| |  Sporadisch öffnet sich der IE 45 mal. Hinzu erscheint ständig die (Iminet) suchmaschine als Startseite.
 Moin,
ich habe den verdacht ein paar Würmer etc... auf meinem PC zu haben. Es ist ein älterer Win xp von Asus.
Fast immer nach Start von Win öffnet sich (obwohl ich mit Firefox arbeite) der IE genau 45 mal! Sporadisch ercheint die Iminet suchmaschine als Home seite. Leider auch im Firefox. In der Systemsteuerung habe ich aber leider kein Iminet programm welches ich deinstallieren könnte.
System bereits komplett platt gemacht und neu aufgesetzt. Selbes Problem ... 
Hier die gewünschten Dateien:
OTL Zitat:
OTL logfile created on: 20.07.2013 13:46:37 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Dokumente und Einstellungen\Benny\Eigene Dateien\Downloads
Windows XP Media Center Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1023,20 Mb Total Physical Memory | 255,94 Mb Available Physical Memory | 25,01% Memory free
2,40 Gb Paging File | 1,72 Gb Available in Paging File | 71,49% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 107,85 Gb Total Space | 95,72 Gb Free Space | 88,75% Space Free | Partition Type: FAT32
Drive D: | 6,67 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Computer Name: BENNYS-NOTEBOOK | User Name: Benny | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2013.07.20 13:41:00 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Benny\Eigene Dateien\Downloads\OTL.exe
PRC - [2013.07.15 21:46:40 | 002,859,048 | ---- | M] (Iminent) -- C:\Programme\Gemeinsame Dateien\Umbrella\Umbrella.exe
PRC - [2013.03.09 23:29:28 | 000,356,376 | ---- | M] (Kaspersky Lab ZAO) -- C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe
PRC - [2013.02.05 17:48:44 | 000,272,248 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee Security Scan\3.0.318\SSScheduler.exe
PRC - [2006.08.06 22:11:00 | 000,573,440 | ---- | M] (Motorola Inc.) -- C:\Programme\Motorola\SMSERIAL\sm56hlpr.exe
PRC - [2006.08.02 00:38:30 | 000,802,816 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Wireless\Bin\ZCfgSvc.exe
PRC - [2006.08.02 00:32:44 | 000,696,320 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Wireless\Bin\iFrmewrk.exe
PRC - [2006.08.02 00:27:54 | 000,479,232 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Wireless\Bin\Dot1XCfg.exe
PRC - [2006.06.29 14:40:52 | 000,774,144 | ---- | M] () -- C:\Program Files\ASUS\PowerForPhone\PowerForPhone.exe
PRC - [2006.06.08 20:33:02 | 000,053,248 | ---- | M] (ASUSTeK Computer INC.) -- C:\Programme\Asus\ATK Media\DMedia.exe
PRC - [2006.06.01 14:02:54 | 000,491,520 | ---- | M] (ASUSTek Computer Inc.) -- C:\Programme\Asus\Asus MultiFrame\MultiFrame.exe
PRC - [2006.05.16 11:42:52 | 001,777,664 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
PRC - [2006.04.24 14:25:44 | 000,073,728 | ---- | M] (Hewlett-Packard Company) -- c:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
PRC - [2006.04.17 02:24:30 | 000,110,592 | ---- | M] () -- C:\WINDOWS\ATK0100\HControl.exe
PRC - [2006.04.07 17:36:46 | 000,290,816 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
PRC - [2006.04.01 01:37:00 | 002,170,880 | ---- | M] () -- C:\WINDOWS\ATK0100\ATKOSD.exe
PRC - [2006.03.24 20:00:00 | 001,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006.03.14 17:46:00 | 000,090,112 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Programme\Asus\Power4 Gear\BatteryLife.exe
PRC - [2006.03.13 23:30:16 | 000,593,920 | ---- | M] (Infineon Technologies AG) -- c:\Programme\Infineon\Security Platform Software\SpTNA.exe
PRC - [2006.03.10 00:41:42 | 000,131,072 | ---- | M] (Infineon Technologies AG) -- c:\Programme\Infineon\Security Platform Software\PSDrt.exe
PRC - [2006.01.27 18:17:50 | 000,221,184 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe
PRC - [2006.01.23 21:47:32 | 000,073,728 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
PRC - [2006.01.02 17:41:22 | 000,045,056 | ---- | M] (ATI Technologies Inc.) -- C:\Programme\ATI Technologies\ATI.ACE\CLI.exe
PRC - [2005.11.29 03:51:04 | 000,099,872 | ---- | M] (Infineon Technologies AG) -- c:\Programme\Infineon\Security Platform Software\PSDsrvc.EXE
PRC - [2005.10.17 17:09:34 | 000,987,136 | ---- | M] () -- C:\Programme\Wireless Console 2\wcourier.exe
PRC - [2004.12.14 04:44:06 | 000,029,696 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
========== Modules (No Company Name) ==========
MOD - [2013.03.09 23:29:16 | 001,310,136 | ---- | M] () -- C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\kpcengine.2.2.dll
MOD - [2012.08.17 21:38:56 | 000,479,160 | ---- | M] () -- C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\dblite.dll
MOD - [2006.11.24 18:42:42 | 003,379,200 | ---- | M] () -- c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_40a2f1cb\mscorlib.dll
MOD - [2006.11.24 18:42:40 | 000,835,584 | ---- | M] () -- c:\windows\assembly\nativeimages1_v1.1.4322\system.drawing\1.0.5000.0__b03f5f7f11d50a3a_102fd2bc\system.drawing.dll
MOD - [2006.11.24 18:42:34 | 002,088,960 | ---- | M] () -- c:\windows\assembly\nativeimages1_v1.1.4322\system.xml\1.0.5000.0__b77a5c561934e089_bf0b8786\system.xml.dll
MOD - [2006.11.24 18:42:30 | 003,014,656 | ---- | M] () -- c:\windows\assembly\nativeimages1_v1.1.4322\system.windows.forms\1.0.5000.0__b77a5c561934e089_d5403d15\system.windows.forms.dll
MOD - [2006.11.24 18:42:24 | 001,953,792 | ---- | M] () -- c:\windows\assembly\nativeimages1_v1.1.4322\system\1.0.5000.0__b77a5c561934e089_840c5558\system.dll
MOD - [2006.11.24 18:42:18 | 001,257,472 | ---- | M] () -- c:\windows\assembly\gac\system.web\1.0.5000.0__b03f5f7f11d50a3a\system.web.dll
MOD - [2006.11.24 18:42:18 | 001,224,704 | ---- | M] () -- c:\windows\assembly\gac\system\1.0.5000.0__b77a5c561934e089\system.dll
MOD - [2006.11.24 18:42:16 | 002,052,096 | ---- | M] () -- c:\windows\assembly\gac\system.windows.forms\1.0.5000.0__b77a5c561934e089\system.windows.forms.dll
MOD - [2006.11.24 18:42:16 | 001,339,392 | ---- | M] () -- c:\windows\assembly\gac\system.xml\1.0.5000.0__b77a5c561934e089\system.xml.dll
MOD - [2006.11.24 18:42:16 | 000,466,944 | ---- | M] () -- c:\windows\assembly\gac\system.drawing\1.0.5000.0__b03f5f7f11d50a3a\system.drawing.dll
MOD - [2006.11.24 18:42:16 | 000,372,736 | ---- | M] () -- c:\windows\assembly\gac\system.management\1.0.5000.0__b03f5f7f11d50a3a\system.management.dll
MOD - [2006.11.24 18:42:16 | 000,323,584 | ---- | M] () -- c:\windows\assembly\gac\system.runtime.remoting\1.0.5000.0__b77a5c561934e089\system.runtime.remoting.dll
MOD - [2006.08.02 00:26:20 | 000,118,784 | ---- | M] () -- C:\Programme\Intel\Wireless\Bin\iWMSProv.dll
MOD - [2006.08.02 00:24:54 | 000,348,160 | ---- | M] () -- C:\Programme\Intel\Wireless\Bin\IntStngs.dll
MOD - [2006.06.29 14:40:52 | 000,774,144 | ---- | M] () -- C:\Program Files\ASUS\PowerForPhone\PowerForPhone.exe
MOD - [2006.06.29 10:17:04 | 000,291,840 | ---- | M] () -- C:\WINDOWS\system32\sbe.dll
MOD - [2006.06.23 13:07:08 | 001,167,360 | ---- | M] () -- C:\Programme\Intel\Wireless\Bin\acAuth.dll
MOD - [2006.05.17 16:39:26 | 000,028,672 | ---- | M] () -- C:\Programme\Asus\Asus MultiFrame\HookTitle.dll
MOD - [2006.04.17 02:24:30 | 000,110,592 | ---- | M] () -- C:\WINDOWS\ATK0100\HControl.exe
MOD - [2006.04.01 01:37:00 | 002,170,880 | ---- | M] () -- C:\WINDOWS\ATK0100\ATKOSD.exe
MOD - [2006.03.24 20:00:00 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll
MOD - [2005.10.17 17:09:34 | 000,987,136 | ---- | M] () -- C:\Programme\Wireless Console 2\wcourier.exe
MOD - [2005.07.22 21:30:20 | 000,065,536 | ---- | M] () -- C:\WINDOWS\system32\TosCommAPI.dll
MOD - [2004.07.20 17:04:02 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\TosBtHcrpAPI.dll
MOD - [2004.05.27 19:13:10 | 000,057,344 | ---- | M] () -- C:\WINDOWS\ATK0100\CMSSC.dll
========== Services (SafeList) ==========
SRV - File not found [On_Demand | Stopped] -- c:\Programme\Gemeinsame Dateien\Symantec Shared\Security Console\NSCSRVCE.EXE -- (NSCService)
SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - File not found [Auto | Stopped] -- c:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe -- (ccSetMgr)
SRV - File not found [Auto | Stopped] -- c:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe -- (ccEvtMgr)
SRV - [2013.07.15 21:46:40 | 002,859,048 | ---- | M] (Iminent) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Umbrella\Umbrella.exe -- (SProtection)
SRV - [2013.07.11 15:19:26 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.03.29 19:59:22 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.03.09 23:29:28 | 000,356,376 | ---- | M] (Kaspersky Lab ZAO) [Auto | Running] -- C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe -- (AVP)
SRV - [2013.02.05 17:48:00 | 000,235,216 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Programme\McAfee Security Scan\3.0.318\McCHSvc.exe -- (McComponentHostService)
SRV - [2006.10.26 19:49:34 | 000,441,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2006.04.24 14:25:44 | 000,073,728 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- c:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe -- (LightScribeService)
SRV - [2005.11.29 03:51:04 | 000,099,872 | ---- | M] (Infineon Technologies AG) [Auto | Running] -- c:\Programme\Infineon\Security Platform Software\PSDsrvc.EXE -- (PersonalSecureDriveService)
SRV - [2005.04.04 00:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- c:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Programme\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - [2013.06.24 20:15:56 | 000,044,000 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\kltdi.sys -- (kltdi)
DRV - [2013.04.23 23:00:46 | 000,145,040 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\kneps.sys -- (kneps)
DRV - [2013.04.23 23:00:42 | 000,591,968 | ---- | M] (Kaspersky Lab ZAO) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\klif.sys -- (KLIF)
DRV - [2012.10.25 12:42:02 | 000,024,920 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\klmouflt.sys -- (klmouflt)
DRV - [2012.10.25 12:42:02 | 000,024,408 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\klkbdflt.sys -- (klkbdflt)
DRV - [2012.06.27 14:09:08 | 000,035,672 | ---- | M] (Kaspersky Lab ZAO) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\klim5.sys -- (klim5)
DRV - [2012.06.19 17:28:12 | 000,136,024 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\kl1.sys -- (kl1)
DRV - [2011.06.16 11:21:42 | 000,059,520 | ---- | M] (SCM Microsystems Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SCR3XX2K.sys -- (SCR3XX2K)
DRV - [2008.11.13 15:10:06 | 000,007,680 | ---- | M] (SCM Microsystems Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\STCFUx32.sys -- (STCFUx32)
DRV - [2006.08.08 23:15:14 | 001,116,544 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SynMini.sys -- (SynMini)
DRV - [2006.08.08 23:15:14 | 000,007,808 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SynScan.sys -- (SynScan)
DRV - [2006.08.06 22:13:50 | 000,980,608 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\smserial.sys -- (smserial)
DRV - [2006.08.02 03:07:52 | 001,681,920 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2006.08.02 01:27:48 | 000,012,544 | ---- | M] (Intel Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans)
DRV - [2006.07.24 01:15:04 | 004,353,024 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService)
DRV - [2006.05.18 21:46:16 | 000,110,976 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tosrfbd.sys -- (Tosrfbd)
DRV - [2006.05.09 11:21:54 | 000,040,192 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tosrfusb.sys -- (Tosrfusb)
DRV - [2006.05.09 10:33:54 | 000,062,848 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tosrfhid.sys -- (Tosrfhid)
DRV - [2006.04.19 13:57:44 | 000,047,488 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tosporte.sys -- (tosporte)
DRV - [2006.03.16 10:45:12 | 000,037,632 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tosrfbnp.sys -- (Tosrfbnp)
DRV - [2006.03.15 10:52:40 | 000,052,864 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tosrfsnd.sys -- (TosRfSnd)
DRV - [2006.01.24 10:45:56 | 000,034,944 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ipswuio.sys -- (ipswuio)
DRV - [2005.11.29 03:50:58 | 000,036,768 | ---- | M] (Infineon Technologies AG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\psd.sys -- (PersonalSecureDrive)
DRV - [2005.11.16 20:28:32 | 000,028,928 | ---- | M] (REDC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2005.11.16 01:08:16 | 000,078,976 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTL8023xp)
DRV - [2005.11.01 17:54:50 | 000,051,584 | ---- | M] (REDC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2005.10.20 20:19:34 | 000,036,352 | ---- | M] (Infineon Technologies AG) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ifxtpm.sys -- (IFXTPM)
DRV - [2005.09.16 23:20:06 | 000,108,168 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\Programme\Symantec\SYMEVENT.SYS -- (SymEvent)
DRV - [2005.08.01 16:45:08 | 000,064,896 | ---- | M] (TOSHIBA Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tosrfcom.sys -- (Tosrfcom)
DRV - [2005.07.11 18:58:56 | 000,003,712 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\toshidpt.sys -- (toshidpt)
DRV - [2005.02.17 08:07:48 | 000,005,632 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ATKACPI.sys -- (MTsensor)
DRV - [2005.01.06 13:42:42 | 000,018,612 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\tosrfnds.sys -- (tosrfnds)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKLM\..\SearchScopes\{BFFED5CA-8BDF-47CC-AED0-23F4E6D77732}: "URL" = hxxp://start.iminent.com/?appId=58C9375B-F904-447E-A683-C29A675693C5&ref=toolbox&q={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.zonealarm.com/?src=hp&tbid=goughDev3&Lan=de&gu=02846d6c54de4a4c8dff8932f432489a&tu=10G9z00981B0CO0&sku=&tstsId=&ver=&
IE - HKCU\..\SearchScopes,DefaultScope = {BFFED5CA-8BDF-47CC-AED0-23F4E6D77732}
IE - HKCU\..\SearchScopes\{BFFED5CA-8BDF-47CC-AED0-23F4E6D77732}: "URL" = hxxp://start.iminent.com/?appId=58C9375B-F904-447E-A683-C29A675693C5&ref=toolbox&q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.selectedEngine: "SearchTheWeb"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:22.0
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/McAfeeMssPlugin: C:\Programme\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.5: C:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\url_advisor@kaspersky.com: C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\FFExt\url_advisor@kaspersky.com [2013.03.06 20:08:44 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\virtual_keyboard@kaspersky.com: C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\FFExt\virtual_keyboard@kaspersky.com [2013.03.06 20:08:44 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\content_blocker@kaspersky.com: C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\FFExt\content_blocker@kaspersky.com [2013.03.06 20:08:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Components: C:\Programme\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins
[2013.04.07 04:09:56 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Benny\Anwendungsdaten\Mozilla\Extensions
[2013.07.20 13:21:12 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Benny\Anwendungsdaten\Mozilla\Firefox\Profiles\86fb2sgg.default\extensions
[2013.07.20 13:21:12 | 000,001,502 | ---- | M] () -- C:\Dokumente und Einstellungen\Benny\Anwendungsdaten\Mozilla\Firefox\Profiles\86fb2sgg.default\searchplugins\zonealarm.xml
[2013.06.25 20:42:18 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\browser\extensions
[2013.06.25 20:42:18 | 000,000,000 | ---D | M] (Default) -- C:\Programme\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
O1 HOSTS File: ([2006.03.24 20:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (MSS+ Identifier) - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Programme\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
O2 - BHO: (Content Blocker Plugin) - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
O2 - BHO: (Virtual Keyboard Plugin) - {73455575-E40C-433C-9784-C78DC7761455} - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
O2 - BHO: (URL Advisor Plugin) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O4 - HKLM..\Run: [ABLKSR] C:\WINDOWS\ABLKSR\ABLKSR.EXE (ASYSTeK Computer INC.)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [ATICCC] C:\Programme\ATI Technologies\ATI.ACE\CLIStart.exe ()
O4 - HKLM..\Run: [ATKMEDIA] C:\Programme\Asus\ATK Media\DMedia.exe (ASUSTeK Computer INC.)
O4 - HKLM..\Run: [AVP] C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [ccApp] "c:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe" File not found
O4 - HKLM..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe ()
O4 - HKLM..\Run: [IntelWireless] C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)
O4 - HKLM..\Run: [IntelZeroConfig] C:\Programme\Intel\Wireless\bin\ZCfgSvc.exe (Intel Corporation)
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [Power_Gear] C:\Programme\ASUS\Power4 Gear\BatteryLife.exe (ASUSTeK Computer Inc.)
O4 - HKLM..\Run: [PowerForPhone] C:\Program Files\ASUS\PowerForPhone\PowerForPhone.exe ()
O4 - HKLM..\Run: [SMSERIAL] C:\Programme\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.)
O4 - HKLM..\Run: [Wireless Console 2] C:\Programme\Wireless Console 2\wcourier.exe ()
O4 - HKLM..\Run: [ZoneAlarm] "C:\Programme\CheckPoint\ZoneAlarm\zatray.exe" File not found
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\MultiFrame.lnk = C:\Programme\Asus\Asus MultiFrame\MultiFrame.exe (ASUSTek Computer Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Bluetooth Manager.lnk = C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Reader Speed Launch.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\McAfee Security Scan Plus.lnk = C:\Programme\McAfee Security Scan\3.0.318\SSScheduler.exe (McAfee, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 28
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Virtuelle Tastatur - {0C4CC089-D306-440D-9772-464E226F6539} - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
O9 - Extra Button: Links untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BE80D841-F9DA-4C8B-9573-6BD10863928F}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\IfxWlxEN: DllName - (IfxWlxEN.dll) - C:\WINDOWS\System32\IfxWlxEN.dll (Infineon Technologies AG)
O20 - Winlogon\Notify\klogon: DllName - (C:\WINDOWS\system32\klogon.dll) - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab ZAO)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Benny\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Benny\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.11.24 18:37:50 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
========== Files/Folders - Created Within 30 Days ==========
[2013.07.20 13:21:07 | 000,000,000 | ---D | C] -- C:\Programme\CheckPoint
[2013.07.20 13:20:11 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CheckPoint
[2013.07.20 13:08:16 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Benny\Eigene Dateien\LogExpert
[2013.07.20 13:07:07 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Benny\Anwendungsdaten\LogExpert
[2013.07.16 14:09:08 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\English learning Software
[2013.07.16 14:08:38 | 000,000,000 | ---D | C] -- C:\Programme\Auralog
[2013.06.25 20:42:01 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Firefox
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2013.07.20 13:44:38 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013.07.20 13:44:34 | 1072,975,872 | -HS- | M] () -- C:\hiberfil.sys
[2013.07.20 13:23:18 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013.07.19 19:52:24 | 000,000,011 | ---- | M] () -- C:\trace.ini
[2013.07.16 14:09:10 | 000,001,786 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\English learning Software.lnk
[2013.07.14 21:33:10 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013.07.11 08:42:34 | 000,002,505 | ---- | M] () -- C:\Dokumente und Einstellungen\Benny\Desktop\Microsoft Office Excel 2007.lnk
[2013.06.24 20:15:56 | 000,044,000 | ---- | M] (Kaspersky Lab ZAO) -- C:\WINDOWS\System32\drivers\kltdi.sys
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
========== Files Created - No Company Name ==========
[2013.07.16 14:09:09 | 000,000,011 | ---- | C] () -- C:\trace.ini
[2013.07.16 14:09:08 | 000,001,786 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\English learning Software.lnk
[2013.03.27 00:30:40 | 000,000,880 | ---- | C] () -- C:\WINDOWS\HBCIKRNL.INI
[2013.03.11 17:04:49 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2013.03.11 16:47:34 | 000,000,106 | ---- | C] () -- C:\Dokumente und Einstellungen\Benny\Anwendungsdaten\wklnhst.dat
[2013.03.09 20:51:55 | 000,000,000 | ---- | C] () -- C:\WINDOWS\tosOBEX.INI
[2013.03.06 19:26:46 | 000,000,546 | ---- | C] () -- C:\WINDOWS\System32\ABF3JP.DAT
[2013.03.06 19:25:55 | 000,000,138 | ---- | C] () -- C:\Dokumente und Einstellungen\Benny\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
========== ZeroAccess Check ==========
[2006.11.24 18:35:16 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2006.02.21 10:04:50 | 001,495,040 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2006.03.24 20:00:00 | 000,472,064 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2006.03.24 20:00:00 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
========== LOP Check ==========
[2006.11.24 19:37:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Infineon
[2013.03.10 14:43:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\StarMoney 8.0
[2013.03.27 00:28:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Software
[2013.04.06 08:17:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Iminent
[2013.07.20 13:20:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CheckPoint
[2006.11.24 19:37:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Benny\Anwendungsdaten\Infineon
[2013.03.11 16:47:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Benny\Anwendungsdaten\Template
[2013.07.20 13:07:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Benny\Anwendungsdaten\LogExpert
========== Purity Check ==========
< End of report >
|
TEXT (OTL) Zitat:
OTL Extras logfile created on: 20.07.2013 13:46:37 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Dokumente und Einstellungen\Benny\Eigene Dateien\Downloads
Windows XP Media Center Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1023,20 Mb Total Physical Memory | 255,94 Mb Available Physical Memory | 25,01% Memory free
2,40 Gb Paging File | 1,72 Gb Available in Paging File | 71,49% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 107,85 Gb Total Space | 95,72 Gb Free Space | 88,75% Space Free | Partition Type: FAT32
Drive D: | 6,67 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Computer Name: BENNYS-NOTEBOOK | User Name: Benny | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htafile [open] -- "%1" %*
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\Programme\Messenger\MSMSGS.EXE" = C:\Programme\Messenger\MSMSGS.EXE:*:Enabled:Windows Messenger -- (Microsoft Corporation)
"C:\Programme\Iminent\Iminent.Messengers.exe" = C:\Programme\Iminent\Iminent.Messengers.exe:*:Enabled:Iminent.Messengers Firewall Rule -- (Iminent)
"C:\Programme\Skype\Phone\Skype.exe" = C:\Programme\Skype\Phone\Skype.exe:*:Enabled:Skype -- ()
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0E2B0B41-7E08-4F9F-B21F-41C4133F43B7}" = mLogView
"{1248C09A-BD6B-47F5-BF3F-CD2B700D9FCB}" = ccCommon
"{139B0FFA-187E-4BA1-BCA6-6B56B2B6AB8C}" = ATK Media
"{17E2F183-BAC4-4D01-BD7A-59F781E17EFA}" = REALTEK PCIE NIC Driver
"{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}" = LifeFrame2
"{1FCBD504-AB7D-4757-9A14-850348384B08}" = StarMoney
"{23FB368F-1399-4EAC-817C-4B83ECBE3D83}" = mProSafe
"{2792F12C-3515-4D69-8083-B557AF35F06F}" = LightScribe 1.4.89.1
"{2A8CF485-5A4D-4C7D-8ACF-4AB98914D529}" = Infineon TPM Professional Package
"{2EBF25F1-F8A2-40EA-92BE-931C142A44E2}" = CC_ccProxyExt
"{30738666-9805-4926-A78F-91DA33B6C437}" = ccPxyCore
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3672B097-EA69-4bfe-B92F-29AE6D9D2B34}" = Norton Internet Security
"{36CDA33B-909B-4719-97D1-C4B99309BDC7}" = ATI Parental Control & Encoder
"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3E9D596A-61D4-4239-BD19-2DB984D2A16F}" = mIWA
"{4462AD13-F2AA-4CBD-9F95-293C38EED870}" = Power4 Gear
"{560985FB-4B76-4121-9189-7A2CDC7886D6}" = Kaspersky Anti-Virus 2013
"{590D9112-F27C-42AF-BF19-531809D69FBA}" = SCR3xxx Smart Card Reader
"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0
"{82A5BF38-8461-4A5C-B2C9-24F5256D92A6}" = Norton Protection Center
"{83F73CB1-7705-49D1-9852-84D839CA2A45}" = Wireless Console 2
"{89DDBCD4-B326-4545-9A05-26C7B16C1DEB}" = PowerForPhone
"{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr
"{8C6BB412-D3A8-4AAE-A01B-35B681789D68}" = mHelp
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (German) 12
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{909B62B0-8ACA-4061-A83B-09CAEF609619}" = MSXML 6.0 Parser
"{90B0D222-8C21-4B35-9262-53B042F18AF9}" = mPfWiz
"{90CC4231-94AC-45CD-991A-0253BFAC0650}" = mDrWiFi
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{94658027-9F16-4509-BBD7-A59FE57C3023}" = mZConfig
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{9CC89556-3578-48DD-8408-04E66EBEF401}" = mXML
"{9D48531D-2135-49FC-BC29-ACCDA5396A76}" = Asus MultiFrame
"{9D6D7811-43B3-463C-BC79-5D1755269989}" = Net4Switch
"{A0F925BF-5C55-44C2-A4E7-5A4C59791C29}" = mDriver
"{AC76BA86-7AD7-1033-7B44-A70000000000}" = Adobe Reader 7.0
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows
"{DE10AB76-4756-4913-BE25-55D1C1051F9A}" = WinFlash
"{E161E7E7-9875-4F7F-AFC7-72D40B45B5F3}" = ATI Catalyst Control Center
"{E2F2B987-F2BC-4969-95F2-92099486B811}" = StarMoney
"{E81667C6-2856-46D6-ABEA-6A2F42166779}" = mCore
"{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}" = mMHouse
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}" = mWlsSafe
"{FFB4DD53-28B7-4981-BFF0-9BD801F61095}" = Norton Internet Security
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"All ATI Software" = ATI - Dienstprogramm zur Deinstallation der Software
"ATI Display Driver" = ATI Display Driver
"HControl" = ATK0100 ACPI UTILITY
"InstallWIX_{560985FB-4B76-4121-9189-7A2CDC7886D6}" = Kaspersky Anti-Virus 2013
"Jumbo-Tech TachWare_CDInst21" = Jumbo-Tech TachWare
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 22.0 (x86 de)" = Mozilla Firefox 22.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Nero - Burning Rom!UninstallKey" = Nero OEM
"PROHYBRIDR" = 2007 Microsoft Office system
"ProInst" = Intel(R) PROSet/Wireless Software
"Revo Uninstaller" = Revo Uninstaller 1.94
"Skype_is1" = Skype 2.0
"SMSERIAL" = Motorola SM56 Speakerphone Modem
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TMM90INTEGRAL2ANG" = English learning Software
"USB2.0 1.3M WebCam" = USB2.0 1.3M WebCam
"VLC media player" = VLC media player 2.0.5
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format Runtime
"ZoneAlarm Free Antivirus + Firewall" = ZoneAlarm Free Antivirus + Firewall
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 10.03.2013 09:44:25 | Computer Name = BENNYS-NOTEBOOK | Source = crypt32 | ID = 131077
Description = Der automatische Aktualisierungsabruf des Drittanbieterstammzertifikats
von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/91C6D6EE3E8AC86384E548C299295C756C817B81.crt>
ist fehlgeschlagen mit dem Fehler: Dieser Vorgang wurde wegen Zeitüberschreitung
zurückgegeben. .
Error - 13.03.2013 14:36:38 | Computer Name = BENNYS-NOTEBOOK | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
ist fehlgeschlagen mit dem Fehler: Die Serververbindung konnte nicht hergestellt
werden. .
Error - 17.03.2013 14:46:12 | Computer Name = BENNYS-NOTEBOOK | Source = Media Center Scheduler | ID = 0
Description =
Error - 02.04.2013 06:32:26 | Computer Name = BENNYS-NOTEBOOK | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung svchost.exe, Version 5.1.2600.2180, fehlgeschlagenes
Modul msvcrt.dll, Version 7.0.2600.2180, Fehleradresse 0x000367ef.
Error - 06.04.2013 03:51:00 | Computer Name = BENNYS-NOTEBOOK | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung TachWare.exe, Version 2.0.1.294, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
Error - 17.04.2013 11:28:53 | Computer Name = BENNYS-NOTEBOOK | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
ist fehlgeschlagen mit dem Fehler: Der Servername oder die Serveradresse konnte
nicht verarbeitet werden. .
Error - 13.05.2013 15:40:08 | Computer Name = BENNYS-NOTEBOOK | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
ist fehlgeschlagen mit dem Fehler: Dieser Vorgang wurde wegen Zeitüberschreitung
zurückgegeben. .
Error - 14.05.2013 14:36:01 | Computer Name = BENNYS-NOTEBOOK | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
ist fehlgeschlagen mit dem Fehler: Dieser Vorgang wurde wegen Zeitüberschreitung
zurückgegeben. .
Error - 11.07.2013 11:04:40 | Computer Name = BENNYS-NOTEBOOK | Source = crypt32 | ID = 131080
Description = Der automatische Aktualisierungsabruf der Drittanbieterstammlisten-Sequenznummer
von <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
ist fehlgeschlagen mit dem Fehler: Der Servername oder die Serveradresse konnte
nicht verarbeitet werden. .
[ OSession Events ]
Error - 25.06.2013 16:16:12 | Computer Name = BENNYS-NOTEBOOK | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 2618
seconds with 1500 seconds of active time. This session ended with a crash.
Error - 11.07.2013 12:21:39 | Computer Name = BENNYS-NOTEBOOK | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 5229
seconds with 720 seconds of active time. This session ended with a crash.
[ System Events ]
Error - 14.07.2013 15:34:04 | Computer Name = BENNYS-NOTEBOOK | Source = Windows Update Agent | ID = 16
Description = Verbindung kann nicht hergestellt werden: Die Verbindung mit dem Dienst
für automatische Updates konnte nicht hergestellt werden, so dass keine Updates
zum angegebenen Zeitplan übertragen und installiert werden können. Es wird weiterhin
versucht, eine Verbindung herzustellen.
Error - 14.07.2013 15:35:11 | Computer Name = BENNYS-NOTEBOOK | Source = DCOM | ID = 10010
Description = Der Server "{7F6316B4-4D69-4765-B0A3-B2598F2FA80A}" konnte innerhalb
des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error - 16.07.2013 07:36:59 | Computer Name = BENNYS-NOTEBOOK | Source = SCardSvr | ID = 610
Description = Smartcardleser "SCM Microsystems Inc. SCR35xx USB Smart Card Reader
0" verweigerte IOCTL GET_ATTRIBUTE: Die Anforderung wird nicht unterstützt.
Error - 16.07.2013 07:37:09 | Computer Name = BENNYS-NOTEBOOK | Source = SCardSvr | ID = 610
Description = Smartcardleser "SCM Microsystems Inc. SCR35xx USB Smart Card Reader
0" verweigerte IOCTL GET_ATTRIBUTE: Die Anforderung wird nicht unterstützt.
Error - 16.07.2013 07:37:13 | Computer Name = BENNYS-NOTEBOOK | Source = SCR3XX2K | ID = 0
Description =
Error - 16.07.2013 07:37:13 | Computer Name = BENNYS-NOTEBOOK | Source = SCardSvr | ID = 610
Description = Smartcardleser "SCM Microsystems Inc. SCR35xx USB Smart Card Reader
0" verweigerte IOCTL TRANSMIT: Das Zeitlimit für die Semaphore wurde erreicht.
Error - 19.07.2013 12:59:35 | Computer Name = BENNYS-NOTEBOOK | Source = Windows Update Agent | ID = 16
Description = Verbindung kann nicht hergestellt werden: Die Verbindung mit dem Dienst
für automatische Updates konnte nicht hergestellt werden, so dass keine Updates
zum angegebenen Zeitplan übertragen und installiert werden können. Es wird weiterhin
versucht, eine Verbindung herzustellen.
Error - 20.07.2013 07:21:10 | Computer Name = BENNYS-NOTEBOOK | Source = SideBySide | ID = 16842784
Description = Abhängige Assemblierung "Microsoft.VC90.CRT" konnte nicht gefunden
werden. "Last Error": Die referenzierte Assemblierung ist nicht auf dem Computer
installiert.
Error - 20.07.2013 07:21:10 | Computer Name = BENNYS-NOTEBOOK | Source = SideBySide | ID = 16842811
Description = Resolve Partial Assembly ist für Microsoft.VC90.CRT fehlgeschlagen.
Referenzfehlermeldung:
Die referenzierte Assemblierung ist nicht auf dem Computer installiert. .
Error - 20.07.2013 07:21:10 | Computer Name = BENNYS-NOTEBOOK | Source = SideBySide | ID = 16842811
Description = Generate Activation Context ist für C:\DOKUME~1\Benny\LOKALE~1\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\clean_tool.exe
fehlgeschlagen. Referenzfehlermeldung: Der Vorgang wurde erfolgreich beendet. .
< End of report >
|
GMER Logfile Zitat:
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-07-20 14:13:39
Windows 5.1.2600 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 Hitachi_HTS541612J9SA00 rev.SBDOC70P 111.79GB
Running: gmer_2.1.19163.exe; Driver: C:\DOKUME~1\Benny\LOKALE~1\Temp\uwxyipow.sys
---- System - GMER 2.1 ----
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwAdjustPrivilegesToken [0xAA98E9E4]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwClose [0xAA92A410]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwConnectPort [0xAA941588]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwCreateEvent [0xAA92A988]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwCreateMutant [0xAA92A86E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwCreatePort [0xAA9418AE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwCreateProcess [0xAA99095E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwCreateProcessEx [0xAA990B7A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwCreateSection [0xAA991A3E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwCreateSemaphore [0xAA92AAA8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwCreateSymbolicLinkObject [0xAA951990]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwCreateThread [0xAA99103E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwCreateWaitablePort [0xAA94197C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwDebugActiveProcess [0xAA990804]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwDeleteKey [0xAA93B60E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwDeleteValueKey [0xAA93CDF6]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwDeviceIoControlFile [0xAA92A454]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwDuplicateObject [0xAA98EB26]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwEnumerateKey [0xAA93C602]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwEnumerateValueKey [0xAA93CF96]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwLoadDriver [0xAA98E78E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwLoadKey [0xAA93C146]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwLoadKey2 [0xAA93C39E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwMapViewOfSection [0xAA9519B0]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwNotifyChangeKey [0xAA93FD4A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwOpenEvent [0xAA92AA1E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwOpenMutant [0xAA92A8FE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwOpenProcess [0xAA9903AC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwOpenSection [0xAA991CEA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwOpenSemaphore [0xAA92AB3E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwOpenThread [0xAA990D9A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwPlugPlayControl [0xAA9519A0]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwQueryKey [0xAA93B442]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwQueryMultipleValueKey [0xAA93CC04]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwQueryObject [0xAA93FF58]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwQueryValueKey [0xAA93C9F8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwQueueApcThread [0xAA9916EA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwRenameKey [0xAA93B722]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwReplaceKey [0xAA93BD94]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwReplyPort [0xAA941BBC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwReplyWaitReceivePort [0xAA941A4A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwReplyWaitReceivePortEx [0xAA941B00]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwRequestWaitReplyPort [0xAA941C2C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwRestoreKey [0xAA93BF9A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwResumeThread [0xAA991414]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSaveKey [0xAA93B8C6]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSaveKeyEx [0xAA93BA5C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSaveMergedKeys [0xAA93BBF8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSecureConnectPort [0xAA941716]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSetContextThread [0xAA991572]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSetInformationToken [0xAA92ABC8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSetSystemInformation [0xAA98E898]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSetValueKey [0xAA93C7C2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSuspendProcess [0xAA99054C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSuspendThread [0xAA9912BC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwSystemDebugControl [0xAA92ABDA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwTerminateProcess [0xAA9906AC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwTerminateThread [0xAA990F3A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwUnmapViewOfSection [0xAA991E52]
SSDT \SystemRoot\system32\DRIVERS\klif.sys ZwWriteVirtualMemory [0xAA991B7C]
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!ZwCallbackReturn + 2BB8 8050389C 4 Bytes JMP B394E339
.text ntkrnlpa.exe!ZwCallbackReturn + 2C44 80503928 12 Bytes [AE, 18, 94, AA, 5E, 09, 99, ...] {SCASB ; SBB [EDX+EBP*4-0x5566f6a2], DL; JP 0x15; CDQ ; STOSB }
.text ntkrnlpa.exe!ZwCallbackReturn + 2C54 80503938 12 Bytes [3E, 1A, 99, AA, A8, AA, 92, ...]
.text ntkrnlpa.exe!ZwCallbackReturn + 2D10 805039F4 12 Bytes [8E, E7, 98, AA, 46, C1, 93, ...] {MOV FS, EDI; CWDE ; STOSB ; INC ESI; RCL DWORD [EBX-0x6c3c6156], 0xaa}
.text ntkrnlpa.exe!ZwCallbackReturn + 2D80 80503A64 8 Bytes [EA, 1C, 99, AA, 3E, AB, 92, ...] {JMP FAR 0x92ab:0x3eaa991c; STOSB }
.text ...
---- User code sections - GMER 2.1 ----
? C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe[228] C:\WINDOWS\system32\ntdll.dll time/date stamp mismatch;
.text C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe[228] ntdll.dll!NtProtectVirtualMemory 7C91DEB6 5 Bytes JMP 6CA42066 C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\ushata.dll
? C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe[228] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
? C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe[228] C:\WINDOWS\system32\ole32.dll time/date stamp mismatch;
.text C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe[228] USER32.dll!VRipOutput 77D12A88 4 Bytes [83, 30, A4, 6C] {XOR DWORD [EAX], -0x5c; INS BYTE [ES:EDI], DX}
? C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe[1856] C:\WINDOWS\system32\ntdll.dll time/date stamp mismatch;
.text C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe[1856] ntdll.dll!NtProtectVirtualMemory 7C91DEB6 5 Bytes JMP 6CA42066 C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\ushata.dll
? C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe[1856] C:\WINDOWS\system32\kernel32.dll time/date stamp mismatch;
? C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe[1856] C:\WINDOWS\system32\ole32.dll time/date stamp mismatch;
.text C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe[1856] USER32.dll!VRipOutput 77D12A88 4 Bytes [83, 30, A4, 6C] {XOR DWORD [EAX], -0x5c; INS BYTE [ES:EDI], DX}
---- Devices - GMER 2.1 ----
AttachedDevice \Driver\Tcpip \Device\Ip kltdi.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys
AttachedDevice \Driver\Tcpip \Device\Tcp kltdi.sys
AttachedDevice \Driver\Tcpip \Device\Udp kltdi.sys
AttachedDevice \Driver\Tcpip \Device\RawIp kltdi.sys
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys
---- EOF - GMER 2.1 ----
| Hat evtl. jemand eine Idee was da los sein könnte, bzw. auf welcher Ebene dortetwas ist was da nicht hingehört? Ich nutze Kaspersky, der sagt jedoch das alles besten sein soll...
lg
Benny
|
20.07.2013, 13:35
Baum-Darstellung