| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Anfangs TR/Dropper.Gen, nun permanente Meldungen zu TR/Sirefef.AG.35, TR/ATRAPS.Gen2 und TR/Small.FIWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
21.06.2012, 15:59
| #31 |
 |  Anfangs TR/Dropper.Gen, nun permanente Meldungen zu TR/Sirefef.AG.35, TR/ATRAPS.Gen2 und TR/Small.FI Ich habe echt keinen Plan, wieso das beim letzten Mal nicht gleich so aussah... Hier das neue Logbuch: [code] Combofix Logfile: Code:
ATTFilter ComboFix 12-06-21.01 - XXXXX 21.06.2012 16:40:12.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.49.1031.18.1023.565 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\XXXXX\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Vorheriger Suchlauf -------
.
c:\dokumente und einstellungen\All Users\Anwendungsdaten\TEMP
c:\dokumente und einstellungen\All Users\Anwendungsdaten\TEMP\{5DB1DF0C-AABC-4362-8A6D-CEFDFB036E41}\PostBuild.exe
c:\dokumente und einstellungen\XXXXX\4.0
c:\dokumente und einstellungen\XXXXX\WINDOWS
c:\dokumente und einstellungen\XXXXX2\WINDOWS
c:\dokumente und einstellungen\XXXXX4\WINDOWS
c:\windows\Downloaded Program Files\Quarantine
c:\windows\IsUn0407.exe
c:\windows\System\SET2A.tmp
c:\windows\system32\is-IORRH.tmp
c:\windows\unin0407.exe
D:\install.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-05-21 bis 2012-06-21 ))))))))))))))))))))))))))))))
.
.
2012-06-21 09:24 . 2012-06-21 09:24 -------- d-----w- c:\windows\LastGood
2012-06-20 21:15 . 2012-06-20 21:15 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\SweetIM
2012-06-20 12:14 . 2012-06-20 19:17 -------- d-----w- c:\programme\SweetIM
2012-06-20 12:13 . 2012-06-20 12:13 -------- d-----w- c:\dokumente und einstellungen\XXXXX\Anwendungsdaten\pdfforge
2012-06-20 12:13 . 2004-03-08 23:00 662288 ----a-w- c:\windows\system32\MSCOMCT2.OCX
2012-06-20 12:13 . 1998-07-06 16:55 158208 ----a-w- c:\windows\system32\MSCMCDE.DLL
2012-06-20 12:13 . 1998-07-06 16:55 64512 ----a-w- c:\windows\system32\MSCC2DE.DLL
2012-06-20 12:13 . 1998-07-05 23:00 23552 ----a-w- c:\windows\system32\MSMPIDE.DLL
2012-06-20 12:13 . 2012-06-20 12:13 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Premium
2012-06-20 12:12 . 2012-06-20 12:13 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\InstallMate
2012-06-17 16:51 . 2012-06-17 16:51 -------- d-----w- c:\programme\Google
2012-06-14 17:23 . 2012-06-14 17:23 -------- d-----w- c:\programme\Lame For Audacity
2012-06-13 22:10 . 2012-06-13 22:10 -------- d-----w- C:\_OTL
2012-06-13 21:00 . 2012-05-11 14:40 521728 -c----w- c:\windows\system32\dllcache\jsdbgui.dll
2012-06-10 10:40 . 2012-06-14 17:47 -------- d-----w- c:\dokumente und einstellungen\XXXXX\Anwendungsdaten\Audacity
2012-06-09 14:11 . 2012-06-17 15:17 -------- d-----w- c:\programme\Opera Next
2012-06-09 10:07 . 2012-06-09 10:19 -------- d-----w- c:\dokumente und einstellungen\XXXXX\Anwendungsdaten\BullGuard
2012-06-09 10:06 . 2012-06-09 10:08 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\BullGuard
2012-06-09 10:06 . 2012-06-09 17:10 -------- d-----w- c:\programme\BullGuard Backup
2012-06-07 23:51 . 2012-06-07 23:51 -------- d-----w- c:\dokumente und einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\PCHealth
2012-06-07 15:01 . 2012-06-07 15:01 -------- d-----w- c:\dokumente und einstellungen\XXXXX\Anwendungsdaten\SUPERAntiSpyware.com
2012-06-07 15:01 . 2012-06-07 15:01 -------- d-----w- c:\programme\SUPERAntiSpyware
2012-06-07 15:01 . 2012-06-07 15:01 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com
2012-06-07 14:54 . 2012-06-07 14:54 -------- d-----w- c:\dokumente und einstellungen\XXXXX\Anwendungsdaten\ElevatedDiagnostics
2012-06-07 14:10 . 2012-06-07 14:10 -------- d-----w- c:\programme\Microsoft Download Manager
2012-06-07 13:40 . 2012-06-07 13:40 159744 ----a-w- c:\programme\Internet Explorer\PLUGINS\npqtplugin3.dll
2012-06-07 13:40 . 2012-06-07 13:40 159744 ----a-w- c:\programme\Internet Explorer\PLUGINS\npqtplugin2.dll
2012-06-07 13:40 . 2012-06-07 13:40 159744 ----a-w- c:\programme\Internet Explorer\PLUGINS\npqtplugin.dll
2012-06-07 12:59 . 2012-06-07 12:59 -------- d-----w- c:\dokumente und einstellungen\XXXXX\Lokale Einstellungen\Anwendungsdaten\Secunia PSI
2012-06-07 12:58 . 2012-06-07 14:18 -------- d-----w- c:\programme\Secunia_PSI
2012-05-26 20:58 . 2012-05-26 20:58 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\ATI
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-09 17:13 . 2012-04-06 14:23 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-06-09 17:13 . 2011-05-13 09:36 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-06-02 13:19 . 2007-08-24 11:43 15896 ----a-w- c:\windows\system32\wuapi.dll.mui
2012-06-02 13:19 . 2007-06-21 09:32 18456 ----a-w- c:\windows\system32\wuaueng.dll.mui
2012-06-02 13:19 . 2004-08-03 12:01 329240 ----a-w- c:\windows\system32\wucltui.dll
2012-06-02 13:19 . 2004-08-03 11:59 219160 ----a-w- c:\windows\system32\wuaucpl.cpl
2012-06-02 13:19 . 2004-08-03 11:59 210968 ----a-w- c:\windows\system32\wuweb.dll
2012-06-02 13:19 . 2007-06-21 09:32 15896 ----a-w- c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 13:19 . 2004-06-22 15:41 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-02 13:19 . 2004-06-22 15:36 97304 ----a-w- c:\windows\system32\cdm.dll
2012-06-02 13:19 . 2007-06-21 09:32 23576 ----a-w- c:\windows\system32\wucltui.dll.mui
2012-06-02 13:19 . 2004-08-03 12:06 577048 ----a-w- c:\windows\system32\wuapi.dll
2012-06-02 13:19 . 2004-06-22 15:41 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-02 13:18 . 2007-06-22 13:00 18160 ----a-w- c:\windows\system32\mucltui.dll.mui
2012-06-02 13:18 . 2006-11-18 16:24 275696 ----a-w- c:\windows\system32\mucltui.dll
2012-06-02 13:18 . 2005-05-26 02:19 214256 ----a-w- c:\windows\system32\muweb.dll
2012-05-31 13:22 . 2004-06-22 23:15 604160 ----a-w- c:\windows\system32\crypt32.dll
2012-05-26 19:55 . 2005-05-03 20:23 192512 ----a-w- c:\windows\system32\ati2evxx.dll
2012-05-26 19:55 . 2010-06-13 09:49 118784 ----a-w- c:\windows\system32\atibtmon.exe
2012-05-26 19:55 . 2005-05-03 19:52 888832 ----a-w- c:\windows\system32\ati2cqag.dll
2012-05-26 19:54 . 2009-02-04 05:03 638976 ----a-w- c:\windows\system32\atiok3x2.dll
2012-05-26 19:54 . 2005-05-03 20:24 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2012-05-26 19:54 . 2001-11-09 09:01 24064 ----a-w- c:\windows\system32\ativcoxx.dll
2012-05-26 19:54 . 2010-10-02 11:14 99856 ----a-w- c:\windows\system32\drivers\AtihdXP3.sys
2012-05-26 19:54 . 2010-06-13 09:49 159744 ----a-w- c:\windows\system32\atiapfxx.exe
2012-05-26 19:54 . 2005-05-03 20:24 217088 ----a-w- c:\windows\system32\atipdlxx.dll
2012-05-26 19:54 . 2005-05-03 20:14 5374560 ----a-w- c:\windows\system32\ati3duag.dll
2012-05-26 19:54 . 2011-05-02 21:33 956160 ----a-w- c:\windows\system32\ativvamv.dll
2012-05-26 19:54 . 2010-06-13 09:49 65024 ----a-w- c:\windows\system32\atimpc32.dll
2012-05-26 19:54 . 2009-02-04 03:58 65024 ----a-w- c:\windows\system32\amdpcom32.dll
2012-05-26 19:54 . 2009-02-04 03:53 237568 ----a-w- c:\windows\system32\atiadlxx.dll
2012-05-26 19:54 . 2005-05-03 20:22 53248 ----a-w- c:\windows\system32\ATIDDC.DLL
2012-05-26 19:54 . 2009-02-04 04:56 442368 ----a-w- c:\windows\system32\ATIDEMGX.dll
2012-05-26 19:54 . 2005-05-03 20:28 305664 ----a-w- c:\windows\system32\ati2dvag.dll
2012-05-26 19:53 . 2005-05-03 20:24 159744 ----a-w- c:\windows\system32\Oemdspif.dll
2012-05-26 19:53 . 2005-05-03 23:04 311296 ----a-w- c:\windows\system32\atiiiexx.dll
2012-05-26 19:53 . 2005-05-03 20:44 19976192 ----a-w- c:\windows\system32\atioglxx.dll
2012-05-26 19:53 . 2008-10-21 17:40 294912 ----a-w- c:\windows\system32\ATIODE.exe
2012-05-26 19:53 . 2005-05-03 20:28 7746048 ----a-w- c:\windows\system32\drivers\ati2mtag.sys
2012-05-26 19:53 . 2005-05-03 19:57 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2012-05-26 19:53 . 2005-05-03 20:24 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe
2012-05-26 19:53 . 2005-05-03 19:57 847872 ----a-w- c:\windows\system32\atikvmag.dll
2012-05-26 19:52 . 2005-05-03 20:22 647168 ----a-w- c:\windows\system32\ati2evxx.exe
2012-05-26 19:52 . 2005-05-03 20:08 3900800 ----a-w- c:\windows\system32\ativvaxx.dll
2012-05-26 19:52 . 2005-05-03 19:57 17408 ----a-w- c:\windows\system32\atitvo32.dll
2012-05-26 19:52 . 2008-10-21 17:40 45056 ----a-w- c:\windows\system32\ATIODCLI.exe
2012-05-16 15:07 . 2004-02-06 16:07 916992 ----a-w- c:\windows\system32\wininet.dll
2012-05-15 13:56 . 2004-06-22 15:36 1863296 ----a-w- c:\windows\system32\win32k.sys
2012-05-11 14:40 . 2004-06-22 15:36 43520 ----a-w- c:\windows\system32\licmgr10.dll
2012-05-11 14:40 . 2004-06-22 15:36 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2012-05-11 11:38 . 2004-10-11 12:32 385024 ----a-w- c:\windows\system32\html.iec
2012-05-09 12:59 . 2011-10-20 18:42 137928 ----a-w- c:\windows\system32\drivers\avipbb.sys
2012-05-09 12:59 . 2011-10-20 18:42 83392 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-05-05 03:14 . 2002-08-29 03:41 2029056 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-05-05 03:14 . 2002-08-29 03:41 2150912 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-05-02 13:46 . 2004-06-22 15:41 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-04-14 12:47 . 2012-04-14 12:47 76800 ----a-w- c:\windows\system32\drivers\SSHDRV84.sys
2012-04-04 13:56 . 2009-10-19 12:10 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-06-09 10:03 . 2011-06-05 23:27 143240 ----a-w- c:\programme\Gemeinsame Dateien\ApnStub.exe
2010-01-26 22:11 . 2011-01-25 22:59 444283 ----a-w- c:\programme\Gemeinsame Dateien\WinPcapNmap.exe
2009-08-09 00:11 . 2009-08-09 00:11 10437264 ----a-w- c:\programme\opera\program\plugins\PDFNetC.dll
2009-08-09 00:30 . 2009-08-09 00:30 107760 ----a-w- c:\programme\opera\program\plugins\ScorchPDFWrapper.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{EEE6C35D-6118-11DC-9C72-001320C79847}"= "c:\programme\SweetIM\Toolbars\Internet Explorer\mgHelper.dll" [2012-06-04 130904]
.
[HKEY_CLASSES_ROOT\clsid\{eee6c35d-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
2012-06-04 14:12 1310040 ----a-w- c:\programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2012-06-04 1310040]
.
[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2012-06-04 1310040]
.
[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\programme\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
"Pando Media Booster"="c:\programme\Pando Networks\Media Booster\PMB.exe" [2011-09-09 3077528]
"WMPNSCFG"="c:\programme\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AGRSMMSG"="AGRSMMSG.exe" [2005-03-08 88203]
"CHotkey"="mHotkey.exe" [2004-02-24 508416]
"ledpointer"="CNYHKey.exe" [2004-02-03 5794816]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2012-05-09 348624]
"EEventManager"="c:\programme\Epson Software\Event Manager\EEventManager.exe" [2010-10-12 979328]
"StartCCC"="c:\programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-04-05 98304]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2011-10-24 421888]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\GEMEIN~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\programme\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\dokumente und einstellungen\All Users\Anwendungsdaten\TuneUp Software\TuneUp Utilities 2012\WinStyler\tu_logonui.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2011-05-04 17:54 551296 ----a-w- c:\programme\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BsMain]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-03 07:37 843712 ----a-w- c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
2006-11-13 11:50 1289000 ----a-w- c:\programme\Microsoft ActiveSync\wcescomm.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ]
2005-06-02 14:03 1957888 ----a-w- c:\programme\Ahead\Nero BackItUp\NBJ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 09:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2010-12-21 10:53 1483264 ----a-w- c:\programme\Nokia\Nokia PC Suite 7\PCSuite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
2005-04-07 14:43 127118 ----a-w- c:\programme\Home Cinema\PowerCinema\PCMService.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-10-24 12:28 421888 ----a-w- c:\programme\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2004-11-02 18:24 32768 ----a-w- c:\programme\Home Cinema\PowerDVD\PDVDServ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2011-04-08 10:59 254696 ----a-w- c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2006-11-03 08:56 204288 ----a-w- c:\programme\Windows Media Player\wmpnscfg.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"NCLaunch"=c:\windows\NCLAUNCH.EXe
"NBJ"="c:\programme\Ahead\Nero BackItUp\NBJ.exe"
"WMPNSCFG"=c:\programme\Windows Media Player\WMPNSCFG.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"ATICustomerCare"="c:\programme\ATI\ATICustomerCare\ATICustomerCare.exe"
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"
"ATIPTA"="c:\programme\ATI Technologies\ATI Control Panel\atiptaxx.exe"
"VX1000"=c:\windows\vVX1000.exe
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" -atboottime
"KernelFaultCheck"=%systemroot%\system32\dumprep 0 -k
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 10.0\Reader\Reader_sl.exe"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Microsoft ActiveSync\\rapimgr.exe"=
"c:\\Programme\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Programme\\EPSON Software\\Event Manager\\EEventManager.exe"=
.
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [20.10.2011 20:42 36000]
R1 SASDIFSV;SASDIFSV;c:\programme\SUPERAntiSpyware\sasdifsv.sys [22.07.2011 18:27 12880]
R1 SASKUTIL;SASKUTIL;c:\programme\SUPERAntiSpyware\SASKUTIL.SYS [12.07.2011 23:55 67664]
R1 SSHDRV84;SSHDRV84;c:\windows\system32\drivers\SSHDRV84.sys [14.04.2012 14:47 76800]
R2 !SASCORE;SAS Core Service;c:\programme\SUPERAntiSpyware\SASCore.exe [12.08.2011 01:38 116608]
R2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\programme\Gemeinsame Dateien\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [14.05.2009 17:07 759048]
R2 AntiVirSchedulerService;Avira Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [20.10.2011 20:42 86224]
R2 BsMain;BullGuard main service;c:\windows\System32\SvcHost.exe -k BullGuard_Main [22.06.2004 17:36 14336]
R2 BsUpdate;BullGuard update service;c:\programme\BullGuard Backup\BullGuardUpdate.exe [09.06.2012 12:08 331096]
R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [27.01.2010 04:09 50704]
R3 3xHybrid;3xHybrid service;c:\windows\system32\drivers\3xHybrid.sys [09.12.2004 16:58 1025920]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdXP3.sys [02.10.2010 13:14 99856]
R3 cmudax;C-Media High Definition Audio Interface;c:\windows\system32\drivers\cmudax.sys [04.04.2005 14:06 1287296]
R3 UKBFLT;UKBFLT;c:\windows\system32\drivers\UKBFLT.sys [23.06.2004 11:32 11672]
S0 PDDSLHND;PDDSLHND; [x]
S2 dtgntdd;dtgntdd; [x]
S2 DTGuardService;DTGuardService; [x]
S2 gupdate;Google Update-Dienst (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [17.06.2012 18:51 116648]
S2 SkypeUpdate;Skype Updater;c:\programme\Skype\Updater\Updater.exe [29.02.2012 08:50 158856]
S3 BgRaSvc;BgRaSvc;c:\programme\BullGuard Backup\Support\BgRaSvc.exe [26.11.2010 14:20 125784]
S3 CardReaderFilter;Card Reader Filter;c:\windows\system32\drivers\USBCRFT.SYS [04.04.2005 11:27 17408]
S3 gupdatem;Google Update-Dienst (gupdatem);c:\programme\Google\Update\GoogleUpdate.exe [17.06.2012 18:51 116648]
S3 HTCAND32;HTC Device Driver;c:\windows\system32\drivers\ANDROIDUSB.sys [05.06.2011 00:29 24576]
S3 IIUSBISP;USB Mass Storage for USB ISP;c:\windows\system32\Drivers\iiusbisp.sys --> c:\windows\system32\Drivers\iiusbisp.sys [?]
S3 PDDSLADP;ProDyne DSL Adapter;c:\windows\system32\DRIVERS\PDDSLADP.SYS --> c:\windows\system32\DRIVERS\PDDSLADP.SYS [?]
S3 PRISM_A00;CREATIX 802.11g Driver;c:\windows\system32\drivers\PRISMA00.sys [25.06.2004 11:47 380736]
S3 XDva288;XDva288; [x]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
BullGuard_Main REG_MULTI_SZ BsMain
.
Inhalt des "geplante Tasks" Ordners
.
2012-06-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2012-06-17 16:51]
.
2012-06-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2012-06-17 16:51]
.
2012-06-21 c:\windows\Tasks\User_Feed_Synchronization-{2EF742D4-4E03-411D-969D-2209FE511C80}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 03:31]
.
2012-06-21 c:\windows\Tasks\User_Feed_Synchronization-{3F92B61E-D798-494B-8489-ED4055E7ED66}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 03:31]
.
2012-06-21 c:\windows\Tasks\User_Feed_Synchronization-{AF956C0B-8C67-475F-A1E3-FAE2CFD0BBC1}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 03:31]
.
2012-06-21 c:\windows\Tasks\User_Feed_Synchronization-{EE91F686-F3D1-4728-A322-42076A29379D}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 03:31]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://de.wikipedia.org/wiki/Wikipedia:Hauptseite
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Google Sidewiki... - c:\programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} - hxxp://www.myheritage.com/Genoogle/Components/ActiveX/SearchEngineQuery.dll
DPF: {BA162249-F2C5-4851-8ADC-FC58CB424243} - hxxp://static.pe.schuelervz.net/photouploader/ImageUploader5.cab?nocache=1208886004
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
WebBrowser-{76AEEA42-E04A-4B62-83AB-DF4B2BE2541E} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{C424171E-592A-415A-9EB1-DFD6D95D3530} - (no file)
HKLM-Run-Cmaudio - cmicnfg.cpl
SafeBoot-WudfPf
SafeBoot-WudfRd
MSConfigStartUp-Adobe Reader Speed Launcher - c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe
MSConfigStartUp-DivXUpdate - c:\programme\DivX\DivX Update\DivXUpdate.exe
MSConfigStartUp-iTunesHelper - c:\programme\iTunes\iTunesHelper.exe
MSConfigStartUp-NSLauncher - c:\programme\Nokia\Nokia Software Launcher\NSLauncher.exe
MSConfigStartUp-PlusService - c:\programme\Messenger Plus!\PlusService.exe
AddRemove-conduitEngine - c:\programme\ConduitEngine\ConduitEngineUninstall.exe
AddRemove-LSI Soft Modem - c:\windows\agrsmdel
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-06-21 16:53
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-2315146459-1594303470-113591373-1008\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•6~*]
"7040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
"7040211900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OOCC7.00.00.01PROSTATION"="B70BA71050CBE6555599D7B8D06722F91F0BB71505D13583F7E4AD8F3E50369CA0A40403DE036B732005227389588BE33E08E22DE53A1FF910DF6823F522DB3591969424726725AC4F1404E2C16E8BF7A1EF98C2F81FE46E770C1F86ED2B752F2F89F8BC5C2BA2028309D9879482BC0205B79AB23E1BD31AA1B5159331EB9E5146BF9142CFD270E701B5C79A7BBDBEC2C2E8EC921C1EBC2B25394EDE2EB87AD6448B86E4E23A214530053684599E36705E205628DCEC73C4B98914A8363B2EEDBDD2BF85928DCBF61B714EE5F1F84933FA0F63EFAB1DD1FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808BA7FD869164D6794A2D97226D213B5558EDD5E5BE2F6E66769DEED448B2184F56066C35B5315DA0779BAF6AACE6802EB0BD11E76AA38A60E9405BA86851F0FD7A24A0FC2C63714C6927CB5C43C2B6D989B379D8F125AC2FAAB40BEC79C899B579204B386E127142583A093B6881CE553DB7CA90006B0C1BD4273EDCAA37CF5359290DBCCD7E968129ADC8EA4E549E05DA7B0358CD0F21E8961A5D016A7F83C357612C4FA916AF7821A8AB878B626A87D4E86C740763DA315850504F565E3E21F084BBFBEA875F66EB6A7B7DE9608D77B92D4FCE7AB0D771A9DE036F750832EBD84A5B188ED3C73D39B56474ACE2ADFA7AB18829759478CD78E2D2DF08F063C611C30150BE354CB32E55C346E622A8450436C1EA41E33AD903080C077FB7C785DF39875BF43B6358E28A3E145048A614DF996A4284B7BF88BCD175DE525D8270A26B57563F6C03672E83BC48B1E326078E27D030265B0DF9227D183DC4EF55EC2BE8049F31FB4AB69A1D2E9C2CAEA43AD832CB653A745277572B4C5BDEC0F0BE6BE16BAB68E37C484C0416D305D639FD0584F5582FD10EA065566CE312BC3E85A9C3528354CD185D72702825C582F5CC650BC84B98A4E171BEC3459A1E81A0D043FC580B89473C47D2C30EE14F442B8784D6A0167A21E6D0FC98CB63EB6F95DD084CECA53D7EA30101A100EE91F78C3D22772983CD00305C06F84CAF95E2F94AE3E7D2059386EC5B1AC854DB2F71162C929132E3051E4C593D4D20D8C566A4113B0232E628D195A87189CAE86D4AC4ED112B13BFC968EEFECE7558BF150C0C7749434344AE3E595388102C843BC53146415D3C82046AF92B8868AE467ADA95CCF17C90A317A38F1720408C50B6C6E147F582578DC38DB95658796CDF085818BA35AA017FBC3544165AC24E4C0D5CB02A477F27BB77B0AB1E430410ED5208A34F3F11A59D2E96426C67D70770F1C9F68D98231987CD196742D3E760421FE66074868BAE221C5F318CDEBAA63E297FE23A8FAF5AD39AFBF41BAE0469DA1D31F0E2CB82CD697E7F6E339E3B4A46D5564E31ED7"
"OODEFRAG14.00.00.01PROFESSIONAL"="0B38ED0C4AFDBEAF211E1EC6E633A215F47415BA4338707EFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B98088EDD5E5BE2F6E667C038D530D6EB3452C038D530D6EB345205C1E771DFB3D8D09933A6750C0B315ACB9CA90622C316ED5F34370551DE62FDF62AF74145F4EA2192258C3CF05E19B924052C3066241D6A317DE76C43392CD50701E487AA92CEB7F9783C5351843D493B45DAB114F2CFF0B8A57BAD27D27DCE9151AD644C77E98997FB6847233B04F66115B527F965B4106E66650DC4F19CB3D6F955EC8C21E3BD1354469A7FD41769C7FA441D0B421687AB4C1D4908F59502FB2DE42A6D2028AFFA790EC22536E17805548F195FE402CE31BB9B1180CC36EC0871E51A991AE76E40377A2BF55B95B193D22491AFBB4A0F23676009E27B135BE7A16AACDE4716BEB62D4F3077D1A95451F814705CCA05A4075B6D48069A8367EC6E04472CF5EB161ACD4FA5D33CD3D48123769568A98C22C9744ADCE65621DEC9574CC31787E42288E3C2D058D0945D4A7A625379037F4DB9E40144A4EECC469836DD6DD971C1428008F86AF85AABC7B502F8F15C173F1E0B31A0740437A7D15533D786503C0709E82CBEA149351DA6328DD7AA7E38F2C355B5BB54EB9A1A6D5ECF5EC4F9057B3E8A126C1983D5B33F92C6282FF14D041F929DE8BF691250B77B5C9A4F7E7D2CDC145457E50741FB080EA8129F70D2A04624EBC108AA30B782D201B44425EAE81696DB5F12D41247AEBC864215D2573A024CF5E67085178354F1B86034DA2746CB066BE29C1276A9929E83EB99987E88CF3265F9B071022CE74850CEA4311F9B95BD14C6F60AB1FEC99618C4AC647F85E1E139A1F5083A6CACAAECB78E5C5486C0F8BD74062A98E11C6A918541FCA4ED1CCAC1095E8C2242C3510557DFB55A66CADBA6D8258216B30643916C3ECD4E459ABFA55E80612D7105D8E1EDF7B95C5EE7E9DB63A24CA89AB7B18B3AFD65EF50A9795E54610EE382F942A2BD2C891758800CC30A3F5F62009627C936D076101B4A1139A07FBE613EE0F03C8E45E9DBFE2F9193C3B23AE810BB786729F859CAF2B287597FC9C358362D2D722E02458FC243AAD80F26FD773BF0E2D4DF2E074EE8CBC0332F25908A3C0525E2E812A5AC59C0EC716CB672DB38B903D9AC1A1F5F54B38211F1E73DD1E643E679161ABDBE395FD114DEF67FF800C85C0CE6DC65D3CFBBF9118E5F859A1275687A8AB4E2E79E0AB6C5EFED33C45008D35A640A3F97B769B4A4CF4CCAE2DDDF01FC226D8CDD0A61DCE3AC1540C9289136840727B829B076A79084E10EC2AB776E6C3EC559E8C038E99DA5597DA4CDB82F1F2E30809D9D50A9F0FE47F8DE24E6D005413309E74995E7F6EE9E6289CA815213BE93681A2C18"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(1076)
c:\programme\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
.
- - - - - - - > 'explorer.exe'(2016)
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\HKCYDLL.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Zeit der Fertigstellung: 2012-06-21 16:57:55
ComboFix-quarantined-files.txt 2012-06-21 14:57
.
Vor Suchlauf: 14 Verzeichnis(se), 45.586.669.568 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 45.522.325.504 Bytes frei
.
- - End Of File - - A69B57C48753C89476E67430A03D7357
|
|
21.06.2012, 19:04
| #32 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Anfangs TR/Dropper.Gen, nun permanente Meldungen zu TR/Sirefef.AG.35, TR/ATRAPS.Gen2 und TR/Small.FI Bitte nun Logs mit GMER und OSAM erstellen und posten.
__________________GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen. Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst. Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM! Downloade dir bitte  aswMBR.exe und speichere die Datei auf deinem Desktop.
Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none). Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes: Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.
__________________ |
|
22.06.2012, 00:10
| #33 |
| | Anfangs TR/Dropper.Gen, nun permanente Meldungen zu TR/Sirefef.AG.35, TR/ATRAPS.Gen2 und TR/Small.FI Okay, erstmal GMER, die weiteren Logs folgen...
__________________[code] GMER Logfile: Code:
ATTFilter GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-06-22 01:10:00
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-17 ST3250823AS rev.3.03
Running: 2oo0o6ox.exe; Driver: C:\DOKUME~1\YYYYY~1\LOKALE~1\Temp\axldqpob.sys
---- System - GMER 1.0.15 ----
SSDT F7D82F6C ZwCreateThread
SSDT F7D82F58 ZwOpenProcess
SSDT F7D82F5D ZwOpenThread
---- Kernel code sections - GMER 1.0.15 ----
.text C:\WINDOWS\system32\DRIVERS\ati2mtag.sys section is writeable [0xF653D000, 0x2DC7EC, 0xE8000020]
.text C:\WINDOWS\system32\drivers\ACEDRV05.sys section is writeable [0xAE601000, 0x30A4A, 0xE8000020]
.pklstb C:\WINDOWS\system32\drivers\ACEDRV05.sys entry point in ".pklstb" section [0xAE643000]
.relo2 C:\WINDOWS\system32\drivers\ACEDRV05.sys unknown last section [0xAE65E000, 0x8E, 0x42000040]
.text C:\WINDOWS\system32\drivers\SSHDRV84.sys section is writeable [0xAE5B7000, 0x233D4, 0xE8000020]
.pklstb C:\WINDOWS\system32\drivers\SSHDRV84.sys entry point in ".pklstb" section [0xAE5E9000]
.relo2 C:\WINDOWS\system32\drivers\SSHDRV84.sys unknown last section [0xAE5FF000, 0x8E, 0x42000040]
init C:\WINDOWS\system32\DRIVERS\UKBFLT.sys entry point in "init" section [0xF7D562E0]
? System32\Drivers\hiber_WMILIB.SYS Das System kann den angegebenen Pfad nicht finden. !
---- Devices - GMER 1.0.15 ----
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
---- Registry - GMER 1.0.15 ----
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OOCC7.00.00.01PROSTATION B70BA71050CBE6555599D7B8D06722F91F0BB71505D13583F7E4AD8F3E50369CA0A40403DE036B732005227389588BE33E08E22DE53A1FF910DF6823F522DB3591969424726725AC4F1404E2C16E8BF7A1EF98C2F81FE46E770C1F86ED2B752F2F89F8BC5C2BA2028309D9879482BC0205B79AB23E1BD31AA1B5159331EB9E5146BF9142CFD270E701B5C79A7BBDBEC2C2E8EC921C1EBC2B25394EDE2EB87AD6448B86E4E23A214530053684599E36705E205628DCEC73C4B98914A8363B2EEDBDD2BF85928DCBF61B714EE5F1F84933FA0F63EFAB1DD1FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808BA7FD869164D6794A2D97226D213B5558EDD5E5BE2F6E66769DEED448B2184F56066C35B5315DA0779BAF6AACE6802EB0BD11E76AA38A60E9405BA86851F0FD7A24A0FC2C63714C6927CB5C43C2B6D989B379D8F125AC2FAAB40BEC79C899B579204B386E127142583A093B6881CE553DB7CA90006B0C1BD4273EDCAA37CF5359290DBCCD7E968129ADC8EA4E549E05DA7B0358CD0F21E8961A5D016A7F83C357612C4FA916AF7821A8AB878B626A87D4E86C740763DA315850504F565E3E21F084BBFBEA875F66EB6A7B7DE9608D77B92D4FCE7AB0D771A9DE036F750832EBD84A5B188ED3C73D39B56474ACE2ADFA7A
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODEFRAG14.00.00.01PROFESSIONAL 0B38ED0C4AFDBEAF211E1EC6E633A215F47415BA4338707EFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B98088EDD5E5BE2F6E667C038D530D6EB3452C038D530D6EB345205C1E771DFB3D8D09933A6750C0B315ACB9CA90622C316ED5F34370551DE62FDF62AF74145F4EA2192258C3CF05E19B924052C3066241D6A317DE76C43392CD50701E487AA92CEB7F9783C5351843D493B45DAB114F2CFF0B8A57BAD27D27DCE9151AD644C77E98997FB6847233B04F66115B527F965B4106E66650DC4F19CB3D6F955EC8C21E3BD1354469A7FD41769C7FA441D0B421687AB4C1D4908F59502FB2DE42A6D2028AFFA790EC22536E17805548F195FE402CE31BB9B1180CC36EC0871E51A991AE76E40377A2BF55B95B193D22491AFBB4A0F23676009E27B135BE7A16AACDE4716BEB62D4F3077D1A95451F814705CCA05A4075B6D48069A8367EC6E04472CF5EB161ACD4FA5D33CD3D48123769568A98C22C9744ADCE65621DEC9574CC31787E42288E3C2D058D0945D4A7A625379037F4DB9E40144A4EECC469836DD6DD971C1428008F86AF85AABC7B502F8F15C173F1E0B31A0740437A7D15533D786503C0709E82CBEA149351DA6328DD7AA7E38F2C355B5BB54EB9A1A6D5ECF5EC4F9057B3E8A126C1983D5B33F92C6282FF14D041
Reg HKLM\SOFTWARE\Classes\CLSID\{811A4731-5D4B-72E9-EE1C-5DBBC92A5CA6}\InprocServer32@RuntimeVersion v1.1.4322
Reg HKLM\SOFTWARE\Classes\CLSID\{811A4731-5D4B-72E9-EE1C-5DBBC92A5CA6}\InprocServer32@Class Microsoft.Office.Interop.Access.AllDatabaseDiagramsClass
Reg HKLM\SOFTWARE\Classes\CLSID\{811A4731-5D4B-72E9-EE1C-5DBBC92A5CA6}\InprocServer32@Assembly Microsoft.Office.Interop.Access, Version=11.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c
Reg HKLM\SOFTWARE\Classes\CLSID\{811A4731-5D4B-72E9-EE1C-5DBBC92A5CA6}\InprocServer32\11.0.0.0
Reg HKLM\SOFTWARE\Classes\CLSID\{811A4731-5D4B-72E9-EE1C-5DBBC92A5CA6}\InprocServer32\11.0.0.0@RuntimeVersion v1.1.4322
Reg HKLM\SOFTWARE\Classes\CLSID\{811A4731-5D4B-72E9-EE1C-5DBBC92A5CA6}\InprocServer32\11.0.0.0@Class Microsoft.Office.Interop.Access.AllDatabaseDiagramsClass
Reg HKLM\SOFTWARE\Classes\CLSID\{811A4731-5D4B-72E9-EE1C-5DBBC92A5CA6}\InprocServer32\11.0.0.0@Assembly Microsoft.Office.Interop.Access, Version=11.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ffwp\OpenWithProgids@Lucom GmbH.FormsForWeb\xae Filler 3.1
---- EOF - GMER 1.0.15 ----
Code:
ATTFilter Report of OSAM: Autorun Manager v5.0.11926.0 hxxp://www.online-solutions.ru/en/ Saved at 01:25:03 on 22.06.2012 OS: Windows XP Home Edition Service Pack 3 (Build 2600) Default Browser: Microsoft Corporation Internet Explorer 8.00.6001.18702 Scanner Settings [x] Rootkits detection (hidden registry) [x] Rootkits detection (hidden files) [x] Retrieve files information [x] Check Microsoft signatures Filters [ ] Trusted entries [ ] Empty entries [x] Hidden registry entries (rootkit activity) [x] Exclusively opened files [x] Not found files [x] Files without detailed information [x] Existing files [ ] Non-startable services [ ] Non-startable drivers [x] Active entries [x] Disabled entries [Boot Execute] -----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager )----- "BootExecute" - ? - OODBS (File not found) [Common] -----( %SystemRoot%\Tasks )----- "GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe "GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe [Control Panel Objects] -----( %SystemRoot%\system32 )----- "FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\WINDOWS\system32\FlashPlayerCPLApp.cpl "infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl "javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl "QTW32.CPL" - "Apple Computer, Inc." - C:\WINDOWS\system32\QTW32.CPL -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )----- "Adobe Gamma" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma.cpl "Avira AntiVir Personal - Free Antivirus " - "Avira Operations GmbH & Co. KG" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl "Avira AntiVir PersonalEdition Classic " - "Avira Operations GmbH & Co. KG" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl "NokiaConnectionManager" - "Nokia" - C:\PROGRA~1\Nokia\NOKIAP~1\CONNEC~1.CPL "Pando" - "Pando Networks" - C:\Programme\Pando Networks\Media Booster\PMB.cpl "QuickTime" - "Apple Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl [Drivers] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "ACEDRV05" (ACEDRV05) - "Protect Software GmbH" - C:\WINDOWS\system32\drivers\ACEDRV05.sys "avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys "avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys "avkmgr" (avkmgr) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avkmgr.sys "axldqpob" (axldqpob) - ? - C:\DOKUME~1\YYYYY~1\LOKALE~1\Temp\axldqpob.sys (Hidden registry entry, rootkit activity | File not found) "Card Reader Filter" (CardReaderFilter) - "ICSI Technology Ltd." - C:\WINDOWS\system32\Drivers\USBCRFT.SYS "catchme" (catchme) - ? - C:\DOKUME~1\YYYYY~1\LOKALE~1\Temp\catchme.sys (File not found) "Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys (File not found) "cpuz132" (cpuz132) - ? - C:\WINDOWS\system32\drivers\cpuz132.sys (File not found) "dtgntdd" (dtgntdd) - ? - C:\WINDOWS\system32\drivers\dtgntdd.sys (File not found) "i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys (File not found) "lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys (File not found) "Logitech QuickCam Express(PID_0928)" (PID_0928) - ? - C:\WINDOWS\System32\DRIVERS\LV561AV.SYS (File not found) "Logitech USB Monitor Filter" (LVUSBSta) - ? - C:\WINDOWS\System32\drivers\lvusbsta.sys (File not found) "NetGroup Packet Filter Driver" (npf) - "CACE Technologies, Inc." - C:\WINDOWS\System32\drivers\npf.sys "NTSIM" (NTSIM) - "VIA Networking Technologies, Inc. " - C:\WINDOWS\System32\ntsim.sys "Padus ASPI Shell" (pfc) - "Padus, Inc." - C:\WINDOWS\System32\drivers\pfc.sys "PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys (File not found) "PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys (File not found) "PDDSLHND" (PDDSLHND) - ? - C:\WINDOWS\system32\drivers\PDDSLHND.sys (File not found) "PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys (File not found) "PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys (File not found) "PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys (File not found) "ProDyne DSL Adapter" (PDDSLADP) - ? - C:\WINDOWS\System32\DRIVERS\PDDSLADP.SYS (File not found) "PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys "SASDIFSV" (SASDIFSV) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Programme\SUPERAntiSpyware\SASDIFSV.SYS "SASKUTIL" (SASKUTIL) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS "SSHDRV84" (SSHDRV84) - ? - C:\WINDOWS\system32\drivers\SSHDRV84.sys "ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys "TAP-Win32 Adapter V9" (tap0901) - "The OpenVPN Project" - C:\WINDOWS\System32\DRIVERS\tap0901.sys "USB Mass Storage for USB ISP" (IIUSBISP) - ? - C:\WINDOWS\System32\Drivers\iiusbisp.sys (File not found) "VIA Rhine Family Fast Ethernet Adapter Driver Service" (FETNDISB) - "VIA Technologies, Inc. " - C:\WINDOWS\System32\DRIVERS\fetnd5b.sys "WAN Miniport (ATW)" (wanatw) - ? - C:\WINDOWS\System32\DRIVERS\wanatw4.sys (File not found) "WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys (File not found) "XDva288" (XDva288) - ? - C:\WINDOWS\system32\drivers\XDva288.sys (File not found) [Explorer] -----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )----- {89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install -----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )----- {7D4D6379-F301-4311-BEBA-E26EB0561882} "NeroDigitalColumnHandler Class" - "Nero AG" - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroDigitalExt.dll {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll -----( HKLM\Software\Classes\Protocols\Filter )----- {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll {807553E5-5146-11D5-A672-00B0D022E945} "text/xml" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL -----( HKLM\Software\Classes\Protocols\Handler )----- {32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\11\OWC11.DLL {3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\10\OWC10.DLL {314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL {828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL {0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll {828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL {03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Programme\Windows Live\Mail\mailcomm.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )----- {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "SABShellExecuteHook Class" - "SuperAdBlocker.com" - C:\Programme\SUPERAntiSpyware\SASSEH.DLL -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )----- {EBDF1F20-C829-11D1-8233-0020AF3E97A9} "4shared_Desktop" - ? - (File not found | COM-object registry key not found) {23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Programme\7-Zip\7-zip.dll {9458E603-FF43-4134-9036-04B4C71791E3} "BackupCopyHook Class" - "BullGuard Ltd." - C:\Programme\BullGuard Backup\BackupShellHook.dll {1F25C6E4-E60D-421A-863F-D0C76F6AB211} "BullGuard Online-Laufwerk" - "BullGuard Ltd." - C:\Programme\BullGuard Backup\BackupShellNamespace.dll {0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Programme\Windows Live\Mail\mailcomm.dll {42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - (File not found | COM-object registry key not found) {872A9397-E0D6-4e28-B64D-52B8D0A7EA35} "DisplayCplExt Class" - "Advanced Micro Devices, Inc." - c:\Programme\ATI Technologies\ATI.ACE\Core-Static\atiamaxx.dll {88895560-9AA2-1069-930E-00AA0030EBC8} "Erweiterung für HyperTerminal-Icons" - ? - (File not found | COM-object registry key not found) {1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll {73B24247-042E-4EF5-ADC2-42F62E6FD654} "ICQ Lite Shell Extension" - ? - (File not found | COM-object registry key not found) {FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? - (File not found | COM-object registry key not found) {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? - (File not found | COM-object registry key not found) {32683183-48a0-441b-a342-7c2a440a9478} "Media Band" - ? - (File not found | COM-object registry key not found) {BC476F4C-D9D7-4100-8D4E-E043F6DEC409} "Microsoft Browser Architecture" - ? - (File not found | COM-object registry key not found) {42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\OFFICE11\msohev.dll {993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll {00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\OFFICE11\MLSHEXT.DLL {C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll {49BF5420-FA7F-11cf-8011-00A0C90A8F78} "Mobiles Gerät" - "Microsoft Corporation" - C:\PROGRA~1\MI3AA1~1\Wcesview.dll {B327765E-D724-4347-8B16-78AE18552FC3} "NeroDigitalIconHandler Class" - "Nero AG" - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroDigitalExt.dll {7F1CF152-04F8-453A-B34C-E609530A9DC8} "NeroDigitalPropSheetHandler Class" - "Nero AG" - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroDigitalExt.dll {416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A} "Nokia Phone Browser" - "Nokia" - C:\Programme\Nokia\Nokia PC Suite 7\PhoneBrowser.dll {0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\OFFICE11\OLKFSTUB.DLL {45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira Operations GmbH & Co. KG" - C:\Programme\Avira\AntiVir Desktop\shlext.dll {E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll {764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? - (File not found | COM-object registry key not found) {e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll {5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - "Advanced Micro Devices, Inc." - c:\Programme\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll {6F5C0F40-1419-4DC8-8D2F-D5EC5FCF07AB} "Sprint.ExplorerIntegration.9" - "ABBYY" - C:\Programme\Gemeinsame Dateien\ABBYY\FineReaderSprint\9.00\Integration\SprintIntegration.dll {BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL {2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\WLXPhotoGallery.exe {00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\WLXPhotoGallery.exe {00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\PhotoViewerShim.dll {00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\PhotoViewerShim.dll {00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\PhotoViewerShim.dll {00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\WLXPhotoGallery.exe {00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\PhotoViewerShim.dll {06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe [Internet Explorer] -----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )----- {32683183-48a0-441b-a342-7c2a440a9478} "{32683183-48a0-441b-a342-7c2a440a9478}" - ? - (File not found | COM-object registry key not found) -----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )----- ITBar7Height "ITBar7Height" - ? - (File not found | COM-object registry key not found) <binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found) <binary data> "SweetPacks Toolbar for Internet Explorer" - "SweetIM Technologies Ltd." - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll <binary data> "{855F3B16-6D32-4FE6-8A56-BBB695989046}" - ? - (File not found | COM-object registry key not found) -----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )----- {EEE6C35D-6118-11DC-9C72-001320C79847} "SweetIM ToolbarURLSearchHook Class" - "SweetIM Technologies Ltd." - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgHelper.dll -----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )----- {59136DB4-6CA3-4B40-8F2F-BBF84B6F1E91} "Attachment Upload Control" - "WEB.DE GmbH" - C:\WINDOWS\DOWNLO~1\MAIL_U~1.OCX / https://stream.web.de/mail/activex/mail_upload_11213.cab {BD393C14-72AD-4790-A095-76522973D6B8} "CBreakshotControl Class" - "pixelStorm entertainment studios Inc." - C:\WINDOWS\Downloaded Program Files\banksht2.dll / hxxp://messenger.zone.msn.com/binary/Bankshot.cab57213.cab {20A60F0D-9AFA-4515-A0FD-83BD84642501} "Checkers Class" - "Microsoft Corporation" - C:\WINDOWS\Downloaded Program Files\msgrchkr.dll / hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} "CMediaMix Object" - "Microsoft Corp." - C:\WINDOWS\system32\MediaLogic.dll / hxxp://musicmix.messenger.msn.com/Medialogic.CAB {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} "CSEQueryObject Object" - "MyHeritage Ltd." - C:\WINDOWS\Downloaded Program Files\SearchEngineQuery.dll / hxxp://www.myheritage.com/Genoogle/Components/ActiveX/SearchEngineQuery.dll {DE22A7AB-A739-4C58-AD52-21F9CD6306B7} "CTAdjust Class" - ? - C:\WINDOWS\Downloaded Program Files\clearadjust.dll / hxxp://download.microsoft.com/download/7/E/6/7E6A8567-DFE4-4624-87C3-163549BE2704/clearadj.cab DirectAnimation Java Classes "DirectAnimation Java Classes" - ? - (File not found | COM-object registry key not found) / file://C:\WINDOWS\Java\classes\dajava.cab {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} "GameLauncher Control" - "Acclaim Game Launcher" - C:\WINDOWS\DOWNLO~1\GAMELA~1.OCX / hxxp://www.acclaim.com/cabs/acclaim_v4.cab {BA162249-F2C5-4851-8ADC-FC58CB424243} "Image Uploader Control" - "Aurigma, Inc." - C:\WINDOWS\Downloaded Program Files\ImageUploader5.ocx / hxxp://static.pe.schuelervz.net/photouploader/ImageUploader5.cab?nocache=1208886004 {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} "InstallerBehaviorFactory Class" - "Microsoft Corp." - C:\WINDOWS\Downloaded Program Files\MsnInstC.dll / https://signup.msn.com/pages/MsnInstC.cab {8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_26.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_26.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_26.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab {15B782AF-55D8-11D1-B477-006097098764} "Macromedia Authorware Web Player Control" - "Macromedia, Inc." - C:\WINDOWS\system32\macromed\authorwa\awswax.ocx / hxxp://fpdownload.macromedia.com/get/shockwave/cabs/authorware/awswaxd.cab {C3F79A2B-B9B4-4A66-B012-3EE46475B072} "MessengerStatsClient Class" - "Microsoft Corporation" - C:\WINDOWS\Downloaded Program Files\MessengerStatsPAClient.dll / hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab {B479199A-1242-4E3C-AD81-7F0DF801B4AE} "Microsoft Download Manager ActiveX control" - "Microsoft Corp." - C:\WINDOWS\npMSDM.dll / hxxp://download.microsoft.com/download/C/9/C/C9C3D86D-84AC-4AF0-8584-842756A66467/MicrosoftDownloadManager.cab Microsoft XML Parser for Java "Microsoft XML Parser for Java" - ? - (File not found | COM-object registry key not found) / file://C:\WINDOWS\Java\classes\xmldso.cab {B8BE5E93-A60C-4D26-A2DC-220313175592} "MSN Games - Installer" - "Microsoft Corporation" - C:\WINDOWS\Downloaded Program Files\ZIntro.ocx / hxxp://messenger.zone.msn.com/binary/ZIntro.cab56649.cab {4F1E5B1A-2A80-42CA-8532-2D05CB959537} "MSN Photo Upload Tool" - "Microsoft® Corporation" - C:\WINDOWS\Downloaded Program Files\MsnPUpld.dll / hxxp://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} "Office Update Installation Engine" - "Microsoft Corporation" - C:\WINDOWS\opuc.dll / hxxp://office.microsoft.com/officeupdate/content/opuc3.cab {56393399-041A-4650-94C7-13DFCB1F4665} "PSFormX Control" - "Visicom Media" - C:\WINDOWS\DOWNLO~1\PESTSC~1.OCX / hxxp://www.ca.com/us/securityadvisor/pestscan/pestscan.cab {166B1BCA-3F9C-11CF-8075-444553540000} "Shockwave ActiveX Control" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Adobe\Director\SwDir.dll / hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab {D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Macromed\Flash\Flash11e.ocx / hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab {5D6F45B3-9043-443D-A792-115447494D24} "UnoCtrl Class" - "Microsoft" - C:\WINDOWS\Downloaded Program Files\GAME_UNO1.dll / hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/de/uno1/GAME_UNO1.cab {17492023-C23A-453E-A040-C7C580BBF700} "Windows Genuine Advantage Validation Tool" - "Microsoft Corporation" - C:\WINDOWS\system32\legitcheckcontrol.dll / hxxp://download.microsoft.com/download/9/b/d/9bdc68ef-6a9f-4505-8fb8-d0d2d160e512/LegitCheckControl.cab {E77F23EB-E7AB-4502-8F37-247DBAF1A147} "Windows Live Hotmail Photo Upload Tool" - "Microsoft® Corporation" - C:\WINDOWS\Downloaded Program Files\CONFLICT.2\MsnPUpld.dll / hxxp://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab {7B297BFD-85E4-4092-B2AF-16A91B2EA103} "WScanCtl Class" - "CA" - C:\WINDOWS\Downloaded Program Files\webscan.dll / hxxp://www.ca.com/de/securityadvisor/virusinfo/webscan.cab {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} "{0E8D0700-75DF-11D3-8B4A-0008C7450C4A}" - ? - (File not found | COM-object registry key not found) / hxxp://www.lizardtech.com/download/files/win/djvuplugin/de_DE/DjVuControl_de_DE.cab {33564D57-0000-0010-8000-00AA00389B71} "{33564D57-0000-0010-8000-00AA00389B71}" - ? - (File not found | COM-object registry key not found) / hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB {67DABFBF-D0AB-41FA-9C46-CC0F21721616} "{67DABFBF-D0AB-41FA-9C46-CC0F21721616}" - ? - (File not found | COM-object registry key not found) / hxxp://download.divx.com/player/DivXBrowserPlugin.cab {E2883E8F-472F-4FB0-9522-AC9BF37916A7} "{E2883E8F-472F-4FB0-9522-AC9BF37916A7}" - ? - (File not found | COM-object registry key not found) / hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )----- {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} "ClsidExtension" - "Microsoft Corporation" - C:\PROGRA~1\MI3AA1~1\INetRepl.dll {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} "Create Mobile Favorite" - "Microsoft Corporation" - C:\PROGRA~1\MI3AA1~1\INetRepl.dll {5F7B1267-94A9-47F5-98DB-E99415F33AEC} "In Blog veröffentlichen" - "Microsoft Corporation" - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll {FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Recherchieren" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )----- {9421DD08-935F-4701-A9CA-22DF90AC4EA6} "Easy Photo Print" - "SEIKO EPSON CORPORATION" - C:\Programme\Epson Software\Easy Photo Print\EPTBL.dll <binary data> "SweetPacks Toolbar for Internet Explorer" - "SweetIM Technologies Ltd." - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )----- {18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll {9421DD08-935F-4701-A9CA-22DF90AC4EA6} "Easy Photo Print" - "SEIKO EPSON CORPORATION" - C:\Programme\Epson Software\Easy Photo Print\EPTBL.dll {7b523e7c-f096-4e36-a0cb-7efeb5c675c1} "IEExtension.VDownloaderBHO" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll {DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll {E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll {EEE6C35C-6118-11DC-9C72-001320C79847} "SweetPacks Browser Helper" - "SweetIM Technologies Ltd." - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll {9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID-Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [Logon] -----( %AllUsersProfile%\Startmenü\Programme\Autostart )----- "desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini -----( %UserProfile%\Startmenü\Programme\Autostart )----- "desktop.ini" - ? - C:\Dokumente und Einstellungen\XXXXX\Startmenü\Programme\Autostart\desktop.ini -----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )----- "H/PC Connection Agent" - "Microsoft Corporation" - "C:\Programme\Microsoft ActiveSync\wcescomm.exe" "Pando Media Booster" - ? - C:\Programme\Pando Networks\Media Booster\PMB.exe -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )----- "Adobe ARM" - "Adobe Systems Incorporated" - "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" "avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min "CHotkey" - "Chicony" - mHotkey.exe "EEventManager" - "SEIKO EPSON CORPORATION" - "C:\Programme\Epson Software\Event Manager\EEventManager.exe" "ledpointer" - "Chicony" - CNYHKey.exe "QuickTime Task" - "Apple Inc." - "C:\Programme\QuickTime\qttask.exe" -atboottime "StartCCC" - "Advanced Micro Devices, Inc." - "c:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [Print Monitors] -----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )----- "EpsonNet Print Port" - "SEIKO EPSON CORPORATION" - C:\WINDOWS\system32\enppmon.dll "Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\mdimon.dll "pdfcmon" - "pdfforge GbR" - C:\WINDOWS\system32\pdfcmon.dll [Services] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- ".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe "ABBYY FineReader 9.0 Sprint Licensing Service" (ABBYY.Licensing.FineReader.Sprint.9.0) - "ABBYY" - C:\Programme\Gemeinsame Dateien\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe "Anwendungsverwaltung" (AppMgmt) - ? - C:\WINDOWS\System32\appmgmts.dll (File not found) "ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe "ATI Smart" (ATI Smart) - ? - C:\WINDOWS\system32\ati2sgag.exe "Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Programme\Avira\AntiVir Desktop\avguard.exe "Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Programme\Avira\AntiVir Desktop\sched.exe "BgRaSvc" (BgRaSvc) - "BullGuard Ltd." - C:\Programme\BullGuard Backup\Support\BgRaSvc.exe "BullGuard main service" (BsMain) - "BullGuard Ltd." - C:\Programme\BullGuard Backup\BsMain.dll "BullGuard update service" (BsUpdate) - "BullGuard Ltd." - C:\Programme\BullGuard Backup\BullGuardUpdate.exe "CyberLink Background Capture Service (CBCS)" (CLCapSvc) - ? - C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe "CyberLink Task Scheduler (CTS)" (CLSched) - ? - C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe "DTGuardService" (DTGuardService) - ? - C:\WINDOWS\system32\drivers\DTGuardService.sys (File not found) "Google Update-Dienst (gupdate)" (gupdate) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe "Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe "InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe "Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe "Machine Debug Manager" (MDM) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE "Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe "Office Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE "OpenVPN Service" (OpenVPNService) - ? - C:\Programme\OpenVPN\bin\openvpnserv.exe (File found, but it contains no detailed information) "SAS Core Service" (!SASCORE) - "SUPERAntiSpyware.com" - C:\Programme\SUPERAntiSpyware\SASCORE.EXE "ServiceLayer" (ServiceLayer) - "Nokia" - C:\Programme\PC Connectivity Solution\ServiceLayer.exe "Skype Updater" (SkypeUpdate) - "Skype Technologies" - C:\Programme\Skype\Updater\Updater.exe "Software Jukebox v2.0 Service" (Software Jukebox v2.0 Service) - ? - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Service\Software Jukebox v2.0 Service File.exe "Windows CardSpace" (idsvc) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe "Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSVC.EXE "Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe "Windows Presentation Foundation Font Cache 4.0.0.0" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe "X10 Device Network Service" (x10nets) - "X10" - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe [Winlogon] -----( HKCU\Control Panel\IOProcs )----- "MVB" - ? - mvfs32.dll (File not found) -----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon )----- "UIHost" - "Microsoft Corporation" - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software\TuneUp Utilities 2012\WinStyler\tu_logonui.exe -----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions )----- {c6dc5466-785a-11d2-84d0-00c04fb169f7} "Softwareinstallation" - ? - appmgmts.dll (File not found) -----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )----- "!SASWinLogon" - "SUPERAntiSpyware.com" - C:\Programme\SUPERAntiSpyware\SASWINLO.DLL "WgaLogon" - "Microsoft Corporation" - C:\WINDOWS\system32\WgaLogon.dll ===[ Logfile end ]=========================================[ Logfile end ]=== Geändert von K-Runa (22.06.2012 um 00:25 Uhr) |
|
22.06.2012, 10:18
| #34 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Anfangs TR/Dropper.Gen, nun permanente Meldungen zu TR/Sirefef.AG.35, TR/ATRAPS.Gen2 und TR/Small.FI Was ist mit aswMBR?
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
22.06.2012, 14:38
| #35 |
| | Anfangs TR/Dropper.Gen, nun permanente Meldungen zu TR/Sirefef.AG.35, TR/ATRAPS.Gen2 und TR/Small.FI ...und nun das letzte Log: Code:
ATTFilter aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-06-22 14:09:31
-----------------------------
14:09:31.437 OS Version: Windows 5.1.2600 Service Pack 3
14:09:31.437 Number of processors: 2 586 0x401
14:09:31.468 ComputerName: YYYYY UserName:
14:09:33.406 Initialize success
14:09:48.562 AVAST engine defs: 12062101
14:10:04.531 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-17
14:10:04.546 Disk 0 Vendor: ST3250823AS 3.03 Size: 238475MB BusType: 3
14:10:04.609 Disk 0 MBR read successfully
14:10:04.625 Disk 0 MBR scan
14:10:04.812 Disk 0 unknown MBR code
14:10:04.828 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 120001 MB offset 63
14:10:04.921 Disk 0 Partition - 00 0F Extended LBA 118471 MB offset 245762370
14:10:04.968 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 109999 MB offset 245762433
14:10:04.984 Disk 0 Partition - 00 05 Extended 8471 MB offset 471041865
14:10:05.046 Disk 0 Partition 3 00 0B FAT32 MSDOS5.0 8471 MB offset 471041928
14:10:05.218 Disk 0 scanning sectors +488392065
14:10:05.375 Disk 0 scanning C:\WINDOWS\system32\drivers
14:10:38.218 Service scanning
14:11:00.468 Modules scanning
14:11:22.328 Disk 0 trace - called modules:
14:11:22.390 TUKERNEL.EXE CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
14:11:22.421 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x87314ab8]
14:11:22.453 3 CLASSPNP.SYS[f77eefd7] -> nt!IofCallDriver -> \Device\0000006f[0x873cb9e8]
14:11:22.484 5 ACPI.sys[f7764620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-17[0x873d0d98]
14:11:23.062 AVAST engine scan C:\WINDOWS
14:11:54.531 AVAST engine scan C:\WINDOWS\system32
14:20:52.218 AVAST engine scan C:\WINDOWS\system32\drivers
14:21:50.109 AVAST engine scan C:\Dokumente und Einstellungen\XXXXX
15:28:34.250 AVAST engine scan C:\Dokumente und Einstellungen\All Users
15:35:33.562 Scan finished successfully
15:39:07.000 Disk 0 MBR has been saved successfully to "C:\Dokumente und Einstellungen\XXXXX\Desktop\MBR.dat"
15:39:07.046 The log file has been saved successfully to "C:\Dokumente und Einstellungen\XXXXX\Desktop\aswMBR.txt"
|
|
24.06.2012, 15:09
| #36 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Anfangs TR/Dropper.Gen, nun permanente Meldungen zu TR/Sirefef.AG.35, TR/ATRAPS.Gen2 und TR/Small.FI Wir sollten den MBR fixen, sichere für den Fall der Fälle ALLE wichtigen Daten, auch wenn meistens alles glatt geht. Hinweis: Mach bitte NICHT den MBR-Fix, wenn du noch andere Betriebssysteme wie zB Ubuntu installiert hast, ein MBR-Fix mit Windows-Tools macht ein parallel installiertes (Dualboot) Linux unbootbar. Mach den Fix auch dann nicht, wenn du zB mit TrueCrypt oder anderen Verschlüsselungsprogrammen eine Vollverschlüsselung der Windowspartition bzw. gesamten Festplatte hast Starte nach der Datensicherung aswmbr erneut und klick auf den Button FIXMBR. Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm! Anschließend Windows neu starten und ein neues Log mit aswMBR machen.
__________________ --> Anfangs TR/Dropper.Gen, nun permanente Meldungen zu TR/Sirefef.AG.35, TR/ATRAPS.Gen2 und TR/Small.FI |
|
26.06.2012, 22:16
| #37 |
| | Anfangs TR/Dropper.Gen, nun permanente Meldungen zu TR/Sirefef.AG.35, TR/ATRAPS.Gen2 und TR/Small.FI Hallo Arne, die Daten sind nun auf einer externen Festplatte gesichert, das Fixen habe ich allerdings noch nicht durchgeführt (vor dem Fixen die ext. Festplatte abkoppeln, oder?). Was mache ich, wenn, wie auch von der Warnung beim Klick auf 'FixMBR' mitgeteilt, das System beschädigt wird, wie kann ich es dann wieder reparieren? Lediglich die Daten von der Festplatte herüberziehen wird nicht die Lösung sein, oder? Das Andere: auf einer Seite im Internet habe ich gelesen, dass dieses Programm nicht bei bereits vorinstallierten Windows-Betriebssystemen ausgeführt werden sollte - ist da etwas dran Gibt es da mögliche andere Sachen, auf die ich achten sollte? Man vergebe mir meine Unsicherheit! :-) Grüße |
|
27.06.2012, 12:55
| #38 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Anfangs TR/Dropper.Gen, nun permanente Meldungen zu TR/Sirefef.AG.35, TR/ATRAPS.Gen2 und TR/Small.FI Ja die Backupplatte abklemmen, dann einen MBR-Fix machen Zitat:
Einen versauten MBR sollte man fixen egal ob vorinstalliert oder nicht Nur geht der vom Hersteller angepasste MBR dann flöten und man kann dann evtl. nicht mehr von einer Recoverypartition allein das System recovern Falls man aber recovern muss wäre es töricht sich nur auf diese Recoverypartition zu verlassen, für den Notfall sollte man immer Recoverymedien brennen falls keine im Lieferumfang waren (meistens muss man sie sich selber brennen, eine positive Ausnahme hab ich aber bei Samsung-Notebooks gesehen, da waren Recoverymedien beigepackt )
__________________ Logfiles bitte immer in CODE-Tags posten |
|
27.06.2012, 16:28
| #39 |
| | Anfangs TR/Dropper.Gen, nun permanente Meldungen zu TR/Sirefef.AG.35, TR/ATRAPS.Gen2 und TR/Small.FI Mit welchem Programm kann man eine solche Recovery-Disk erstellen? Nero hat - glaube ich - eine solche Funktion, gibt es da aber bessere (möglichst Freeware)? Grüße |
|
28.06.2012, 09:54
| #40 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Anfangs TR/Dropper.Gen, nun permanente Meldungen zu TR/Sirefef.AG.35, TR/ATRAPS.Gen2 und TR/Small.FI Das hat so nichts mit dem Brennprogramm zu tun. Lies in deinem Handbuch zum Rechner nach, das geht bei jedem Hersteller anders
__________________ Logfiles bitte immer in CODE-Tags posten |
|
03.07.2012, 12:48
| #41 |
| | Anfangs TR/Dropper.Gen, nun permanente Meldungen zu TR/Sirefef.AG.35, TR/ATRAPS.Gen2 und TR/Small.FI Hallo Arne, ich habe nun über das Windows-eigene Sicherungsprogramm und jenes von BullGuard eine Sicherung erstellt, das müsste doch soweit genügen, oder? Mit welchen möglichen Veränderungen werde ich zu rechnen haben nach der Anwendung des Fixes? Nach dem Ausführen der letzten Programme habe ich bspw. den Verlust des "Pfeile" im Startmenü bei den Punkten Eigene Dateien, Bilder, Musik zu beklagen - was nicht wirklich dramatisch ist, allerdings möchte ich ungerne 'drastischere' Veränderungen haben. Gibt es mögliche "harmlosere" Alternativen zu diesem Verfahren? Oder sorge ich mich unnötigerweise und das Verfahren ist weit weniger invasiv als ich erwarte? Liebe Grüße |
|
03.07.2012, 14:50
| #42 | ||
| /// Winkelfunktion /// TB-Süch-Tiger™ | Anfangs TR/Dropper.Gen, nun permanente Meldungen zu TR/Sirefef.AG.35, TR/ATRAPS.Gen2 und TR/Small.FI Du hast irgendwas eingestellt, irgendwas wurde irgendwie auf irgendwas gesichert und ich soll nun sagen, dass das so reicht?  Zitat:
Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Anfangs TR/Dropper.Gen, nun permanente Meldungen zu TR/Sirefef.AG.35, TR/ATRAPS.Gen2 und TR/Small.FI |
| 4shared, 7-zip, acedrv05.sys, alternate, andere, anti-malware, audacity, avira, benötige, ccc.exe, community, conduit, dateien, dateisystem, daten, dllhost.exe, erneut, fontcache, hdaudio.sys, heuristiks/extra, heuristiks/shuriken, interne, internetverbindung, konnte, langs, liebe, log-datei, meldungen, mom.exe, msn deutschland, ntdll.dll, origin, pando media booster, plug-in, quarantäne, quelle, scan, schei, searchscopes, sensible, tr/atraps.gen, tr/atraps.gen2, tr/dropper.gen, tr/sirefef.ag.35, tr/small.fi, troja, trojan.small, trojaner, verbindung, version=1.0, verweise, visual studio, vollständige, wallpapers, wbemess.dll, windows internet |
Linear-Darstellung
