| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: BKA-TrojanerWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
28.06.2012, 06:28
| #1 |
 |  BKA-Trojaner Auf diesem Netbook hat MBAM den BKA-Trojaner entdeckt und in Quarantäne gesteckt. Den Shell-Eintrag in der Registry habe ich manuell wieder zu explorer.exe geändert. MBAM findet nichts mehr, aber ich wollte Security Essentials installieren, hängt dabei auf, hat nach Stunden immer noch das gleiche Bild, wird aber nicht fertig. MS-Updates werden angezeigt, aber der download geht nicht, zeigt nach Stunden immer noch 0% an. hier die logs: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 09:14 on 27/06/2012 (Lukas)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter OTL logfile created on: 27.06.2012 09:28:27 - Run 1 OTL by OldTimer - Version 3.2.53.0 Folder = C:\Users\***\Desktop Starter Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1013,09 Mb Total Physical Memory | 272,44 Mb Available Physical Memory | 26,89% Memory free 1,99 Gb Paging File | 1,04 Gb Available in Paging File | 52,43% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 215,79 Gb Total Space | 182,19 Gb Free Space | 84,43% Space Free | Partition Type: NTFS Drive D: | 4,00 Gb Total Space | 2,65 Gb Free Space | 66,35% Space Free | Partition Type: FAT32 Computer Name: ***-PC | User Name: Lukas | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.06.27 09:22:27 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe PRC - [2012.05.18 01:21:54 | 000,748,664 | ---- | M] (Microsoft Corporation) -- C:\Programme\Internet Explorer\iexplore.exe PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2011.11.14 10:51:34 | 000,101,888 | ---- | M] (Crunchdeal Ltd.) -- c:\Programme\Crunchdeal\0.0.2.6\crunchupd.exe PRC - [2011.02.26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2010.08.05 15:58:43 | 000,231,888 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\System32\Macromed\Flash\FlashUtil10h_ActiveX.exe PRC - [2010.07.21 03:53:50 | 000,492,096 | ---- | M] (Insyde Software Corp.) -- C:\Programme\Acer\Updater\iUpdate.exe PRC - [2010.06.22 08:34:48 | 000,321,104 | ---- | M] (Dritek System Inc.) -- C:\Programme\Launch Manager\dsiwmis.exe PRC - [2010.06.22 08:34:48 | 000,305,744 | ---- | M] (Dritek System Inc.) -- C:\Programme\Launch Manager\LMworker.exe PRC - [2010.06.22 08:34:46 | 000,968,272 | ---- | M] (Dritek System Inc.) -- C:\Programme\Launch Manager\LManager.exe PRC - [2010.06.11 14:28:06 | 000,715,296 | ---- | M] (Acer Incorporated) -- C:\Programme\Acer\Acer ePower Management\ePowerTray.exe PRC - [2010.06.11 14:28:02 | 000,735,776 | ---- | M] (Acer Incorporated) -- C:\Programme\Acer\Acer ePower Management\ePowerSvc.exe PRC - [2010.06.11 14:27:54 | 000,469,536 | ---- | M] (Acer Incorporated) -- C:\Programme\Acer\Acer ePower Management\ePowerEvent.exe PRC - [2010.06.10 09:57:20 | 000,548,744 | ---- | M] (ELAN Microelectronic Corp.) -- C:\Programme\Elantech\ETDCtrl.exe PRC - [2010.05.27 04:41:24 | 000,349,552 | ---- | M] (Egis Technology Inc.) -- C:\Programme\EgisTec MyWinLocker\x86\mwlDaemon.exe PRC - [2010.04.07 07:16:54 | 001,599,880 | ---- | M] (ELAN Microelectronic Corp.) -- C:\Programme\Elantech\ETDCtrlHelper.exe PRC - [2010.03.11 07:11:56 | 000,407,920 | ---- | M] (Egis Technology Inc.) -- C:\Programme\EgisTec IPS\PmmUpdate.exe PRC - [2010.03.11 07:11:42 | 000,201,584 | ---- | M] (Egis Technology Inc.) -- C:\Programme\EgisTec IPS\EgisUpdate.exe PRC - [2010.01.30 01:52:58 | 000,260,640 | ---- | M] (Acer Incorporated) -- C:\Programme\Acer\Acer VCM\RS_Service.exe PRC - [2010.01.29 01:27:36 | 000,243,232 | ---- | M] (Acer Group) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe PRC - [2010.01.08 15:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) -- C:\Programme\Acer\Registration\GREGsvc.exe PRC - [2010.01.08 11:53:30 | 000,407,416 | ---- | M] (Insyde Software Corp.) -- C:\Programme\Acer\Android Manager\iSync.exe PRC - [2009.11.20 11:17:12 | 000,434,176 | ---- | M] (Sony Ericsson Mobile Communications AB) -- C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe PRC - [2009.10.13 19:25:54 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe PRC - [2009.10.13 19:25:30 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe PRC - [2009.07.14 03:14:50 | 000,314,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wusa.exe PRC - [2009.07.14 03:14:47 | 001,121,280 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe PRC - [2009.07.14 03:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe PRC - [2009.04.30 12:23:26 | 000,090,112 | ---- | M] () -- C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe ========== Modules (No Company Name) ========== MOD - [2010.07.20 14:54:12 | 000,411,136 | ---- | M] () -- C:\Programme\Acer\Android Manager\DEU.dll MOD - [2009.11.20 15:45:06 | 000,294,912 | ---- | M] () -- C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\Calendar.dll MOD - [2009.11.17 15:03:10 | 000,745,472 | ---- | M] () -- C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\MmsKrnl.dll MOD - [2009.10.13 10:45:30 | 000,225,280 | ---- | M] () -- C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\VistaCalendar.dll MOD - [2009.10.05 17:54:20 | 000,200,704 | ---- | M] () -- C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\LogoEdit.dll MOD - [2009.07.29 12:43:08 | 000,155,648 | ---- | M] () -- C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\CAgdLNote.dll MOD - [2009.06.24 16:48:04 | 000,282,624 | ---- | M] () -- C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\Messaging.dll MOD - [2009.06.16 18:10:48 | 000,155,648 | ---- | M] () -- C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\Contacts.dll MOD - [2009.06.03 18:25:48 | 000,053,248 | ---- | M] () -- C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\VObject.dll MOD - [2009.05.20 08:02:04 | 000,072,200 | ---- | M] () -- C:\Programme\Launch Manager\CdDirIo.dll MOD - [2009.04.28 12:17:58 | 000,208,896 | ---- | M] () -- C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\CAgdOutlook.dll MOD - [2009.04.01 09:33:10 | 000,106,496 | ---- | M] () -- C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\CalEngine.dll MOD - [2009.03.26 16:41:32 | 000,315,392 | ---- | M] () -- C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\MelodyEdit.dll MOD - [2008.11.07 16:05:06 | 000,196,608 | ---- | M] () -- C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\Report.dll ========== Win32 Services (SafeList) ========== SRV - File not found [Auto | Stopped] -- %SystemRoot%\System32\aptw33ety.dll -- (LanmanWorkstation) SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2011.12.13 21:04:09 | 000,114,000 | ---- | M] (Joosoft.com GmbH) [Auto | Running] -- C:\Windows\System32\UpdSvc.dll -- (Update-Service) SRV - [2010.06.22 08:34:48 | 000,321,104 | ---- | M] (Dritek System Inc.) [Auto | Running] -- C:\Programme\Launch Manager\dsiwmis.exe -- (DsiWMIService) SRV - [2010.06.11 14:28:02 | 000,735,776 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer ePower Management\ePowerSvc.exe -- (ePowerSvc) SRV - [2010.05.27 04:41:06 | 000,305,520 | ---- | M] (Egis Technology Inc.) [On_Demand | Stopped] -- C:\Programme\EgisTec MyWinLocker\x86\MWLService.exe -- (MWLService) SRV - [2010.01.30 01:52:58 | 000,260,640 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Acer VCM\RS_Service.exe -- (RS_Service) SRV - [2010.01.29 01:27:36 | 000,243,232 | ---- | M] (Acer Group) [Auto | Running] -- C:\Programme\Acer\Acer Updater\UpdaterService.exe -- (Updater Service) SRV - [2010.01.08 15:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Programme\Acer\Registration\GREGsvc.exe -- (GREGService) SRV - [2009.10.13 19:25:30 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R) SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2009.07.14 03:14:47 | 001,121,280 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) SRV - [2009.04.30 12:23:26 | 000,090,112 | ---- | M] () [Auto | Running] -- C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe -- (OMSI download service) ========== Driver Services (SafeList) ========== DRV - [2012.04.24 18:59:32 | 000,463,872 | ---- | M] (New Technology Quality, Ltd.) [Kernel | System | Unknown] -- C:\Windows\System32\ntq4he51.sys -- (ntq4he51) DRV - [2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector) DRV - [2010.10.01 02:07:44 | 000,052,096 | ---- | M] (Generic USB smartcard reader) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\MHIKEY10.sys -- (MHIKEY10) DRV - [2010.06.17 08:50:38 | 000,082,768 | ---- | M] (ENE Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\EUCR6SK.sys -- (EUCR) DRV - [2010.05.20 08:10:32 | 000,068,208 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L1C62x86.sys -- (L1C) DRV - [2010.04.07 04:04:42 | 001,792,512 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr) DRV - [2009.07.14 01:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp) DRV - [2009.07.14 01:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb) DRV - [2009.06.03 04:15:40 | 000,060,976 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk) DRV - [2009.06.03 04:15:38 | 000,016,432 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\mwlPSDNserv.sys -- (mwlPSDNServ) DRV - [2009.06.03 04:15:34 | 000,018,992 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\System32\drivers\mwlPSDFilter.sys -- (mwlPSDFilter) DRV - [2009.05.25 14:35:00 | 000,116,904 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1029unic.sys -- (s1029unic) Sony Ericsson Device 1029 USB Ethernet Emulation (WDM) DRV - [2009.05.25 14:34:56 | 000,122,280 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1029mdm.sys -- (s1029mdm) DRV - [2009.05.25 14:34:56 | 000,090,280 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1029bus.sys -- (s1029bus) Sony Ericsson Device 1029 driver (WDM) DRV - [2009.05.25 14:34:56 | 000,015,016 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1029mdfl.sys -- (s1029mdfl) DRV - [2009.05.25 14:34:54 | 000,115,880 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1029mgmt.sys -- (s1029mgmt) Sony Ericsson Device 1029 USB WMC Device Management Drivers (WDM) DRV - [2009.05.25 14:34:54 | 000,111,912 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1029obex.sys -- (s1029obex) DRV - [2009.05.25 14:34:54 | 000,026,024 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1029nd5.sys -- (s1029nd5) Sony Ericsson Device 1029 USB Ethernet Emulation (NDIS) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aod255&r=27b51210k635l0454ww85w47j2u684 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aod255&r=27b51210k635l0454ww85w47j2u684 IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aod255&r=27b51210k635l0454ww85w47j2u684 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\..\URLSearchHook: - No CLSID value found IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&AF=100478&babsrc=SP_ss&mntrId=cc132f45000000000000560f6e39c33d IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd IE - HKCU\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE412DE412 IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\***\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited) FF - HKCU\Software\MozillaPlugins\@www.flatcast.com/FlatViewer 5.2: C:\Windows\DOWNLO~1\NpFv530.dll (1 mal 1 Software GmbH) O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (Crunchdeal) - {01FEFC77-1031-43C6-BA9A-FEC28E75607C} - C:\Programme\Crunchdeal\0.0.2.6\crunchdll.dll (Crunchdeal Ltd) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (DealPly) - {A6174F27-1FFF-E1D6-A93F-BA48AD5DD448} - C:\Programme\DealPly\DealPlyIE.dll (DealPly Technologies Ltd) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (ICQ Sparberater) - {EC136321-1AE5-4A7F-B01C-5380D666175B} - C:\Programme\icq\Internet Explorer\icq.dll (solute gmbh) O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found. O4 - HKLM..\Run: [Acer ePower Management] C:\Programme\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated) O4 - HKLM..\Run: [AndroidManager] C:\Programme\Acer\Android Manager\AML.exe () O4 - HKLM..\Run: [EgisTecPMMUpdate] C:\Program Files\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.) O4 - HKLM..\Run: [EgisUpdate] C:\Program Files\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.) O4 - HKLM..\Run: [ETDWare] C:\Programme\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.) O4 - HKLM..\Run: [IAAnotif] C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation) O4 - HKLM..\Run: [iPatchData] C:\Programme\Acer\Updater\iUpdate.exe (Insyde Software Corp.) O4 - HKLM..\Run: [iSyncData] C:\Programme\Acer\Android Manager\iSync.exe (Insyde Software Corp.) O4 - HKLM..\Run: [LManager] C:\Programme\Launch Manager\LManager.exe (Dritek System Inc.) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [mwlDaemon] C:\Programme\EgisTec MyWinLocker\x86\mwlDaemon.exe (Egis Technology Inc.) O4 - HKLM..\Run: [SuiteTray] C:\Program Files\EgisTec MyWinLockerSuite\x86\SuiteTray.exe (Egis Technology Inc.) O4 - HKCU..\Run: [Facebook Update] C:\Users\***\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.) O4 - HKCU..\Run: [ICQ] C:\Program Files\ICQ7.6\ICQ.exe (ICQ, LLC.) O4 - HKCU..\Run: [Sony Ericsson PC Suite] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe (Sony Ericsson Mobile Communications AB) O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\Windows\System32\Macromed\Flash\FlashUtil10h_ActiveX.exe (Adobe Systems, Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra Button: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Programme\ICQ7.6\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Programme\ICQ7.6\ICQ.exe (ICQ, LLC.) O13 - gopher Prefix: missing O16 - DPF: {E55FD215-A32E-43FE-A777-A7E8F165F561} hxxp://92.51.137.94/objects/NpFv530.dll (Flatcast Viewer 5.3) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A796C01B-50C1-473E-8381-74C027566653}: DhcpNameServer = 192.168.1.254 O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Acer\Acer VCM\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKCU Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{e2f9da55-0fb1-11e0-8972-4c0f6e39c33d}\Shell - "" = AutoRun O33 - MountPoints2\{e2f9da55-0fb1-11e0-8972-4c0f6e39c33d}\Shell\AutoRun\command - "" = E:\Startme.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.06.27 09:22:27 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe [2012.06.27 09:05:40 | 000,237,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe [2012.06.26 23:34:42 | 000,000,000 | ---D | C] -- C:\f44573309d702cc0c2dc75f95d [2012.06.26 23:32:35 | 000,000,000 | ---D | C] -- C:\9f34a57e90f956cfcca096c26abb6311 [2012.06.26 23:18:24 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java [2012.06.26 23:17:33 | 000,000,000 | ---D | C] -- C:\Program Files\Oracle [2012.06.26 23:17:00 | 000,772,504 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\npDeployJava1.dll [2012.06.26 23:17:00 | 000,227,720 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaws.exe [2012.06.26 23:16:29 | 000,174,064 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaw.exe [2012.06.26 23:16:29 | 000,174,064 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\java.exe [2012.06.26 23:15:55 | 000,000,000 | ---D | C] -- C:\Program Files\Java [2012.06.26 22:07:58 | 000,000,000 | ---D | C] -- C:\3e34a0370a84ba65967851f7d0e961 [2012.06.26 20:17:46 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes [2012.06.26 20:17:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.06.26 20:17:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.06.26 20:17:39 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2012.06.26 20:17:38 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2012.06.26 18:53:17 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2012.06.26 18:53:14 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2012.06.26 18:53:14 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2012.06.26 18:53:13 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2012.06.26 18:53:11 | 001,800,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll [2012.06.26 18:53:10 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll [2012.06.26 18:53:08 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2012.06.20 13:09:18 | 002,342,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2012.06.20 13:09:10 | 000,129,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcorekmts.dll [2012.06.20 13:09:10 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpwsx.dll [2012.06.20 13:09:10 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdrmemptylst.exe [2011.12.19 18:20:04 | 000,148,736 | ---- | C] (Avanquest Software) -- C:\ProgramData\hpeC7E0.dll ========== Files - Modified Within 30 Days ========== [2012.06.27 09:23:12 | 000,302,592 | ---- | M] () -- C:\Users\***\Desktop\3v0d974h.exe [2012.06.27 09:22:27 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe [2012.06.27 09:14:07 | 000,000,000 | ---- | M] () -- C:\Users\***\defogger_reenable [2012.06.27 09:13:56 | 000,050,477 | ---- | M] () -- C:\Users\***\Desktop\Defogger.exe [2012.06.27 07:38:06 | 000,000,928 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2255263238-3343793464-1269229287-1000UA.job [2012.06.27 06:35:20 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.06.26 23:36:56 | 000,009,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.06.26 23:36:56 | 000,009,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.06.26 23:34:42 | 000,000,000 | -H-- | M] () -- C:\Windows\wusa.lock [2012.06.26 23:29:13 | 796,729,344 | -HS- | M] () -- C:\hiberfil.sys [2012.06.26 23:16:00 | 000,174,064 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\javaw.exe [2012.06.26 23:16:00 | 000,174,064 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\java.exe [2012.06.26 22:41:25 | 000,007,597 | ---- | M] () -- C:\Users\***\AppData\Local\Resmon.ResmonCfg [2012.06.26 22:07:11 | 000,648,704 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.06.26 22:07:11 | 000,611,332 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.06.26 22:07:11 | 000,105,512 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.06.26 22:07:10 | 000,128,930 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.06.26 19:40:08 | 000,003,072 | -H-- | M] () -- C:\Users\***\AppData\Roaming\panda.dll [2012.06.26 19:12:10 | 000,257,880 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT ========== Files Created - No Company Name ========== [2012.06.27 09:23:12 | 000,302,592 | ---- | C] () -- C:\Users\***\Desktop\3v0d974h.exe [2012.06.27 09:14:07 | 000,000,000 | ---- | C] () -- C:\Users\***\defogger_reenable [2012.06.27 09:13:48 | 000,050,477 | ---- | C] () -- C:\Users\***\Desktop\Defogger.exe [2012.06.26 23:34:42 | 000,000,000 | -H-- | C] () -- C:\Windows\wusa.lock [2012.06.26 22:41:25 | 000,007,597 | ---- | C] () -- C:\Users\***\AppData\Local\Resmon.ResmonCfg [2012.05.22 22:19:06 | 000,003,072 | -H-- | C] () -- C:\Users\***\AppData\Roaming\panda.dll [2011.12.27 22:53:13 | 000,098,304 | ---- | C] () -- C:\Windows\System32\redmonnt.dll [2011.11.16 22:49:22 | 000,005,120 | ---- | C] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.12.24 22:22:14 | 000,004,096 | ---- | C] () -- C:\Windows\d3dx.dat [2010.09.10 02:58:04 | 000,648,704 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2010.09.10 02:58:04 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2010.09.10 02:58:04 | 000,128,930 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2010.09.10 02:58:04 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2010.08.05 16:00:20 | 000,361,808 | ---- | C] () -- C:\Windows\EMCRI_E.dll [2010.08.05 15:39:30 | 000,131,984 | ---- | C] () -- C:\ProgramData\FullRemove.exe [2010.08.05 15:30:52 | 000,247,560 | ---- | C] () -- C:\Windows\System32\drivers\RTConvEQ.dat [2010.08.05 15:30:52 | 000,037,468 | ---- | C] () -- C:\Windows\System32\drivers\RtPCEE3.DAT [2010.08.05 15:30:52 | 000,001,448 | ---- | C] () -- C:\Windows\System32\drivers\RtHdatEx.dat [2010.08.05 15:30:52 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\RTEQEX3.dat [2010.08.05 15:30:52 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\RTEQEX2.dat [2010.08.05 15:30:52 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\RTEQEX1.dat [2010.08.05 15:30:52 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\RTEQEX0.dat [2010.08.05 15:30:52 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ1.dat [2010.08.05 15:30:52 | 000,000,024 | ---- | C] () -- C:\Windows\System32\drivers\rtkhdaud.dat ========== Alternate Data Streams ========== @Alternate Data Stream - 150 bytes -> C:\ProgramData\TEMP:5D7E5A8F @Alternate Data Stream - 149 bytes -> C:\ProgramData\TEMP:CDFF58FE @Alternate Data Stream - 149 bytes -> C:\ProgramData\TEMP:93EB7685 @Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:E36F5B57 @Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:1A60DE96 @Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:E1F04E8D @Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:4D066AD2 @Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:0B9176C0 @Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:798A3728 < End of report > Code:
ATTFilter OTL Extras logfile created on: 27.06.2012 09:28:27 - Run 1
OTL by OldTimer - Version 3.2.53.0 Folder = C:\Users\***\Desktop
Starter Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1013,09 Mb Total Physical Memory | 272,44 Mb Available Physical Memory | 26,89% Memory free
1,99 Gb Paging File | 1,04 Gb Available in Paging File | 52,43% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 215,79 Gb Total Space | 182,19 Gb Free Space | 84,43% Space Free | Partition Type: NTFS
Drive D: | 4,00 Gb Total Space | 2,65 Gb Free Space | 66,35% Space Free | Partition Type: FAT32
Computer Name: ***-PC | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{05A1A018-B680-4B28-AB5A-3A1D85C437EF}" = rport=137 | protocol=17 | dir=out | app=system |
"{0A01CD15-EC28-49E2-B8FF-F63CD396F973}" = lport=139 | protocol=6 | dir=in | app=system |
"{1194C2A2-BDEB-48A6-8799-B8F8B530BC75}" = lport=138 | protocol=17 | dir=in | app=system |
"{2162DB44-4718-47AC-B4CD-B91596A40EC5}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{34C8A0C7-018B-40F0-BBC0-54E0591175EB}" = lport=445 | protocol=6 | dir=in | app=system |
"{425CB6A4-5DBC-4722-97A3-BBD936158026}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{5565931C-FAAA-4D36-A0A7-3A895132F1E0}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{56641F2C-457F-46B2-BEAD-82A39FB61EDB}" = rport=139 | protocol=6 | dir=out | app=system |
"{60800B8A-AA2F-4A49-97C8-0A25CDB852E7}" = rport=138 | protocol=17 | dir=out | app=system |
"{856512F8-AD10-42C9-9D6E-7E8120D282DD}" = rport=445 | protocol=6 | dir=out | app=system |
"{8A966417-5FF8-44FC-929A-D14941422EA4}" = lport=137 | protocol=17 | dir=in | app=system |
"{8ECB41CD-E025-456E-BF6F-3EC52BF4628B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{C5511997-4F35-495B-A7AF-C126B371F8B2}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{E015509E-1A03-4D83-9FA4-EBEEEACF91BE}" = lport=2869 | protocol=6 | dir=in | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0D6D4362-5E9F-447A-A945-1060965AC1CF}" = protocol=6 | dir=in | app=c:\program files\icq7.6\icq.exe |
"{129559A7-BA0B-427A-B5F7-9CAFC8EB7E73}" = protocol=17 | dir=in | app=c:\program files\icq7.6\icq.exe |
"{16DA650A-4C66-4365-A9F5-CD7D33D937EB}" = protocol=6 | dir=in | app=c:\program files\icq7.6\icq.exe |
"{21D4B537-C381-4C5F-9E7A-EA1AD7650ACC}" = dir=in | app=c:\program files\acer\acer vcm\rs_service.exe |
"{2BB35494-295C-4CEC-A755-1F001AC7B5A5}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{39A0D151-B1A1-43F8-9FDE-B4C04BDA4CC7}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{6475A150-469C-4D51-8CC1-E9027491DB90}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe |
"{6E844D77-F029-484B-A205-FF217CF085F9}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{715DD107-D3A3-4904-AB41-D98A1CEB647D}" = dir=in | app=c:\program files\acer\acer vcm\vc.exe |
"{8932E954-39EF-40DB-B1C4-08DF0336B7E2}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{AA456E1E-BED9-4112-96F2-637494A29B0C}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{C8E937AE-3202-4725-AD9A-AF6EC705171A}" = dir=in | app=c:\users\***\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"{D2104D7F-1AE8-4475-87A7-481D20E694E2}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe |
"{F84AB4EC-3C2D-45C4-A4A2-D9E415B34C5C}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{FCB947C9-FE5F-40BA-A99B-477828541627}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{FEA79100-A104-4106-932B-4F98B734E244}" = protocol=17 | dir=in | app=c:\program files\icq7.6\icq.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{047F790A-7A2A-4B6A-AD02-38092BA63DAC}" = Acer VCM
"{0D7CD0D9-4A88-4A63-8F91-3F4E8F371768}" = MyWinLocker
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83217005FF}" = Java(TM) 7 Update 5
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie
"{2FFE93F0-BB72-4E52-8761-354D1AAA9387}" = Sony Ericsson PC Suite 6.011.00
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3DB0448D-AD82-4923-B305-D001E521A964}" = Acer ePower Management
"{3EFEF049-23D4-4B46-8903-4592FEA51018}" = Windows Live Movie Maker
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{51F026FA-5146-4232-A8BA-1364740BD053}" = Acer Crystal Eye webcam
"{523281E5-91DD-49F5-9D85-954148F7596A}" = AndroidInstaller
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{58F4D244-314F-4D26-B5EF-C28AB32E22CB}_is1" = Acer GameZone Console
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{738BF5C3-AF7B-4BB0-B7EF-E505EFC756BE}" = MyWinLocker Suite
"{7644E42D-B096-457F-8B5B-901238FC81AE}" = ICQ7.6
"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync
"{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = Avanquest update
"{7CAC6A44-C3DE-4153-ACA6-7524602C789E}" = Facebook Video Calling 1.2.0.159
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110300453}" = Spin & Win
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111199750}" = Cake Mania
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111307457}" = Galapago
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111355427}" = Poker Pop
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112662477}" = Merriam Websters Spell Jam
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11273477}" = Amazonia
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113786380}" = Heroes of Hellas
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113832110}" = Dream Day First Home
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11505173}" = Airport Mania First Flight
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11531173}" = Farm Frenzy 2
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{AC76BA86-7AD7-FFFF-7B44-A91000000001}" = Adobe Reader 9.1 MUI
"{C2695E83-CF1D-43D1-84FE-B3BEC561012A}" = Shredder
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E0B19DF7-B1C7-4937-82C4-0E4B1E346965}" = eBay Worldwide
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{EC136321-1AE5-4A7F-B01C-5380D666175B}" = ICQ Sparberater
"{EE171732-BEB4-4576-887D-CB62727F01CA}" = Acer Updater
"{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}" = Sony Ericsson PC Companion 1.60.00
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"3B29FD3CCF1F5B855DA0C521597413EBABE97DFB" = ENE USB Card Reader Driver
"Acer Registration" = Acer Registration
"Acer Screensaver" = Acer ScreenSaver
"Acer Welcome Center" = Welcome Center
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Crunchdeal" = Crunchdeal
"DealPly" = DealPly
"Elantech" = ETDWare PS/2-x86 7.0.6.6_WHQL
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"Identity Card" = Identity Card
"InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"InstallShield_{523281E5-91DD-49F5-9D85-954148F7596A}" = AndroidInstaller
"InstallShield_{738BF5C3-AF7B-4BB0-B7EF-E505EFC756BE}" = MyWinLocker Suite
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"WinLiveSuite_Wave3" = Windows Live Essentials
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 03.04.2012 16:39:37 | Computer Name = ***-PC | Source = ESENT | ID = 447
Description = Catalog Database (1440) Catalog Database: Ungültige Seitenverknüpfung
(Fehler -327) in B-Struktur (Objekt-Id: 9, PgnoRoot: 39) von Datenbank C:\Windows\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb
(4692 => 4696, 3055).
Error - 03.04.2012 16:39:37 | Computer Name = ***-PC | Source = ESENT | ID = 447
Description = Catalog Database (1440) Catalog Database: Ungültige Seitenverknüpfung
(Fehler -327) in B-Struktur (Objekt-Id: 9, PgnoRoot: 39) von Datenbank C:\Windows\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb
(4692 => 4696, 3055).
Error - 03.04.2012 16:39:37 | Computer Name = ***-PC | Source = ESENT | ID = 447
Description = Catalog Database (1440) Catalog Database: Ungültige Seitenverknüpfung
(Fehler -327) in B-Struktur (Objekt-Id: 9, PgnoRoot: 39) von Datenbank C:\Windows\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb
(4692 => 4696, 3055).
Error - 03.04.2012 16:39:37 | Computer Name = ***-PC | Source = ESENT | ID = 447
Description = Catalog Database (1440) Catalog Database: Ungültige Seitenverknüpfung
(Fehler -327) in B-Struktur (Objekt-Id: 9, PgnoRoot: 39) von Datenbank C:\Windows\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb
(4692 => 4696, 3055).
Error - 03.04.2012 16:39:37 | Computer Name = ***-PC | Source = ESENT | ID = 447
Description = Catalog Database (1440) Catalog Database: Ungültige Seitenverknüpfung
(Fehler -327) in B-Struktur (Objekt-Id: 9, PgnoRoot: 39) von Datenbank C:\Windows\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb
(4692 => 4696, 3055).
Error - 03.04.2012 16:39:37 | Computer Name = ***-PC | Source = ESENT | ID = 447
Description = Catalog Database (1440) Catalog Database: Ungültige Seitenverknüpfung
(Fehler -327) in B-Struktur (Objekt-Id: 9, PgnoRoot: 39) von Datenbank C:\Windows\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb
(4692 => 4696, 3055).
Error - 03.04.2012 16:39:37 | Computer Name = ***-PC | Source = ESENT | ID = 447
Description = Catalog Database (1440) Catalog Database: Ungültige Seitenverknüpfung
(Fehler -327) in B-Struktur (Objekt-Id: 9, PgnoRoot: 39) von Datenbank C:\Windows\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb
(4692 => 4696, 3055).
Error - 03.04.2012 16:39:37 | Computer Name = ***-PC | Source = ESENT | ID = 447
Description = Catalog Database (1440) Catalog Database: Ungültige Seitenverknüpfung
(Fehler -327) in B-Struktur (Objekt-Id: 9, PgnoRoot: 39) von Datenbank C:\Windows\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb
(4692 => 4696, 3055).
Error - 03.04.2012 16:39:38 | Computer Name = ***-PC | Source = ESENT | ID = 447
Description = Catalog Database (1440) Catalog Database: Ungültige Seitenverknüpfung
(Fehler -327) in B-Struktur (Objekt-Id: 9, PgnoRoot: 39) von Datenbank C:\Windows\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb
(4692 => 4696, 3055).
Error - 03.04.2012 16:39:38 | Computer Name = ***-PC | Source = ESENT | ID = 447
Description = Catalog Database (1440) Catalog Database: Ungültige Seitenverknüpfung
(Fehler -327) in B-Struktur (Objekt-Id: 9, PgnoRoot: 39) von Datenbank C:\Windows\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb
(4692 => 4696, 3055).
[ System Events ]
Error - 27.06.2012 03:39:14 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Arbeitsstationsdienst" wurde mit folgendem Fehler beendet:
%%126
Error - 27.06.2012 03:39:25 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Windows Modules Installer" wurde mit folgendem Fehler
beendet: %%126
Error - 27.06.2012 03:39:55 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Windows Modules Installer" wurde mit folgendem Fehler
beendet: %%126
Error - 27.06.2012 03:40:25 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Windows Modules Installer" wurde mit folgendem Fehler
beendet: %%126
Error - 27.06.2012 03:40:55 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Windows Modules Installer" wurde mit folgendem Fehler
beendet: %%126
Error - 27.06.2012 03:41:25 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Windows Modules Installer" wurde mit folgendem Fehler
beendet: %%126
Error - 27.06.2012 03:41:55 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Windows Modules Installer" wurde mit folgendem Fehler
beendet: %%126
Error - 27.06.2012 03:42:25 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Windows Modules Installer" wurde mit folgendem Fehler
beendet: %%126
Error - 27.06.2012 03:42:55 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Windows Modules Installer" wurde mit folgendem Fehler
beendet: %%126
Error - 27.06.2012 03:43:26 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Windows Modules Installer" wurde mit folgendem Fehler
beendet: %%126
< End of report >
Code:
ATTFilter GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-06-27 23:07:09
Windows 6.1.7600 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 WDC_WD25 rev.01.0
Running: fhr0tf10.exe; Driver: C:\Users\***\AppData\Local\Temp\fwloapow.sys
---- System - GMER 1.0.15 ----
Code \??\C:\Windows\system32\ntq4he51.sys ZwResumeThread [0x8A443712]
---- Kernel code sections - GMER 1.0.15 ----
.text ntkrnlpa.exe!ZwRollbackTransaction + 13E9 81E4B599 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 81E70092 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
PAGE peauth.sys A5C24B9B 72 Bytes JMP CF9FAE79
PAGE peauth.sys A5C24E20 101 Bytes [24, F0, 8F, E8, DD, 88, 39, ...]
---- User code sections - GMER 1.0.15 ----
.text C:\Windows\Explorer.EXE[344] SHELL32.dll!SHEvaluateSystemCommandTemplate + 58A6 7610E284 4 Bytes [90, 1B, 00, 10]
.text C:\Program Files\Internet Explorer\iexplore.exe[4192] USER32.dll!EnableWindow 7580A72E 5 Bytes JMP 6D139EAC C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4192] USER32.dll!DialogBoxIndirectParamW 75834AA7 5 Bytes JMP 6D288D86 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4192] USER32.dll!DialogBoxParamW 7583564A 5 Bytes JMP 6D09187B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4192] USER32.dll!DialogBoxParamA 7584CF6A 5 Bytes JMP 6D288D21 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4192] USER32.dll!DialogBoxIndirectParamA 7584D29C 5 Bytes JMP 6D288DEB C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4192] USER32.dll!MessageBoxIndirectA 7585E8C9 5 Bytes JMP 6D288CA8 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4192] USER32.dll!MessageBoxIndirectW 7585E9C3 5 Bytes JMP 6D288C2F C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4192] USER32.dll!MessageBoxExA 7585EA29 5 Bytes JMP 6D288BCB C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4192] USER32.dll!MessageBoxExW 7585EA4D 5 Bytes JMP 6D288B67 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4304] kernel32.dll!CreateThread 7573279D 5 Bytes JMP 6D0F75CB C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4304] USER32.dll!CreateDialogParamW 75809BFF 5 Bytes JMP 6D2890F0 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4304] USER32.dll!EnableWindow 7580A72E 5 Bytes JMP 6D139EAC C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4304] USER32.dll!GetAsyncKeyState 7580C09A 5 Bytes JMP 6D0DDEAD C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4304] USER32.dll!UnhookWindowsHookEx 7580CC7B 5 Bytes JMP 6D17ECE0 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4304] USER32.dll!CallNextHookEx 7580CC8F 5 Bytes JMP 6D157FDF C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4304] USER32.dll!DefWindowProcA 7580E0E4 7 Bytes JMP 6D0F97F5 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4304] USER32.dll!CreateWindowExA 7580E18A 5 Bytes JMP 6D10362B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4304] USER32.dll!CreateWindowExW 75810E51 5 Bytes JMP 6D1603B7 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4304] USER32.dll!SetWindowsHookExW 7581210A 5 Bytes JMP 6D1325AC C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4304] USER32.dll!GetKeyState 75814FDA 5 Bytes JMP 6D0DDD87 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4304] USER32.dll!IsDialogMessageW 75816F06 5 Bytes JMP 6D289855 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4304] USER32.dll!DefWindowProcW 7581724B 7 Bytes JMP 6D158042 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4304] USER32.dll!CreateDialogParamA 75823E79 5 Bytes JMP 6D2890B8 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4304] USER32.dll!IsDialogMessage 7582407A 5 Bytes JMP 6D28982D C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4304] USER32.dll!CreateDialogIndirectParamA 75829110 5 Bytes JMP 6D289128 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4304] USER32.dll!CreateDialogIndirectParamW 758308AD 5 Bytes JMP 6D289160 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4304] USER32.dll!DialogBoxIndirectParamW 75834AA7 5 Bytes JMP 6D288D86 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4304] USER32.dll!EndDialog 7583555C 5 Bytes JMP 6D289B01 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4304] USER32.dll!DialogBoxParamW 7583564A 5 Bytes JMP 6D09187B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4304] USER32.dll!SetKeyboardState 75836B52 5 Bytes JMP 6D28A11D C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4304] USER32.dll!SendInput 75837055 5 Bytes JMP 6D28A0C5 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4304] USER32.dll!SetCursorPos 7584C1D8 5 Bytes JMP 6D28A19E C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4304] USER32.dll!DialogBoxParamA 7584CF6A 5 Bytes JMP 6D288D21 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4304] USER32.dll!DialogBoxIndirectParamA 7584D29C 5 Bytes JMP 6D288DEB C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4304] USER32.dll!MessageBoxIndirectA 7585E8C9 5 Bytes JMP 6D288CA8 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4304] USER32.dll!MessageBoxIndirectW 7585E9C3 5 Bytes JMP 6D288C2F C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4304] USER32.dll!MessageBoxExA 7585EA29 5 Bytes JMP 6D288BCB C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4304] USER32.dll!MessageBoxExW 7585EA4D 5 Bytes JMP 6D288B67 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4304] USER32.dll!keybd_event 7585EC9B 5 Bytes JMP 6D28A082 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[4304] SHELL32.dll!SHChangeNotification_Lock + 45BA 7613B440 4 Bytes [CF, 01, 0D, 70]
.text C:\Program Files\Internet Explorer\iexplore.exe[4304] SHELL32.dll!SHChangeNotification_Lock + 45C2 7613B448 8 Bytes [E0, 61, 0C, 70, 79, F7, 0C, ...] {LOOPNZ 0x63; OR AL, 0x70; JNS 0xfffffffffffffffd; OR AL, 0x70}
.text C:\Program Files\Internet Explorer\iexplore.exe[4304] ole32.dll!OleLoadFromStream 76EB5BF6 5 Bytes JMP 6D28955F C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation)
---- Devices - GMER 1.0.15 ----
Device \Driver\ACPI_HAL \Device\00000045 halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)
---- EOF - GMER 1.0.15 ----
Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.61.0.1400 www.malwarebytes.org Datenbank Version: v2012.06.25.07 Windows 7 x86 NTFS (Abgesichertenmodus) Internet Explorer 9.0.8112.16421 *** :: ***-PC [Administrator] Schutz: Deaktiviert 26.06.2012 20:21:17 mbam-log-2012-06-26 (20-21-17).txt Art des Suchlaufs: Vollständiger Suchlauf Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 354458 Laufzeit: 1 Stunde(n), 1 Minute(n), 22 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 2 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FoxTab PDF Creator (Adware.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PDF Reader (Adware.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 1 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Panda Media Booster (Trojan.Agent.SZ) -> Daten: "C:\Users\***\AppData\Roaming\55cf8f.exe" -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 7 C:\Users\***\AppData\Roaming\55cf8f.exe (Trojan.Agent.SZ) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Windows\System32\aptw33ety.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\FoxTabPDFConverter\Uninstall\Uninstall.exe (Adware.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Program Files\PDFReader\Uninstall\Uninstall.exe (Adware.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\***\AppData\Local\Temp\tempfiles.exe (Trojan.FakeMS) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\***\AppData\Local\Temp\~!#C572.tmp (Trojan.Agent.SZ) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\***\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39\457895a7-216df5b8 (Trojan.FakeMS) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Geändert von Armin_M (28.06.2012 um 06:35 Uhr) Grund: Mbam-log zugefügt |
| Themen zu BKA-Trojaner |
| .com, adobe, alternate, autorun, bho, bluescreen, dealply, defender, ebay, error, fehler, firefox, flash player, format, generic, heuristiks/extra, heuristiks/shuriken, hängt, install.exe, lanmanworkstation, launch, limited.com/facebook, locker, logfile, mywinlocker, pdf creator, plug-in, programme, realtek, registry, rundll, scan, searchscopes, security, software, svchost.exe, usb, version=1.0, windows |
Baum-Darstellung