootkit activity | File signed by Microsoft) [Winlogon] -----( HKCU\Control Panel\IOProcs )----- "MVB" - ? - mvfs32.dll (File not found) ===[ Logfile end ]=========================================[ Logfile end ]=== If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru und hier die Log-Datei von aswMBR: Code:
ATTFilter aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-04-23 19:25:39
-----------------------------
19:25:39.906 OS Version: Windows 5.1.2600 Service Pack 3
19:25:39.906 Number of processors: 2 586 0x403
19:25:39.906 ComputerName: THOMAS-8157C8E2 UserName:
19:25:40.234 Initialize success
19:34:33.640 AVAST engine defs: 12042300
19:35:00.593 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
19:35:00.593 Disk 0 Vendor: WDC_WD25 10.0 Size: 238418MB BusType: 3
19:35:00.609 Disk 0 MBR read successfully
19:35:00.609 Disk 0 MBR scan
19:35:00.656 Disk 0 Windows XP default MBR code
19:35:00.656 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 24999 MB offset 63
19:35:00.656 Disk 0 Partition - 00 0F Extended LBA 213410 MB offset 51199155
19:35:00.671 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 213410 MB offset 51199218
19:35:00.671 Disk 0 scanning sectors +488263545
19:35:00.765 Disk 0 scanning C:\WINDOWS\system32\drivers
19:35:11.109 Service scanning
19:35:22.875 Modules scanning
19:35:27.296 Disk 0 trace - called modules:
19:35:27.312 ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
19:35:27.328 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x894d8ab8]
19:35:27.328 3 CLASSPNP.SYS[ba0e8fd7] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x89dd0030]
19:35:27.687 AVAST engine scan C:\WINDOWS
19:35:43.359 AVAST engine scan C:\WINDOWS\system32
19:38:41.937 AVAST engine scan C:\WINDOWS\system32\drivers
19:38:57.593 AVAST engine scan C:\Dokumente und Einstellungen\T****
19:40:44.906 AVAST engine scan C:\Dokumente und Einstellungen\All Users
19:42:03.078 Scan finished successfully
19:44:16.531 Disk 0 MBR has been saved successfully to "D:\viren logs\MBR.dat"
19:44:16.562 The log file has been saved successfully to "D:\viren logs\aswMBR.txt"
 Vielen Dank & Gruß! |
|
| Themen zu Suche Hilfe für Logauswertung "weißer Bildschirm mit Verbindungs-Meldung" |
| 0x00000001, ad-aware, avira, bho, bildschirm, booten, computer, conduit, desktop, disabletaskmgr, error, excel, firefox, flash player, google earth, helper, logfile, microsoft office word, netgear, object, office 2007, otl-datei, plug-in, registry, remote control, rundll, scan, security, server, software, system, thomas, udp, usb 2.0, windows internet, windows xp |
Hybrid-Darstellung
