| |
| |||||||
Log-Analyse und Auswertung: Win 7/ Rootkit lässt sich nicht entfernen.Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
04.07.2014, 00:14
| #1 |
| |  Win 7/ Rootkit lässt sich nicht entfernen. Hallo, bin echt am verzweifelt  habe warscheinlich ein ganz bösen Kernel Rootkit auf mein Rechner.Ich habe Windows schon mehrfach Neu Installiert, Festplatten Formatiert und immer wieder das selbe. Gruppen rechte für den Admin werden gesperrt usw. und komische Automatisch Installierte Datein im Windows verzeichnis. Das ganz ist mir aufgefallen, weil ich bei mein Provider ein Netblock bekommen habe. Ich habe schon zich Viren Tools und Root Scanner ausprobiert, ich kann das Infecte Betriebssystem einfach nicht mehr Normal Steuern und weiß zu dem nicht was mit mein Rechner angestellt wird, scheinbar schon ordentlich mist, sonst hätte ich durch mein Provider nicht ein Netblock. Ich hoffe mir kann hier jemand weiter helfen. Ich Poste mal die Logs. defogger - log Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 00:34 on 04/07/2014 (Neu)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:03-07-2014
Ran by Neu (administrator) on Neu-PC on 04-07-2014 00:36:18
Running from C:\Users\Neu\Desktop
Platform: Microsoft Windows 7 Enterprise (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(PortableApps.com) C:\Users\Neu\Desktop\FirefoxPortable\FirefoxPortable.exe
(Mozilla Corporation) C:\Users\Neu\Desktop\FirefoxPortable\App\Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Telefónica I+D) C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe
(Telefónica I+D) C:\Program Files\o2\Mobile Connection Manager\EMMSN.exe
(Telefónica I+D) C:\Program Files\o2\Nori\Nori.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
() C:\Users\Neu\Desktop\Defogger.exe
==================== Registry (Whitelisted) ==================
==================== Internet (Whitelisted) ====================
Tcpip\..\Interfaces\{D748268F-6327-4697-*-*}: [NameServer]193.*.*.* 193.*.*.*
FireFox:
========
========================== Services (Whitelisted) =================
R2 TGCM_ImportWiFiSvc; C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe [199600 2010-11-11] (Telefónica I+D)
==================== Drivers (Whitelisted) ====================
S3 massfilter_hs; C:\Windows\System32\drivers\massfilter_hs.sys [9728 2009-02-03] (ZTE Incorporated)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-07-04 01:18 - 2014-07-04 01:18 - 00008192 __RSH () C:\BOOTSECT.BAK
2014-07-04 01:18 - 2009-07-14 03:38 - 00383562 __RSH () C:\bootmgr
2014-07-04 00:36 - 2014-07-04 00:36 - 00002100 _____ () C:\Users\Neu\Desktop\FRST.txt
2014-07-04 00:36 - 2014-07-04 00:36 - 00000000 ____D () C:\FRST
2014-07-04 00:35 - 2014-07-04 00:35 - 01073664 _____ (Farbar) C:\Users\Neu\Desktop\FRST.exe
2014-07-04 00:34 - 2014-07-04 00:34 - 00050477 _____ () C:\Users\Neu\Desktop\Defogger.exe
2014-07-04 00:34 - 2014-07-04 00:34 - 00000468 _____ () C:\Users\Neu\Desktop\defogger_disable.log
2014-07-04 00:34 - 2014-07-04 00:34 - 00000000 _____ () C:\Users\Neu\defogger_reenable
2014-07-04 00:28 - 2014-07-04 00:28 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf
2014-07-04 00:27 - 2014-07-04 00:27 - 00002062 _____ () C:\Users\Public\Desktop\Mobile Connection Manager.lnk
2014-07-04 00:27 - 2014-07-04 00:27 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2014-07-04 00:27 - 2014-07-04 00:27 - 00000000 ____D () C:\Windows\massfilter
2014-07-04 00:27 - 2014-07-04 00:27 - 00000000 ____D () C:\Users\Neu\AppData\Roaming\Telefónica
2014-07-04 00:27 - 2010-02-22 18:25 - 00014336 _____ (ZTE) C:\Windows\system32\Drivers\ZTEusbccid.sys
2014-07-04 00:27 - 2010-02-22 17:39 - 00105856 _____ (ZTE Incorporated) C:\Windows\system32\Drivers\ZTEusbser6k.sys
2014-07-04 00:27 - 2010-02-22 17:39 - 00105856 _____ (ZTE Incorporated) C:\Windows\system32\Drivers\ZTEusbnmeaext2.sys
2014-07-04 00:27 - 2010-02-22 17:39 - 00105856 _____ (ZTE Incorporated) C:\Windows\system32\Drivers\ZTEusbnmea.sys
2014-07-04 00:27 - 2010-02-22 17:39 - 00105856 _____ (ZTE Incorporated) C:\Windows\system32\Drivers\ZTEusbmdm6k.sys
2014-07-04 00:27 - 2010-02-10 17:50 - 00186368 _____ (ZTE Incorporated) C:\Windows\system32\Drivers\ZTEusbnet.sys
2014-07-04 00:27 - 2009-12-28 15:52 - 00010240 _____ (ZTE Incorporated) C:\Windows\system32\Drivers\massfilter.sys
2014-07-04 00:27 - 2009-02-03 16:56 - 00009728 _____ (ZTE Incorporated) C:\Windows\system32\Drivers\massfilter_hs.sys
2014-07-04 00:26 - 2014-07-04 00:31 - 00004520 _____ () C:\Windows\WindowsUpdate.log
2014-07-04 00:26 - 2014-07-04 00:26 - 00000000 ____D () C:\Users\Neu\AppData\Roaming\Mozilla
2014-07-04 00:26 - 2014-07-04 00:26 - 00000000 ____D () C:\Users\Neu\AppData\Local\Mozilla
2014-07-04 00:26 - 2014-07-04 00:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\o2
2014-07-04 00:26 - 2014-07-04 00:26 - 00000000 ____D () C:\Program Files\o2
2014-07-04 00:25 - 2014-07-04 00:25 - 00001413 _____ () C:\Users\Neu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-07-04 00:25 - 2014-07-04 00:25 - 00000000 ____D () C:\Users\Neu\Desktop\FirefoxPortable
2014-07-04 00:24 - 2014-07-04 00:34 - 00000000 ____D () C:\Users\Neu
2014-07-04 00:24 - 2014-07-04 00:24 - 00000020 ___SH () C:\Users\Neu\ntuser.ini
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Musik
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Bilder
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Neu\Startmenü
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Neu\Netzwerkumgebung
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Neu\Druckumgebung
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Neu\Documents\Eigene Musik
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Neu\Documents\Eigene Bilder
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Neu\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Neu\AppData\Local\Verlauf
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default\Startmenü
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default\Netzwerkumgebung
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default\Druckumgebung
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Musik
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Bilder
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Verlauf
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Musik
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Bilder
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Verlauf
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Programme
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\ProgramData\Startmenü
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\ProgramData\Microsoft\Windows\Start Menu\Programme
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\ProgramData\Dokumente
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 __SHD () C:\Recovery
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 ____D () C:\Users\Neu\AppData\Local\VirtualStore
2014-07-04 00:24 - 2009-07-14 06:42 - 00000000 ___RD () C:\Users\Neu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-07-04 00:24 - 2009-07-14 06:37 - 00000000 ___RD () C:\Users\Neu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-07-04 00:20 - 2014-07-04 00:20 - 00000000 _____ () C:\Windows\system32\atiicdxx.dat
2014-07-04 00:20 - 2014-07-04 00:20 - 00000000 _____ () C:\Windows\ativpsrm.bin
2014-07-04 00:19 - 2014-07-04 00:19 - 00000000 ____D () C:\Windows\CSC
==================== One Month Modified Files and Folders =======
2014-07-04 01:18 - 2014-07-04 01:18 - 00008192 __RSH () C:\BOOTSECT.BAK
2014-07-04 01:18 - 2009-07-14 06:57 - 00025600 ___SH () C:\Windows\system32\config\BCD-Template.LOG
2014-07-04 01:18 - 2009-07-14 06:52 - 00028672 _____ () C:\Windows\system32\config\BCD-Template
2014-07-04 00:36 - 2014-07-04 00:36 - 00002100 _____ () C:\Users\Neu\Desktop\FRST.txt
2014-07-04 00:36 - 2014-07-04 00:36 - 00000000 ____D () C:\FRST
2014-07-04 00:35 - 2014-07-04 00:35 - 01073664 _____ (Farbar) C:\Users\Neu\Desktop\FRST.exe
2014-07-04 00:34 - 2014-07-04 00:34 - 00050477 _____ () C:\Users\Neu\Desktop\Defogger.exe
2014-07-04 00:34 - 2014-07-04 00:34 - 00000468 _____ () C:\Users\Neu\Desktop\defogger_disable.log
2014-07-04 00:34 - 2014-07-04 00:34 - 00000000 _____ () C:\Users\Neu\defogger_reenable
2014-07-04 00:34 - 2014-07-04 00:24 - 00000000 ____D () C:\Users\Neu
2014-07-04 00:31 - 2014-07-04 00:26 - 00004520 _____ () C:\Windows\WindowsUpdate.log
2014-07-04 00:28 - 2014-07-04 00:28 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf
2014-07-04 00:28 - 2010-09-14 20:52 - 01498506 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-07-04 00:28 - 2009-07-14 06:39 - 00022175 _____ () C:\Windows\setupact.log
2014-07-04 00:27 - 2014-07-04 00:27 - 00002062 _____ () C:\Users\Public\Desktop\Mobile Connection Manager.lnk
2014-07-04 00:27 - 2014-07-04 00:27 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2014-07-04 00:27 - 2014-07-04 00:27 - 00000000 ____D () C:\Windows\massfilter
2014-07-04 00:27 - 2014-07-04 00:27 - 00000000 ____D () C:\Users\Neu\AppData\Roaming\Telefónica
2014-07-04 00:27 - 2009-07-14 06:34 - 00009984 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-04 00:27 - 2009-07-14 06:34 - 00009984 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-04 00:26 - 2014-07-04 00:26 - 00000000 ____D () C:\Users\Neu\AppData\Roaming\Mozilla
2014-07-04 00:26 - 2014-07-04 00:26 - 00000000 ____D () C:\Users\Neu\AppData\Local\Mozilla
2014-07-04 00:26 - 2014-07-04 00:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\o2
2014-07-04 00:26 - 2014-07-04 00:26 - 00000000 ____D () C:\Program Files\o2
2014-07-04 00:26 - 2009-07-14 06:52 - 00000000 ____D () C:\Windows\system32\restore
2014-07-04 00:25 - 2014-07-04 00:25 - 00001413 _____ () C:\Users\Neu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-07-04 00:25 - 2014-07-04 00:25 - 00000000 ____D () C:\Users\Neu\Desktop\FirefoxPortable
2014-07-04 00:24 - 2014-07-04 00:24 - 00000020 ___SH () C:\Users\Neu\ntuser.ini
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Musik
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Public\Documents\Eigene Bilder
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Neu\Startmenü
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Neu\Netzwerkumgebung
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Neu\Druckumgebung
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Neu\Documents\Eigene Musik
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Neu\Documents\Eigene Bilder
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Neu\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Neu\AppData\Local\Verlauf
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default\Startmenü
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default\Netzwerkumgebung
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default\Druckumgebung
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Musik
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default\Documents\Eigene Bilder
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default\AppData\Local\Verlauf
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Musik
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default User\Documents\Eigene Bilder
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Users\Default User\AppData\Local\Verlauf
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\Programme
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\ProgramData\Startmenü
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\ProgramData\Microsoft\Windows\Start Menu\Programme
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 _SHDL () C:\ProgramData\Dokumente
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 __SHD () C:\Recovery
2014-07-04 00:24 - 2014-07-04 00:24 - 00000000 ____D () C:\Users\Neu\AppData\Local\VirtualStore
2014-07-04 00:24 - 2010-09-14 21:40 - 00000000 ____D () C:\Windows\Panther
2014-07-04 00:24 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-04 00:24 - 2009-07-14 04:37 - 00000000 __RHD () C:\Users\Default
2014-07-04 00:24 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\Recovery
2014-07-04 00:24 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-07-04 00:24 - 2009-07-14 04:37 - 00000000 ____D () C:\Program Files\Windows NT
2014-07-04 00:21 - 2010-09-14 20:42 - 00003540 _____ () C:\Windows\TSSysprep.log
2014-07-04 00:20 - 2014-07-04 00:20 - 00000000 _____ () C:\Windows\system32\atiicdxx.dat
2014-07-04 00:20 - 2014-07-04 00:20 - 00000000 _____ () C:\Windows\ativpsrm.bin
2014-07-04 00:19 - 2014-07-04 00:19 - 00000000 ____D () C:\Windows\CSC
2014-07-04 00:19 - 2009-07-14 06:34 - 00002790 _____ () C:\Windows\DtcInstall.log
Some content of TEMP:
====================
C:\Users\Neu\AppData\Local\Temp\card_setup.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2010-09-14 20:41
==================== End Of Log ============================
Addition -log FRST Additions Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version:03-07-2014
Ran by Neu at 2014-07-04 00:36:54
Running from C:\Users\Neu\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Mobile Connection Manager (HKLM\...\o2DE) (Version: - Mobile Connection Manager)
ZTE USB Driver (HKLM\...\ZTE USB Driver) (Version: 1.0.1.25_TME - ZTE Corporation)
==================== Restore Points =========================
03-07-2014 22:26:51 Instalado ZTE Drivers v1.2059.0.11
==================== Hosts content: ==========================
2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
==================== Loaded Modules (whitelisted) =============
2014-07-04 00:26 - 2014-07-04 00:26 - 00029696 _____ () C:\Users\Neu\AppData\Local\Temp\nsgCED4.tmp\registry.dll
2014-07-04 00:26 - 2014-07-04 00:26 - 00008704 _____ () C:\Users\Neu\AppData\Local\Temp\nsgCED4.tmp\newadvsplash.dll
2014-07-04 00:26 - 2014-07-04 00:26 - 00011264 _____ () C:\Users\Neu\AppData\Local\Temp\nsgCED4.tmp\System.dll
2014-06-06 06:38 - 2014-06-06 06:38 - 03852912 _____ () C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\mozjs.dll
2010-11-11 18:07 - 2010-11-11 18:07 - 00125304 _____ () C:\Program Files\o2\Mobile Connection Manager\AgendaLib.dll
2010-11-11 18:07 - 2010-11-11 18:07 - 00508760 _____ () C:\Program Files\o2\Mobile Connection Manager\sqlite3.dll
2009-07-13 23:03 - 2009-07-14 03:15 - 00364544 _____ () C:\Windows\system32\msjetoledb40.dll
2010-11-11 17:52 - 2010-11-11 17:52 - 00018864 _____ () C:\Program Files\o2\Mobile Connection Manager\langs\de_DE_md.dll
2010-11-11 18:00 - 2010-11-11 18:00 - 00201136 _____ () C:\Program Files\o2\Nori\legplgs\plgalc.dll
2010-11-11 18:00 - 2010-11-11 18:00 - 00191920 _____ () C:\Program Files\o2\Nori\legplgs\plgati.dll
2010-11-11 18:00 - 2010-11-11 18:00 - 00240048 _____ () C:\Program Files\o2\Nori\legplgs\plghwi.dll
2010-11-11 18:00 - 2010-11-11 18:00 - 00190384 _____ () C:\Program Files\o2\Nori\legplgs\plgice.dll
2010-11-11 18:00 - 2010-11-11 18:00 - 00293296 _____ () C:\Program Files\o2\Nori\legplgs\plgnvt.dll
2010-11-11 18:00 - 2010-11-11 18:00 - 00193968 _____ () C:\Program Files\o2\Nori\legplgs\plgopt.dll
2010-11-11 18:00 - 2010-11-11 18:00 - 00193456 _____ () C:\Program Files\o2\Nori\legplgs\plgser.dll
2010-11-11 18:00 - 2010-11-11 18:00 - 00342448 _____ () C:\Program Files\o2\Nori\legplgs\plgsie.dll
2010-11-11 18:00 - 2010-11-11 18:00 - 00192944 _____ () C:\Program Files\o2\Nori\legplgs\plgzte.dll
2014-07-04 00:34 - 2014-07-04 00:34 - 00050477 _____ () C:\Users\Neu\Desktop\Defogger.exe
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== EXE Association (whitelisted) =============
==================== MSCONFIG/TASK MANAGER disabled items =========
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (07/04/2014 00:26:50 AM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {aa6d7fea-93d2-4e09-bafe-e0cd4e11c089}
System errors:
=============
Error: (07/04/2014 00:28:38 AM) (Source: Server) (EventID: 2505) (User: )
Description: Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{D748268F-6327-4697-95C8-EEB9982DAA0B} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden.
Error: (09/14/2010 09:22:28 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
Microsoft Office Sessions:
=========================
Error: (07/04/2014 00:26:50 AM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Zugriff verweigert
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {aa6d7fea-93d2-4e09-bafe-e0cd4e11c089}
==================== Memory info ===========================
Percentage of memory in use: 47%
Total physical RAM: 1790.49 MB
Available physical RAM: 944.89 MB
Total Pagefile: 3580.98 MB
Available Pagefile: 2624.65 MB
Total Virtual: 2047.88 MB
Available Virtual: 1889.46 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:335.34 GB) (Free:325.52 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: () (Fixed) (Total:335.34 GB) (Free:335.13 GB) NTFS
Drive e: (bie786910g) (CDROM) (Total:2.64 GB) (Free:0 GB) CDFS
Drive f: () (Removable) (Total:0.03 GB) (Free:0.03 GB) FAT
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 335 GB) (Disk ID: 6C96BF96)
Partition 1: (Not Active) - (Size=335 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 335 GB) (Disk ID: BD4F7A07)
Partition 1: (Active) - (Size=335 GB) - (Type=07 NTFS)
========================================================
Disk: 2 (Size: 29 MB) (Disk ID: 00000000)
Partition: GPT Partition Type.
==================== End Of Log ============================
gmer - log GMER Logfile: Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-07-04 00:51:25
Windows 6.1.7600 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP0T1L0-7 ST3360320AS rev.3.AAM 335,35GB
Running: i97e8zep.exe; Driver: C:\Users\Neu\AppData\Local\Temp\uwldqpow.sys
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!ZwSaveKeyEx + 13AD 82851599 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82875F52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text C:\Windows\system32\DRIVERS\atikmdag.sys section is writeable [0x8CA24000, 0x227A14, 0xE8000020]
---- User code sections - GMER 2.1 ----
.text C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\firefox.exe[2664] ntdll.dll!NtCreateFile 77D94A30 5 Bytes JMP 6620B8D0 C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\xul.dll
.text C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\firefox.exe[2664] ntdll.dll!NtFlushBuffersFile 77D94DC0 5 Bytes JMP 66207B07 C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\xul.dll
.text C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\firefox.exe[2664] ntdll.dll!NtQueryFullAttributesFile 77D95450 5 Bytes JMP 66207820 C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\xul.dll
.text C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\firefox.exe[2664] ntdll.dll!NtReadFile 77D95720 5 Bytes JMP 66207A00 C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\xul.dll
.text C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\firefox.exe[2664] ntdll.dll!NtReadFileScatter 77D95730 5 Bytes JMP 66A5CCC0 C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\xul.dll
.text C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\firefox.exe[2664] ntdll.dll!NtWriteFile 77D95ED0 5 Bytes JMP 6620BFE0 C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\xul.dll
.text C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\firefox.exe[2664] ntdll.dll!NtWriteFileGather 77D95EE0 5 Bytes JMP 66A5CC6F C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\xul.dll
.text C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\firefox.exe[2664] ntdll.dll!LdrLoadDll 77DAF625 5 Bytes JMP 69901EAE C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\mozglue.dll
.text C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\firefox.exe[2664] kernel32.dll!K32GetDeviceDriverBaseNameW + 16F 7691C0CF 7 Bytes JMP 66A29E65 C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\xul.dll
.text C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\firefox.exe[2664] kernel32.dll!CloseHandle + 38 7692060F 7 Bytes JMP 66A29E88 C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\xul.dll
.text C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\firefox.exe[2664] kernel32.dll!GetExitCodeProcess + 2C 7692315D 7 Bytes JMP 66208236 C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\xul.dll
.text C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\firefox.exe[2664] USER32.dll!GetWindowInfo 761B6A82 5 Bytes JMP 66937585 C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\xul.dll
.text C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\firefox.exe[2664] GDI32.dll!GetViewportOrgEx + 21C 769B85EB 7 Bytes JMP 66A29DE6 C:\Users\Neu\Desktop\FirefoxPortable\App\firefox\xul.dll
---- Devices - GMER 2.1 ----
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch2@Epoch 22
---- EOF - GMER 2.1 ----
Ich hoffe echt mir kann Hier jemand weiterhelfen und bin über jede Hilfe dankbar. Zur Info, dass Windows wurde gerade erst Neu Installiert. Gruß Geändert von mmkai (04.07.2014 um 00:19 Uhr) |
| Themen zu Win 7/ Rootkit lässt sich nicht entfernen. |
| .dll, administrator, cdrom, defender, download, entfernen, explorer, explorer.exe, fehler, festplatte, gesperrt, harddisk, installation, microsoft, mozilla, neu, registry, rootkit, scan, security, services.exe, svchost.exe, viren, windows, winlogon.exe |
Baum-Darstellung