| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Verdacht auf Torpig-TrojanerWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
08.05.2012, 20:15
| #1 |
| |  Verdacht auf Torpig-Trojaner Hallo zusammen, wurde heute von meiner Bank benachrichtigt, dass mein Rechner mit dem Trojaner Torpig infisziert sei. Es wurde speziell darauf hingewiesen, dass der MBR womöglich überschrieben wurde. Habe darauf mit MBRCheck geprüft aber schliesse aus dem Log, dass der MBR okay ist. Den Rechner habe ich erst vor Kurzem neu aufgesetzt. Ungewöhnlich ist, dass der Firefox teilweise extrem langsam ist oder sich sogar auch komplett aufhängt. Weiter scheint Windows mein Avira Antivir nicht zu erkennen - im Wartungscenter wird mir angegeben, dass keine Antivirensoftware auf dem PC ist. Hier nun die Logfiles ... Code:
ATTFilter MBRCheck, version 1.2.3
(c) 2010, AD
Command-line:
Windows Version: Windows 7 Home Premium Edition
Windows Information: Service Pack 1 (build 7601), 64-bit
Base Board Manufacturer: Gigabyte Technology Co., Ltd.
BIOS Manufacturer: Award Software International, Inc.
System Manufacturer: Gigabyte Technology Co., Ltd.
System Product Name: P43-ES3G
Logical Drives Mask: 0x000003fc
Kernel Drivers (total 193):
0x02C66000 \SystemRoot\system32\ntoskrnl.exe
0x02C1D000 \SystemRoot\system32\hal.dll
0x00BB1000 \SystemRoot\system32\kdcom.dll
0x00CD0000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x00D1F000 \SystemRoot\system32\PSHED.dll
0x00D33000 \SystemRoot\system32\CLFS.SYS
0x00C00000 \SystemRoot\system32\CI.dll
0x00EA3000 \SystemRoot\system32\drivers\Wdf01000.sys
0x00F47000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x00F56000 \SystemRoot\system32\drivers\ACPI.sys
0x00FAD000 \SystemRoot\system32\drivers\WMILIB.SYS
0x00FB6000 \SystemRoot\system32\drivers\msisadrv.sys
0x00FC0000 \SystemRoot\system32\drivers\pci.sys
0x00FF3000 \SystemRoot\system32\drivers\vdrvroot.sys
0x00E00000 \SystemRoot\System32\drivers\partmgr.sys
0x00E15000 \SystemRoot\system32\drivers\volmgr.sys
0x00E2A000 \SystemRoot\System32\drivers\volmgrx.sys
0x00E86000 \SystemRoot\system32\drivers\pciide.sys
0x00E8D000 \SystemRoot\system32\drivers\PCIIDEX.SYS
0x00D91000 \SystemRoot\system32\DRIVERS\vmci.sys
0x00DB1000 \SystemRoot\System32\drivers\mountmgr.sys
0x00DCB000 \SystemRoot\system32\drivers\atapi.sys
0x00DD4000 \SystemRoot\system32\drivers\ataport.SYS
0x00CC0000 \SystemRoot\system32\drivers\amdxata.sys
0x0106E000 \SystemRoot\system32\drivers\fltmgr.sys
0x010BA000 \SystemRoot\system32\drivers\fileinfo.sys
0x01206000 \SystemRoot\System32\Drivers\Ntfs.sys
0x010CE000 \SystemRoot\System32\Drivers\msrpc.sys
0x013A9000 \SystemRoot\System32\Drivers\ksecdd.sys
0x0112C000 \SystemRoot\System32\Drivers\cng.sys
0x013C4000 \SystemRoot\System32\drivers\pcw.sys
0x013D5000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x014F6000 \SystemRoot\system32\drivers\ndis.sys
0x01400000 \SystemRoot\system32\drivers\NETIO.SYS
0x01460000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x016AD000 \SystemRoot\System32\drivers\tcpip.sys
0x018B1000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x018FB000 \SystemRoot\system32\drivers\volsnap.sys
0x01947000 \SystemRoot\System32\Drivers\spldr.sys
0x0194F000 \SystemRoot\System32\drivers\rdyboost.sys
0x01989000 \SystemRoot\System32\Drivers\mup.sys
0x0199B000 \SystemRoot\System32\drivers\hwpolicy.sys
0x019A4000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x019DE000 \SystemRoot\system32\DRIVERS\disk.sys
0x01600000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x0148B000 \SystemRoot\system32\DRIVERS\dtsoftbus01.sys
0x01666000 \SystemRoot\system32\drivers\cdrom.sys
0x01690000 \SystemRoot\System32\Drivers\Null.SYS
0x01699000 \SystemRoot\System32\Drivers\Beep.SYS
0x014D4000 \SystemRoot\System32\drivers\vga.sys
0x0119E000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x014E2000 \SystemRoot\System32\drivers\watchdog.sys
0x016A0000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x019F4000 \SystemRoot\system32\drivers\rdpencdd.sys
0x015E9000 \SystemRoot\system32\drivers\rdprefmp.sys
0x015F2000 \SystemRoot\System32\Drivers\Msfs.SYS
0x013DF000 \SystemRoot\System32\Drivers\Npfs.SYS
0x011C3000 \SystemRoot\system32\DRIVERS\tdx.sys
0x013F0000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x06A5B000 \SystemRoot\system32\drivers\afd.sys
0x06AE4000 \SystemRoot\System32\DRIVERS\netbt.sys
0x06B29000 \SystemRoot\system32\drivers\ws2ifsl.sys
0x06B34000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x06B3D000 \SystemRoot\system32\DRIVERS\pacer.sys
0x06B63000 \SystemRoot\system32\DRIVERS\netbios.sys
0x06B72000 \SystemRoot\system32\DRIVERS\serial.sys
0x06B8F000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x06BAA000 \SystemRoot\system32\drivers\termdd.sys
0x06A00000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x06BBE000 \SystemRoot\system32\drivers\nsiproxy.sys
0x06BCA000 \SystemRoot\system32\drivers\mssmbios.sys
0x06BD5000 \SystemRoot\System32\drivers\discache.sys
0x01000000 \SystemRoot\System32\Drivers\dfsc.sys
0x06BE4000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x06BF5000 \SystemRoot\system32\DRIVERS\avkmgr.sys
0x01045000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x011E5000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x0F032000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
0x0FD50000 \SystemRoot\System32\Drivers\nvBridge.kmd
0x02C5F000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x02D53000 \SystemRoot\System32\drivers\dxgmms1.sys
0x02D99000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x02DA6000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x02C00000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x02C11000 \SystemRoot\system32\drivers\HDAudBus.sys
0x0FD55000 \SystemRoot\system32\DRIVERS\Rt64win7.sys
0x02C35000 \SystemRoot\system32\DRIVERS\serenum.sys
0x02C41000 \SystemRoot\system32\DRIVERS\parport.sys
0x0FD87000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x0FD94000 \SystemRoot\system32\drivers\CompositeBus.sys
0x0FDA4000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x0FDBA000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x0FDDE000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x0F000000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x06C8E000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x06CA9000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x06CCA000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x06CE4000 \SystemRoot\system32\drivers\kbdclass.sys
0x06CF3000 \SystemRoot\system32\drivers\mouclass.sys
0x06D02000 \SystemRoot\system32\drivers\swenum.sys
0x06D04000 \SystemRoot\system32\drivers\ks.sys
0x06D47000 \SystemRoot\system32\drivers\umbus.sys
0x06D59000 \SystemRoot\system32\DRIVERS\vmnetadapter.sys
0x06D61000 \SystemRoot\system32\DRIVERS\VMNET.SYS
0x06D6B000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x06DC5000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x06C00000 \SystemRoot\system32\drivers\HdAudio.sys
0x07C01000 \SystemRoot\system32\drivers\portcls.sys
0x07C3E000 \SystemRoot\system32\drivers\drmk.sys
0x07C60000 \SystemRoot\system32\drivers\ksthunk.sys
0x07C66000 \SystemRoot\System32\Drivers\crashdmp.sys
0x07C74000 \SystemRoot\System32\Drivers\dump_dumpata.sys
0x07C80000 \SystemRoot\System32\Drivers\dump_atapi.sys
0x07C89000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x00080000 \SystemRoot\System32\win32k.sys
0x07C9C000 \SystemRoot\System32\drivers\Dxapi.sys
0x07CA8000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0x07CC3000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x07CC5000 \SystemRoot\system32\DRIVERS\monitor.sys
0x07CD3000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x07CF0000 \SystemRoot\system32\drivers\hidusb.sys
0x07CFE000 \SystemRoot\system32\drivers\HIDCLASS.SYS
0x07D17000 \SystemRoot\system32\drivers\HIDPARSE.SYS
0x07D20000 \SystemRoot\system32\drivers\kbdhid.sys
0x07D2E000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x00420000 \SystemRoot\System32\TSDDD.dll
0x00620000 \SystemRoot\System32\cdd.dll
0x07D3B000 \SystemRoot\system32\drivers\luafv.sys
0x07D7E000 \SystemRoot\system32\drivers\WudfPf.sys
0x07D9F000 \SystemRoot\system32\DRIVERS\vmnetbridge.sys
0x07DB0000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x07DC5000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x07ABC000 \SystemRoot\system32\drivers\HTTP.sys
0x07B85000 \SystemRoot\System32\Drivers\fastfat.SYS
0x07BBB000 \SystemRoot\system32\DRIVERS\bowser.sys
0x07BD9000 \SystemRoot\System32\drivers\mpsdrv.sys
0x07A00000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x07A2D000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x07A7B000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x07A9F000 \??\C:\Windows\system32\drivers\hcmon.sys
0x07AAB000 \??\C:\Windows\system32\drivers\VMparport.sys
0x07DDD000 \??\C:\Windows\system32\drivers\vmx86.sys
0x082E1000 \SystemRoot\system32\drivers\peauth.sys
0x08387000 \SystemRoot\System32\Drivers\secdrv.SYS
0x08392000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x083C3000 \SystemRoot\System32\drivers\tcpipreg.sys
0x083D5000 \??\C:\Windows\system32\drivers\vmnetuserif.sys
0x083DF000 \SystemRoot\SysWOW64\drivers\vstor2-mntapi10-shared.sys
0x08200000 \SystemRoot\System32\DRIVERS\srv2.sys
0x086A7000 \SystemRoot\System32\DRIVERS\srv.sys
0x0873F000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
0x08600000 \SystemRoot\system32\DRIVERS\avipbb.sys
0x08627000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0x08647000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0x77450000 \Windows\System32\ntdll.dll
0x47C60000 \Windows\System32\smss.exe
0xFF770000 \Windows\System32\apisetschema.dll
0xFF3D0000 \Windows\System32\autochk.exe
0xFF730000 \Windows\System32\imm32.dll
0x77240000 \Windows\System32\iertutil.dll
0xFF710000 \Windows\System32\imagehlp.dll
0xFF600000 \Windows\System32\msctf.dll
0xFE870000 \Windows\System32\shell32.dll
0xFE7D0000 \Windows\System32\clbcatq.dll
0xFE5F0000 \Windows\System32\setupapi.dll
0xFE510000 \Windows\System32\oleaut32.dll
0x77140000 \Windows\System32\user32.dll
0xFE490000 \Windows\System32\shlwapi.dll
0xFE410000 \Windows\System32\difxapi.dll
0xFE340000 \Windows\System32\usp10.dll
0x77020000 \Windows\System32\kernel32.dll
0x76EC0000 \Windows\System32\wininet.dll
0xFE320000 \Windows\System32\sechost.dll
0xFE310000 \Windows\System32\lpk.dll
0xFE1E0000 \Windows\System32\rpcrt4.dll
0xFE180000 \Windows\System32\Wldap32.dll
0xFE0E0000 \Windows\System32\comdlg32.dll
0xFE070000 \Windows\System32\gdi32.dll
0xFDF90000 \Windows\System32\advapi32.dll
0xFDF80000 \Windows\System32\nsi.dll
0xFDD70000 \Windows\System32\ole32.dll
0x77620000 \Windows\System32\normaliz.dll
0x77610000 \Windows\System32\psapi.dll
0x76D70000 \Windows\System32\urlmon.dll
0xFDD20000 \Windows\System32\ws2_32.dll
0xFDC80000 \Windows\System32\msvcrt.dll
0xFDBE0000 \Windows\System32\comctl32.dll
0xFDBC0000 \Windows\System32\devobj.dll
0xFDB80000 \Windows\System32\wintrust.dll
0xFDA10000 \Windows\System32\crypt32.dll
0xFD9D0000 \Windows\System32\cfgmgr32.dll
0xFD960000 \Windows\System32\KernelBase.dll
0xFD950000 \Windows\System32\msasn1.dll
Processes (total 55):
0 System Idle Process
4 System
252 C:\Windows\System32\smss.exe
344 csrss.exe
404 C:\Windows\System32\wininit.exe
428 csrss.exe
464 C:\Windows\System32\services.exe
492 C:\Windows\System32\lsass.exe
500 C:\Windows\System32\lsm.exe
608 C:\Windows\System32\svchost.exe
692 C:\Windows\System32\nvvsvc.exe
732 C:\Windows\System32\svchost.exe
792 C:\Windows\System32\svchost.exe
816 C:\Windows\System32\winlogon.exe
860 C:\Windows\System32\svchost.exe
896 C:\Windows\System32\svchost.exe
272 C:\Windows\System32\svchost.exe
716 C:\Windows\System32\svchost.exe
1196 C:\Windows\System32\spoolsv.exe
1288 C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
1300 C:\Windows\System32\nvvsvc.exe
1396 C:\Windows\System32\svchost.exe
1548 C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
1628 C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1656 C:\Program Files\Bonjour\mDNSResponder.exe
1728 C:\Windows\System32\svchost.exe
2332 WUDFHost.exe
2560 C:\Windows\System32\taskhost.exe
2628 C:\Windows\System32\dwm.exe
2688 C:\Windows\explorer.exe
3020 C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
3052 C:\Program Files (x86)\iTunes\iTunesHelper.exe
2476 C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
2672 C:\Program Files\iPod\bin\iPodService.exe
432 C:\Windows\System32\SearchIndexer.exe
2372 C:\Program Files\Windows Media Player\wmpnetwk.exe
2420 C:\Windows\System32\svchost.exe
3208 C:\Windows\System32\svchost.exe
3552 C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
1468 C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
3764 C:\Windows\System32\svchost.exe
2396 C:\Program Files (x86)\Mozilla Firefox\firefox.exe
4028 C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
2548 C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
3096 C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
216 C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
980 C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
128 C:\Windows\System32\conhost.exe
2136 C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
3608 C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
4048 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
1144 C:\Windows\System32\audiodg.exe
4844 D:\Download\MBRCheck.exe
3396 C:\Windows\System32\conhost.exe
3716 C:\Windows\System32\dllhost.exe
\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`0c900000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000018`76900000 (NTFS)
PhysicalDrive0 Model Number: SAMSUNGHD753LJ, Rev: 1AA01118
Size Device Name MBR Status
--------------------------------------------
698 GB \\.\PhysicalDrive0 Windows 7 MBR code detected
SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79
Done!
Code:
ATTFilter .
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_31
Run by jonas at 20:44:21 on 2012-05-08
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.41.1031.18.4094.2948 [GMT 2:00]
.
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
C:\Windows\system32\conhost.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.ch/
uInternet Settings,ProxyOverride = *.local
mWinlogon: Userinit=userinit.exe
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
uRun: [Google Update] "C:\Users\jonas\AppData\Local\Google\Update\GoogleUpdate.exe" /c
mRun: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
mRunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: An OneNote s&enden - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
LSP: %SystemRoot%\system32\vsocklib.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{1C663C07-406B-43BC-ADED-C4F531C29C07} : DhcpNameServer = 164.128.36.34 164.128.76.39
TCP: Interfaces\{4DB7907D-ACBF-4D14-8830-EDC101084650} : DhcpNameServer = 192.168.1.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
{18DF081C-E8AD-4283-A596-FA578C2EBDC3}
{72853161-30C5-4D22-B7F9-0BBC1D38A37E}
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
{B4F3A835-0E21-4959-BA22-42B3008E02FF}
{DBC80044-A445-435b-BC74-9C25C1C588A9}
mRun-x64: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
mRunOnce-x64: [ Malwarebytes Anti-Malware ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
SEH-X64: {B5A7F190-DDA6-4420-B3BA-52453494E6CD}: Groove GFS Stub Execution Hook
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\jonas\AppData\Roaming\Mozilla\Firefox\Profiles\t2ygwyg7.default\
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
FF - plugin: C:\Users\jonas\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
FF - plugin: C:\Windows\system32\Wat\npWatWeb.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_233.dll
.
============= SERVICES / DRIVERS ===============
.
R1 avkmgr;avkmgr;C:\Windows\system32\DRIVERS\avkmgr.sys --> C:\Windows\system32\DRIVERS\avkmgr.sys [?]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\system32\DRIVERS\dtsoftbus01.sys --> C:\Windows\system32\DRIVERS\dtsoftbus01.sys [?]
R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-1-3 63928]
R2 AntiVirSchedulerService;Avira Planer;C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2012-3-19 86224]
R2 AntiVirService;Avira Echtzeit Scanner;C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2012-3-19 110032]
R2 avgntflt;avgntflt;C:\Windows\system32\DRIVERS\avgntflt.sys --> C:\Windows\system32\DRIVERS\avgntflt.sys [?]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-5-8 654408]
R2 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-3-22 2348352]
R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]
R3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-4-12 253088]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-6-12 31125880]
S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-5-2 129976]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]
S3 WatAdminSvc;Windows-Aktivierungstechnologieservice;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
S4 VMUSBArbService;VMware USB Arbitration Service;C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe [2011-8-29 846448]
S4 VMwareHostd;VMware Workstation Server;C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe [2011-11-13 11839488]
.
=============== Created Last 30 ================
.
2012-05-08 18:34:03 -------- d-----w- C:\Users\jonas\AppData\Roaming\Malwarebytes
2012-05-08 18:33:52 24904 ----a-w- C:\Windows\System32\drivers\mbam.sys
2012-05-08 18:33:52 -------- d-----w- C:\ProgramData\Malwarebytes
2012-05-08 18:33:52 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-05-08 18:33:39 69000 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{6897B81F-BED9-4001-A893-230C977F6F8C}\offreg.dll
2012-05-08 16:42:31 8917360 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{6897B81F-BED9-4001-A893-230C977F6F8C}\mpengine.dll
2012-05-08 16:34:05 119808 ----a-r- C:\Users\jonas\AppData\Roaming\Microsoft\Installer\{CCF298AF-9CE1-4B26-B251-486E98A34789}\icons.exe
2012-05-02 21:02:20 -------- d-----w- C:\Program Files (x86)\Mozilla Maintenance Service
2012-05-02 21:02:19 157352 ----a-w- C:\Program Files (x86)\Mozilla Firefox\maintenanceservice_installer.exe
2012-05-02 21:02:19 129976 ----a-w- C:\Program Files (x86)\Mozilla Firefox\maintenanceservice.exe
2012-04-27 14:31:53 -------- d-----w- C:\Program Files\iTunes
2012-04-27 14:31:53 -------- d-----w- C:\Program Files\iPod
2012-04-23 17:01:29 -------- d-----w- C:\Users\jonas\AppData\Local\Google
2012-04-23 17:01:10 -------- d-----w- C:\Users\jonas\AppData\Local\Deployment
2012-04-23 17:01:10 -------- d-----w- C:\Users\jonas\AppData\Local\Apps
2012-04-12 17:12:06 418464 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2012-04-11 16:48:33 81408 ----a-w- C:\Windows\System32\imagehlp.dll
2012-04-11 16:48:33 5120 ----a-w- C:\Windows\SysWow64\wmi.dll
2012-04-11 16:48:33 5120 ----a-w- C:\Windows\System32\wmi.dll
2012-04-11 16:48:33 23408 ----a-w- C:\Windows\System32\drivers\fs_rec.sys
2012-04-11 16:48:33 220672 ----a-w- C:\Windows\System32\wintrust.dll
2012-04-11 16:48:33 172544 ----a-w- C:\Windows\SysWow64\wintrust.dll
2012-04-11 16:48:33 159232 ----a-w- C:\Windows\SysWow64\imagehlp.dll
2012-04-09 14:45:05 -------- d-----w- C:\Users\jonas\AppData\Roaming\TeamViewer
.
==================== Find3M ====================
.
2012-05-08 16:40:54 98848 ----a-w- C:\Windows\System32\drivers\avgntflt.sys
2012-04-22 12:40:53 70304 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-04-01 13:14:55 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll
2012-03-20 07:22:48 175616 ----a-w- C:\Windows\System32\msclmd.dll
2012-03-20 07:22:48 152576 ----a-w- C:\Windows\SysWow64\msclmd.dll
2012-03-19 18:57:32 283200 ----a-w- C:\Windows\System32\drivers\dtsoftbus01.sys
2012-03-19 17:39:45 536870912 --sha-w- C:\WinPEpge.sys
2012-03-06 06:53:37 5559152 ----a-w- C:\Windows\System32\ntoskrnl.exe
2012-03-06 05:59:47 3968368 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2012-03-06 05:59:41 3913072 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2012-02-29 21:00:22 3089728 ----a-w- C:\Windows\System32\nvsvc64.dll
2012-02-29 21:00:09 6074176 ----a-w- C:\Windows\System32\nvcpl.dll
2012-02-29 20:59:47 889664 ----a-w- C:\Windows\System32\nvvsvc.exe
2012-02-29 20:59:47 63296 ----a-w- C:\Windows\System32\nvshext.dll
2012-02-29 20:59:47 2561856 ----a-w- C:\Windows\System32\nvsvcr.dll
2012-02-29 20:59:47 118080 ----a-w- C:\Windows\System32\nvmctray.dll
2012-02-28 06:56:48 2311168 ----a-w- C:\Windows\System32\jscript9.dll
2012-02-28 06:49:56 1390080 ----a-w- C:\Windows\System32\wininet.dll
2012-02-28 06:48:57 1493504 ----a-w- C:\Windows\System32\inetcpl.cpl
2012-02-28 06:42:55 2382848 ----a-w- C:\Windows\System32\mshtml.tlb
2012-02-28 01:18:55 1799168 ----a-w- C:\Windows\SysWow64\jscript9.dll
2012-02-28 01:11:21 1427456 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2012-02-28 01:11:07 1127424 ----a-w- C:\Windows\SysWow64\wininet.dll
2012-02-28 01:03:16 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2012-02-23 08:18:36 279656 ------w- C:\Windows\System32\MpSigStub.exe
2012-02-17 06:38:26 1031680 ----a-w- C:\Windows\System32\rdpcore.dll
2012-02-17 05:34:22 826880 ----a-w- C:\Windows\SysWow64\rdpcore.dll
2012-02-17 04:58:24 210944 ----a-w- C:\Windows\System32\drivers\rdpwd.sys
2012-02-17 04:57:32 23552 ----a-w- C:\Windows\System32\drivers\tdtcp.sys
2012-02-15 10:01:50 52736 ----a-w- C:\Windows\System32\drivers\usbaapl64.sys
2012-02-15 10:01:50 4547944 ----a-w- C:\Windows\System32\usbaaplrc.dll
2012-02-14 10:09:44 1070352 ----a-w- C:\Windows\SysWow64\MSCOMCTL.OCX
2012-02-10 06:36:07 1544192 ----a-w- C:\Windows\System32\DWrite.dll
2012-02-10 05:38:43 1077248 ----a-w- C:\Windows\SysWow64\DWrite.dll
.
============= FINISH: 20:44:54.74 ===============
Code:
ATTFilter . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-08-26.01) . Microsoft Windows 7 Home Premium Boot Device: \Device\HarddiskVolume1 Install Date: 19.03.2012 19:17:30 System Uptime: 08.05.2012 18:24:39 (2 hours ago) . Motherboard: Gigabyte Technology Co., Ltd. | | P43-ES3G Processor: Intel(R) Core(TM)2 Quad CPU Q8300 @ 2.50GHz | Socket 775 | 2500/333mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 98 GiB total, 54.529 GiB free. D: is FIXED (NTFS) - 601 GiB total, 175.602 GiB free. E: is CDROM () F: is Removable G: is Removable H: is Removable I: is Removable J: is CDROM () . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . No restore point in system. . ==== Installed Programs ====================== . Adobe Reader X (10.1.3) - Deutsch Apple Application Support Apple Software Update Avira Free Antivirus BalTax 2011 7.0.1 DAEMON Tools Lite Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition FileZilla Client 3.5.3 Google Chrome Hotfix für Microsoft Visual C# 2010 Express - DEU (KB2635973) IrfanView (remove only) Java Auto Updater Java(TM) 6 Update 31 JDownloader 0.9 Malwarebytes Anti-Malware Version 1.61.0.1400 Microsoft .NET Framework 4 Multi-Targeting Pack Microsoft Application Error Reporting Microsoft Office 2010 Service Pack 1 (SP1) Microsoft Office Access MUI (English) 2010 Microsoft Office Access Setup Metadata MUI (English) 2010 Microsoft Office Excel MUI (English) 2010 Microsoft Office Groove MUI (English) 2010 Microsoft Office InfoPath MUI (English) 2010 Microsoft Office OneNote MUI (English) 2010 Microsoft Office Outlook MUI (English) 2010 Microsoft Office PowerPoint MUI (English) 2010 Microsoft Office Professional Plus 2010 Microsoft Office Proof (English) 2010 Microsoft Office Proof (French) 2010 Microsoft Office Proof (Spanish) 2010 Microsoft Office Proofing (English) 2010 Microsoft Office Publisher MUI (English) 2010 Microsoft Office Shared MUI (English) 2010 Microsoft Office Shared Setup Metadata MUI (English) 2010 Microsoft Office Word MUI (English) 2010 Microsoft SQL Server 2008 R2 Management Objects Microsoft SQL Server Compact 3.5 SP2 DEU Microsoft SQL Server System CLR Types Microsoft Visual C# 2010 Express - DEU Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Visual C++ 2010 x86 Runtime - 10.0.40219 Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools Microsoft Visual Studio 2010 Service Pack 1 Mozilla Firefox 12.0 (x86 de) Mozilla Maintenance Service Notepad++ NVIDIA PhysX PSPad editor QuickTime Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368) Security Update for Microsoft .NET Framework 4 Extended (KB2487367) Security Update for Microsoft .NET Framework 4 Extended (KB2656351) Security Update for Microsoft Office 2010 (KB2553091) Security Update for Microsoft Office 2010 (KB2553096) Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2598039) 32-Bit Edition Security Update for Microsoft PowerPoint 2010 (KB2553185) 32-Bit Edition Security Update for Microsoft SharePoint Workspace 2010 (KB2566445) Security Update for Microsoft Visio Viewer 2010 (KB2597170) 32-Bit Edition tools-freebsd tools-linux tools-netware tools-solaris tools-windows tools-winPre2k Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) Update for Microsoft .NET Framework 4 Extended (KB2468871) Update for Microsoft .NET Framework 4 Extended (KB2533523) Update for Microsoft .NET Framework 4 Extended (KB2600217) Update for Microsoft Excel 2010 (KB2553439) 32-Bit Edition Update for Microsoft Office 2010 (KB2553065) Update for Microsoft Office 2010 (KB2553092) Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition Update for Microsoft Office 2010 (KB2553385) 32-Bit Edition Update for Microsoft Office 2010 (KB2566458) Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition Update for Microsoft Office 2010 (KB2597091) 32-Bit Edition Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition Update for Microsoft Outlook 2010 (KB2553248) 32-Bit Edition Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU VLC media player 2.0.1 VMware Workstation WampServer 2.2 Windows 7 USB/DVD Download Tool WinPcap 4.1.2 Wireshark 1.6.5 . ==== End Of File =========================== |
| Themen zu Verdacht auf Torpig-Trojaner |
| acrobat update, adobe, adobe flash player, antivir, avg, avira, bonjour, build 7601, cpu, defender, desktop, document, error, firefox, flash player, home, hook, langsam, log, mozilla, nvidia, nvidia update, outlook 2010, pdf, plug-in, realtek, scan, software, trojaner, visual studio, windows |
Baum-Darstellung