| |
| |||||||
Log-Analyse und Auswertung: Trojaner an Board: Win32:BProtect-D [Trj] System:Win7Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
23.09.2014, 14:10
| #1 |
| | ![Trojaner an Board: Win32:BProtect-D [Trj] System:Win7 - Standard](images/icons/icon1.gif){kind=icon} Trojaner an Board: Win32:BProtect-D [Trj] System:Win7 Guten Tag zusammen, Avast premium hat mir beim heutigen Suchlauf folgenden Trojaner gemeldet Win32:BProtect-D [Trj] Avast kann ihn nicht in den Container verschieben. Ich hätte dieses Ding gerne los und wäre froh wenn ich Hilfestellung bekomme. gemäß eurer Anleitung habe ich mein System schonmal gescannt Systemscan mit fsrt: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 21-09-2014 01
Ran by muck (administrator) on MUCK-PC on 23-09-2014 12:42:49
Running from C:\Users\muck\Desktop\scansoftware
Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\afwServ.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
() C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
(RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\RPDS\Bin\rpdsvc.exe
() C:\Program Files\Real\UpdateService\RealPlayerUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(STRATO) C:\Program Files\STRATO AG\STRATO HiDrive\STRATO HiDrive Service.exe
(X10) C:\Program Files\Common Files\X10\Common\X10nets.exe
() C:\Program Files\002\yewimmxqbs32.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
() C:\Windows\tsnp2uvc.exe
(CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
(CyberLink Corp.) C:\Program Files\CyberLink\YouCam\YouCamTray.exe
(MyHeritage) C:\Program Files\MyHeritage\Bin\FTBCheckUpdates.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastUI.exe
() C:\Program Files\DSL Soforthilfe\DSL_Soforthilfe.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
(RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\Update\realsched.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
(Akamai Technologies, Inc.) C:\Users\muck\AppData\Local\Akamai\netsession_win.exe
(Siber Systems) C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe
(RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\RPDS\Bin\rpsystray.exe
(Akamai Technologies, Inc.) C:\Users\muck\AppData\Local\Akamai\netsession_win.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Stardock) C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
(Microsoft Corporation) C:\Program Files\Windows NT\Accessories\wordpad.exe
(Microsoft Corporation) C:\Windows\System32\sdclt.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)
HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7625248 2009-07-20] (Realtek Semiconductor)
HKLM\...\Run: [snp2uvc] => C:\Windows\vsnp2uvc.exe
HKLM\...\Run: [tsnp2uvc] => C:\Windows\tsnp2uvc.exe [233472 2008-08-28] ()
HKLM\...\Run: [CLMLServer] => C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-06-03] (CyberLink)
HKLM\...\Run: [UpdateP2GoShortCut] => C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [UCam_Menu] => C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [YouCam Mirror Tray icon] => C:\Program Files\CyberLink\YouCam\YouCamTray.exe [167008 2009-09-28] (CyberLink Corp.)
HKLM\...\Run: [fspuip] => "\FSP\fspuip.exe"
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [499608 2011-03-30] (Adobe Systems Incorporated)
HKLM\...\Run: [BrMfcWnd] => C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [663552 2007-03-12] (Brother Industries, Ltd.)
HKLM\...\Run: [SwitchBoard] => C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM\...\Run: [AdobeCS5.5ServiceManager] => C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [1523360 2011-01-12] (Adobe Systems Incorporated)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [Family Tree Builder Update] => C:\Program Files\MyHeritage\Bin\FTBCheckUpdates.exe [2532352 2013-08-04] (MyHeritage)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [4085896 2014-08-05] (AVAST Software)
HKLM\...\Run: [ControlCenter3] => C:\Program Files\Brother\ControlCenter3\brctrcen.exe [65536 2007-01-26] (Brother Industries, Ltd.)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM\...\Run: [DSL Soforthilfe] => C:\Program Files\DSL Soforthilfe\DSL_Soforthilfe.exe [20585888 2013-11-21] ()
HKLM\...\Run: [ArcSoft Connection Service] => C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.)
HKLM\...\Run: [TkBellExe] => C:\Program Files\Real\RealPlayer\update\realsched.exe [296520 2014-08-03] (RealNetworks, Inc.)
HKU\S-1-5-21-2086479380-1908498283-1882529649-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-2086479380-1908498283-1882529649-1000\...\Run: [Google Update] => C:\Users\muck\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-11-01] (Google Inc.)
HKU\S-1-5-21-2086479380-1908498283-1882529649-1000\...\Run: [Akamai NetSession Interface] => C:\Users\muck\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\S-1-5-21-2086479380-1908498283-1882529649-1000\...\Run: [RoboForm] => C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe [100200 2014-01-15] (Siber Systems)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\RealPlayer Cloud Service UI.lnk
ShortcutTarget: RealPlayer Cloud Service UI.lnk -> C:\Program Files\Real\RealPlayer\RPDS\Bin\rpsystray.exe (RealNetworks, Inc.)
Startup: C:\Users\muck\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\muck\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\muck\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk
ShortcutTarget: Stardock ObjectDock.lnk -> C:\Program Files\Stardock\ObjectDock\ObjectDock.exe (Stardock)
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Alwil Software\Avast5\ashShell.dll (AVAST Software)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://de.yhs4.search.yahoo.com/yhs/search?type=prc265&hspart=avast&hsimp=yhs-001&p={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://medion.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://de.yahoo.com?fr=hp-avast&type=prc265
HKCU\Software\Microsoft\Internet Explorer\Main,Start Default_Page_URL = hxxp://search.certified-toolbar.com?si=41460&home=true&tid=592
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://de.yahoo.com?fr=hp-avast&type=prc265
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://de.yahoo.com?fr=hp-avast&type=prc265
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.certified-toolbar.com?si=41460&tid=592&bs=true&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Start Default_Page_URL = hxxp://search.certified-toolbar.com?si=41460&home=true&tid=592
HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.certified-toolbar.com?si=41460&tid=592&bs=true&q=
SearchScopes: HKLM - DefaultScope {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?type=prc265&hspart=avast&hsimp=yhs-001&p={searchTerms}
SearchScopes: HKLM - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=coolmsd&cd=2XzuyEtN2Y1L1QzutC0CyE0B0DyCtAtDyDtCyE0D0DtC0AzztN0D0Tzu0CyDtCtBtN1L2XzutBtFtBtFtCtFyDyByEtN1L1Czu1R1F1F1I1H1B1Q&cr=821848212&ir=
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://search.certified-toolbar.com?si=41460&bs=true&tid=592&q={searchTerms}
SearchScopes: HKLM - {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?type=prc265&hspart=avast&hsimp=yhs-001&p={searchTerms}
SearchScopes: HKLM - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.certified-toolbar.com?si=41460&bs=true&tid=592&q={searchTerms}
SearchScopes: HKCU - DefaultScope {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?type=prc265&hspart=avast&hsimp=yhs-001&p={searchTerms}
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
SearchScopes: HKCU - {05836D6B-3A4B-487A-82D3-2001E0D2828F} URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=coolmsd&cd=2XzuyEtN2Y1L1QzutC0CyE0B0DyCtAtDyDtCyE0D0DtC0AzztN0D0Tzu0CyDtCtBtN1L2XzutBtFtBtFtCtFyDyByEtN1L1Czu1R1F1F1I1H1B1Q&cr=821848212&ir=
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www2.delta-search.com/?q={searchTerms}&affID=120519&babsrc=SP_ss&mntrId=E23B1C4BD630514D
SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL =
SearchScopes: HKCU - {69535C9E-55B0-418C-A041-6610346008ED} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ATU2&o=14670&src=kw&q={searchTerms}&locale=&apn_ptnrs=^T8&apn_dtid=^zzz001^YY^DE&apn_uid=caedf34a-2c5c-4ca1-8d60-14a58ef0d500&apn_sauid=B3E2833F-1148-4DC5-9449-8AA579D3417A
SearchScopes: HKCU - {87C7DAB5-00A2-49E3-8892-ADF265F0308A} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://search.certified-toolbar.com?si=41460&bs=true&tid=592&q={searchTerms}
SearchScopes: HKCU - {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?type=prc265&hspart=avast&hsimp=yhs-001&p={searchTerms}
SearchScopes: HKCU - {AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8} URL = hxxp://www.daemon-search.com/search?q={searchTerms}
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.certified-toolbar.com?si=41460&bs=true&tid=592&q={searchTerms}
SearchScopes: HKCU - {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://mystart.incredibar.com/mb128/?search={searchTerms}&loc=IB_DS&a=6OySRaoenk&i=26
SearchScopes: HKCU - {F33C6390-D1E5-45D5-9694-672A7C1B29BE} URL = hxxp://ws.infospace.com/gamers_brw/ws/redir?_iceUrl=true&user_id=%userid&tool_id=%toolid&qkw={searchTerms}
BHO: No Name -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> No File
BHO: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} -> No File
BHO: Search Helper -> {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} -> C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
BHO: avast! EasyPass Toolbar Helper -> {724d43a9-0d85-11d4-9908-00400523e39a} -> C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (AVAST Software)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
BHO: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
BHO: Windows Live Toolbar Helper -> {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} -> C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKLM - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKLM - avast! EasyPass Toolbar - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (AVAST Software)
Toolbar: HKCU - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {32099AAC-C132-4136-9E9A-4E364A424E17} - No File
DPF: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} hxxp://www.myheritage.de/Genoogle/Components/ActiveX/SearchEngineQuery.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin: @java.com/DTPlugin,version=10.40.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.5.1 -> C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=17.0.11.7 -> c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlchromebrowserrecordext;version=17.0.11 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlhtml5videoshim;version=17.0.11 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlpepperflashvideoshim;version=17.0.11 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpplugin;version=17.0.11.7 -> c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer Cloud)
FF Plugin: @spoon.net/Spoon Plugin 3.33 -> C:\Program Files\Spoon\3.33.6.270\npMozillaSpoonPlugin.dll No File
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\muck\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\muck\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\babylon.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\Web Search.xml
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2012-03-23]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [2012-03-23]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} [2012-03-23]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} [2012-04-19]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} [2012-04-15]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-09-05]
FF HKLM\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\IB Updater\Firefox
FF HKLM\...\Firefox\Extensions: [{1DD9AC48-0855-4AE7-9934-159B4377FFA2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2014-08-03]
Chrome:
=======
CHR CustomProfile: C:\Users\muck\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\muck\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-23]
CHR Extension: (avast! Online Security) - C:\Users\muck\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2013-05-29]
CHR Extension: (RealPlayer Downloader) - C:\Users\muck\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2014-08-03]
CHR Extension: (Google Wallet) - C:\Users\muck\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-07]
CHR HKLM\...\Chrome\Extension: [dkinklhnkmkhkhofcnapakaoehijaoih] - C:\Program Files\OnlineHD.TV\onhd11.crx []
CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\IB Updater\source.crx []
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\Alwil Software\Avast5\WebRep\Chrome\aswWebRepChrome.crx [2014-08-05]
CHR HKLM\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2014-06-10]
CHR HKLM\...\Chrome\Extension: [jifflliplgeajjdhmkcfnngfpgbjonjg] - C:\Program Files\Perion\NewTab\newTab.crx [2012-11-01]
CHR HKLM\...\Chrome\Extension: [kpkbnefaikfaeadgidhpoanckoiaheli] - C:\Program Files\HDvidCodec.com\HDvidCodec10.crx [2013-04-17]
CHR HKLM\...\Chrome\Extension: [lbbbdmbjkgojacipgefbifkiebpcdjhn] - C:\Program Files\Movie2KDownloader.com\m2kDownloader10.crx [2013-04-17]
CHR HKLM\...\Chrome\Extension: [niogeckbkdcabhnapjbkeiklablhjoca] - C:\Program Files\Perion\ChromeInfoBar\ChromeInfoBar.crx [2012-11-01]
CHR StartMenuInternet: Google Chrome - C:\Users\muck\AppData\Local\Google\Chrome\Application\chrome.exe
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [50344 2014-08-05] (AVAST Software)
R2 avast! Firewall; C:\Program Files\Alwil Software\Avast5\afwServ.exe [106488 2014-08-05] (AVAST Software)
R2 RealNetworks Downloader Resolver Service; C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [39568 2014-06-10] ()
R2 RealPlayer Cloud Service; c:\program files\real\realplayer\RPDS\Bin\rpdsvc.exe [1141848 2014-08-03] (RealNetworks, Inc.)
R2 RealPlayerUpdateSvc; C:\Program Files\Real\UpdateService\RealPlayerUpdateSvc.exe [23552 2014-06-26] () [File not signed]
R2 STRATO HiDrive Service; C:\Program Files\STRATO AG\STRATO HiDrive\STRATO HiDrive Service.exe [32768 2011-07-05] (STRATO) [File not signed]
S3 SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 x10nets; C:\Program Files\Common Files\X10\Common\X10nets.exe [20480 2001-11-12] (X10) [File not signed]
R2 yewimmxqbs32; C:\Program Files\002\yewimmxqbs32.exe [541696 2014-04-30] () [File not signed]
S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 Afc; C:\Windows\System32\drivers\Afc.sys [18688 2006-11-10] (Arcsoft, Inc.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-08-05] ()
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [26136 2014-08-05] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [67824 2014-08-05] (AVAST Software)
R0 aswNdisFlt; C:\Windows\System32\DRIVERS\aswNdisFlt.sys [270752 2014-08-05] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81768 2014-08-05] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-08-05] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [779536 2014-08-05] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [414520 2014-08-05] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [71944 2014-08-05] (AVAST Software)
R1 aswTdi; C:\Windows\system32\Drivers\aswTdi.sys [56080 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [192352 2014-08-05] ()
S3 mod7700; C:\Windows\System32\DRIVERS\mod7700.sys [786400 2009-08-13] (DiBcom SA)
R2 NPF; C:\Windows\System32\drivers\npf.sys [35088 2010-06-25] (CACE Technologies, Inc.)
S3 optousb; C:\Windows\System32\DRIVERS\optousb.sys [18432 2009-08-26] (OPTO ELECTRONICS CO.,LTD.)
S3 optovcm; C:\Windows\System32\DRIVERS\optovcm.sys [26368 2009-08-26] (OPTO ELECTRONICS CO.,LTD.)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2011-09-10] (Duplex Secure Ltd.)
R3 ssudserd; C:\Windows\System32\DRIVERS\ssudserd.sys [184192 2014-01-22] (DEVGURU Co., LTD.(www.devguru.co.kr))
R3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [25984 2011-07-05] (The OpenVPN Project)
R3 X10Hid; C:\Windows\System32\Drivers\x10hid.sys [13720 2009-05-13] (X10 Wireless Technology, Inc.)
R3 XUIF; C:\Windows\System32\Drivers\x10ufx2.sys [27160 2009-05-13] (X10 Wireless Technology, Inc.)
S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [X]
S3 taphss6; system32\DRIVERS\taphss6.sys [X]
S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2020-10-02 20:10 - 2020-10-02 20:10 - 00000000 ____D () C:\ProgramData\ALM
2014-09-23 12:42 - 2014-09-23 12:42 - 00000000 ____D () C:\FRST
2014-09-23 12:33 - 2014-09-23 12:34 - 00000020 _____ () C:\Users\muck\defogger_reenable
2014-09-23 12:17 - 2014-09-23 12:42 - 00000000 ____D () C:\Users\muck\Desktop\scansoftware
2014-08-28 21:01 - 2014-08-23 03:46 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 21:01 - 2014-08-23 02:42 - 02352640 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-24 19:23 - 2014-08-24 19:23 - 00000000 ____D () C:\Users\muck\AppData\Roaming\EurekaLab s.a.s
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2020-10-02 21:05 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2020-10-02 21:03 - 2011-09-05 12:24 - 00000000 ____D () C:\ProgramData\regid.1986-12.com.adobe
2020-10-02 20:10 - 2020-10-02 20:10 - 00000000 ____D () C:\ProgramData\ALM
2014-09-23 12:42 - 2014-09-23 12:42 - 00000000 ____D () C:\FRST
2014-09-23 12:42 - 2014-09-23 12:17 - 00000000 ____D () C:\Users\muck\Desktop\scansoftware
2014-09-23 12:40 - 2011-09-06 15:21 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-23 12:39 - 2013-07-19 21:42 - 00000000 ___RD () C:\Users\muck\Dropbox
2014-09-23 12:39 - 2013-07-19 21:39 - 00000000 ____D () C:\Users\muck\AppData\Roaming\Dropbox
2014-09-23 12:37 - 2011-09-06 15:21 - 00001090 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-23 12:35 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-23 12:35 - 2009-07-14 06:39 - 00101574 _____ () C:\Windows\setupact.log
2014-09-23 12:34 - 2014-09-23 12:33 - 00000020 _____ () C:\Users\muck\defogger_reenable
2014-09-23 12:34 - 2011-09-04 18:48 - 01706085 _____ () C:\Windows\WindowsUpdate.log
2014-09-23 12:33 - 2012-03-31 18:13 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-23 12:33 - 2011-09-04 18:49 - 00000000 ____D () C:\Users\muck
2014-09-23 11:56 - 2011-11-01 10:37 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2086479380-1908498283-1882529649-1000UA.job
2014-09-23 11:17 - 2010-12-30 10:18 - 00000000 ____D () C:\Users\muck\Downloads\programme
2014-09-23 09:51 - 2014-04-30 11:24 - 00000000 ____D () C:\temp
2014-09-23 09:51 - 2011-11-14 19:38 - 00000000 ____D () C:\Program Files\ScanIT-Client
2014-09-23 07:33 - 2012-03-31 18:13 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-09-23 07:33 - 2011-10-05 19:57 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-09-23 06:40 - 2013-04-24 15:51 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-09-23 06:16 - 2009-07-14 06:34 - 00019024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-23 06:16 - 2009-07-14 06:34 - 00019024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-30 23:03 - 2010-01-05 13:48 - 00000000 ____D () C:\ProgramData\Temp
2014-08-30 22:37 - 2011-12-27 22:15 - 00007607 _____ () C:\Users\muck\AppData\Local\Resmon.ResmonCfg
2014-08-30 20:56 - 2011-11-01 10:37 - 00001064 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2086479380-1908498283-1882529649-1000Core.job
2014-08-30 20:42 - 2009-07-14 06:33 - 03127952 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-25 20:36 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-08-25 06:53 - 2010-01-05 11:57 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-08-24 19:37 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-08-24 19:33 - 2009-07-14 04:37 - 00000000 __RHD () C:\Users\Public\Libraries
2014-08-24 19:23 - 2014-08-24 19:23 - 00000000 ____D () C:\Users\muck\AppData\Roaming\EurekaLab s.a.s
Some content of TEMP:
====================
C:\Users\muck\AppData\Local\Temp\99310uninstall.exe
C:\Users\muck\AppData\Local\Temp\AskSLib.dll
C:\Users\muck\AppData\Local\Temp\BackupSetup.exe
C:\Users\muck\AppData\Local\Temp\Cloud_Backup_Setup_euro.exe
C:\Users\muck\AppData\Local\Temp\distro-amzn-adknowledge-rs.exe
C:\Users\muck\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpv3wdps.dll
C:\Users\muck\AppData\Local\Temp\frnd2wtd.dll
C:\Users\muck\AppData\Local\Temp\f_kz3t_c.dll
C:\Users\muck\AppData\Local\Temp\htmlayout.dll
C:\Users\muck\AppData\Local\Temp\InstallAX.exe
C:\Users\muck\AppData\Local\Temp\installhelper.dll
C:\Users\muck\AppData\Local\Temp\InstallPlugin.exe
C:\Users\muck\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe
C:\Users\muck\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe
C:\Users\muck\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\muck\AppData\Local\Temp\jre-7u7-windows-i586-iftw.exe
C:\Users\muck\AppData\Local\Temp\jre-7u9-windows-i586-iftw.exe
C:\Users\muck\AppData\Local\Temp\mediaimpression_1.5.42.419_1.5.42.1202_update_all.exe
C:\Users\muck\AppData\Local\Temp\MyHeritage_Version_6_0_0_5634_Size_29083336.exe
C:\Users\muck\AppData\Local\Temp\MyHeritage_Version_6_0_0_5634_Size_29083344.exe
C:\Users\muck\AppData\Local\Temp\MyHeritage_Version_7_0_0_7118_Size_36943976.exe
C:\Users\muck\AppData\Local\Temp\MyHeritage_Version_7_0_0_7121_Size_36936376.exe
C:\Users\muck\AppData\Local\Temp\MyHeritage_Version_7_0_0_7128_Size_37008752.exe
C:\Users\muck\AppData\Local\Temp\nitro_pdf_reader(1).exe
C:\Users\muck\AppData\Local\Temp\nitro_pdf_reader.exe
C:\Users\muck\AppData\Local\Temp\nitro_reader3.exe
C:\Users\muck\AppData\Local\Temp\nsgAE6C.exe
C:\Users\muck\AppData\Local\Temp\nsiD2F.exe
C:\Users\muck\AppData\Local\Temp\nsmFD22.tmp.exe
C:\Users\muck\AppData\Local\Temp\nss3FA.exe
C:\Users\muck\AppData\Local\Temp\nss6447.exe
C:\Users\muck\AppData\Local\Temp\nsx5DB1.exe
C:\Users\muck\AppData\Local\Temp\setup.exe
C:\Users\muck\AppData\Local\Temp\SetupDataMngr_Searchqu.exe
C:\Users\muck\AppData\Local\Temp\Sqlite3.dll
C:\Users\muck\AppData\Local\Temp\SRAssetsHelper.dll
C:\Users\muck\AppData\Local\Temp\stubhelper.dll
C:\Users\muck\AppData\Local\Temp\uninst1.exe
C:\Users\muck\AppData\Local\Temp\uninstall8547996.exe
C:\Users\muck\AppData\Local\Temp\vcredist_x86.exe
C:\Users\muck\AppData\Local\Temp\YontooSetup-S.exe
C:\Users\muck\AppData\Local\Temp\_is4C6A.exe
C:\Users\muck\AppData\Local\Temp\_is52E.exe
C:\Users\muck\AppData\Local\Temp\_isD195.exe
C:\Users\muck\AppData\Local\Temp\_TinDel.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-08-25 20:26
==================== End Of Log ============================
Gmerlog: Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-09-23 14:49:45
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST950032 rev.0003 465,76GB
Running: tusxwiur.exe; Driver: C:\Users\muck\AppData\Local\Temp\pwldypoc.sys
---- System - GMER 2.1 ----
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwAddBootEntry [0x9112DBA6]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwAssignProcessToJobObject [0x9112E684]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateEvent [0x9113A6F8]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateEventPair [0x9113A744]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateIoCompletion [0x9113A8DE]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateMutant [0x9113A666]
SSDT \SystemRoot\system32\drivers\aswSP.sys ZwCreateSection [0x8B79EDF0]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateSemaphore [0x9113A6AE]
SSDT \SystemRoot\system32\drivers\aswSP.sys ZwCreateThread [0x8B79F080]
SSDT \SystemRoot\system32\drivers\aswSP.sys ZwCreateThreadEx [0x8B79F16A]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateTimer [0x9113A898]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwDebugActiveProcess [0x9112F472]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwDeleteBootEntry [0x9112DC0C]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwDuplicateObject [0x91132C68]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwLoadDriver [0x9112D7F8]
SSDT \SystemRoot\system32\drivers\aswSP.sys ZwMapViewOfSection [0x8B79EED0]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwModifyBootEntry [0x9112DC72]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwNotifyChangeKey [0x9113305E]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwNotifyChangeMultipleKeys [0x9112FF5A]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenEvent [0x9113A722]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenEventPair [0x9113A766]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenIoCompletion [0x9113A902]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenMutant [0x9113A68C]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenProcess [0x91132560]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenSection [0x9113A816]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenSemaphore [0x9113A6D6]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenThread [0x9113294C]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenTimer [0x9113A8BC]
SSDT \SystemRoot\system32\drivers\aswSP.sys ZwProtectVirtualMemory [0x8B79EC6E]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwQueryObject [0x9112FDCE]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwQueueApcThreadEx [0x9112FADC]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetBootEntryOrder [0x9112DCD8]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetBootOptions [0x9112DD3E]
SSDT \SystemRoot\system32\drivers\aswSP.sys ZwSetContextThread [0x8B79EFCC]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetSystemInformation [0x9112D892]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetSystemPowerState [0x9112DA64]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwShutdownSystem [0x9112D9F2]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSuspendProcess [0x9112F63C]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSuspendThread [0x9112F79E]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSystemDebugControl [0x9112DAEC]
SSDT \SystemRoot\system32\drivers\aswSP.sys ZwTerminateProcess [0x8B79ED3C]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwTerminateThread [0x9112F2CC]
SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwVdmControl [0x9112DDA4]
SSDT \SystemRoot\system32\drivers\aswSP.sys ZwWriteVirtualMemory [0x8B79EBA0]
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!ZwRollbackEnlistment + 142D 83084A15 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 830BE212 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!KeRemoveQueueEx + 10CB 830C5460 4 Bytes [A6, DB, 12, 91] {CMPSB ; FIST DWORD [EDX]; XCHG ECX, EAX}
.text ntkrnlpa.exe!KeRemoveQueueEx + 1153 830C54E8 4 Bytes [84, E6, 12, 91]
.text ntkrnlpa.exe!KeRemoveQueueEx + 11A7 830C553C 8 Bytes [F8, A6, 13, 91, 44, A7, 13, ...] {CLC ; CMPSB ; ADC EDX, [ECX-0x6eec58bc]}
.text ntkrnlpa.exe!KeRemoveQueueEx + 11B3 830C5548 4 Bytes [DE, A8, 13, 91]
.text ntkrnlpa.exe!KeRemoveQueueEx + 11CF 830C5564 4 Bytes [66, A6, 13, 91]
.text ...
PAGE ntkrnlpa.exe!ZwReplyWaitReceivePortEx + 108 832804EF 4 Bytes CALL 91130641 \SystemRoot\system32\drivers\aswSnx.sys
PAGE ntkrnlpa.exe!ZwAlpcSendWaitReceivePort + 122 8329A357 4 Bytes CALL 91130657 \SystemRoot\system32\drivers\aswSnx.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe[148] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62]
.text C:\Windows\system32\csrss.exe[488] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62]
.text C:\Windows\system32\wininit.exe[556] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62]
.text C:\Windows\system32\csrss.exe[576] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62]
.text C:\Windows\system32\services.exe[612] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62]
.text ...
.text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1524] kernel32.dll!SetUnhandledExceptionFilter 7582F5AB 8 Bytes [31, C0, C2, 04, 00, 90, 90, ...] {XOR EAX, EAX; RET 0x4; NOP ; NOP ; NOP }
.text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1524] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62]
.text C:\Windows\System32\spoolsv.exe[1636] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62]
.text C:\Windows\system32\svchost.exe[1676] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62]
.text C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe[1696] KERNEL32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62]
.text C:\Program Files\Alwil Software\Avast5\afwServ.exe[1712] kernel32.dll!SetUnhandledExceptionFilter 7582F5AB 8 Bytes [31, C0, C2, 04, 00, 90, 90, ...] {XOR EAX, EAX; RET 0x4; NOP ; NOP ; NOP }
.text C:\Program Files\Alwil Software\Avast5\afwServ.exe[1712] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62]
.text c:\program files\real\realplayer\RPDS\Bin\rpdsvc.exe[1860] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62]
.text C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe[1864] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62]
.text C:\Program Files\Real\UpdateService\RealPlayerUpdateSvc.exe[2076] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62]
.text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[2100] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62]
.text ...
.text C:\Program Files\Alwil Software\Avast5\AvastUI.exe[3160] kernel32.dll!SetUnhandledExceptionFilter 7582F5AB 8 Bytes [31, C0, C2, 04, 00, 90, 90, ...] {XOR EAX, EAX; RET 0x4; NOP ; NOP ; NOP }
.text C:\Program Files\Alwil Software\Avast5\AvastUI.exe[3160] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62]
.text C:\Windows\system32\Dwm.exe[3256] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62]
.text C:\Windows\Explorer.EXE[3284] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[3460] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62]
.text C:\Windows\system32\wbem\wmiprvse.exe[3484] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62]
.text ...
.text C:\Program Files\Real\RealPlayer\Update\realsched.exe[4364] kernel32.dll!SetUnhandledExceptionFilter 7582F5AB 5 Bytes [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}
.text C:\Program Files\Real\RealPlayer\Update\realsched.exe[4364] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62]
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac[4416] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62]
.text C:\Users\muck\AppData\Local\Akamai\netsession_win.exe[4456] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62]
.text C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe[4464] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62]
.text C:\Program Files\Real\RealPlayer\RPDS\Bin\rpsystray.exe[4484] kernel32.dll!SetUnhandledExceptionFilter 7582F5AB 5 Bytes [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}
.text C:\Program Files\Real\RealPlayer\RPDS\Bin\rpsystray.exe[4484] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62]
.text C:\Users\muck\AppData\Local\Akamai\netsession_win.exe[4500] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62]
.text C:\Windows\system32\svchost.exe[4752] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62]
.text C:\Windows\system32\wbem\unsecapp.exe[4812] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62]
.text C:\Windows\system32\wbem\wmiprvse.exe[4888] kernel32.dll!GetBinaryTypeW + 70 75846AAC 1 Byte [62]
.text ...
---- Devices - GMER 2.1 ----
AttachedDevice \Driver\tdx \Device\Tcp aswTdi.SYS
AttachedDevice \Driver\tdx \Device\Udp aswTdi.SYS
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xA2 0x9B 0x87 0xD2 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xA2 0x9B 0x87 0xD2 ...
Reg HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@C:\Users\muck\Downloads\programme\Adobe_Creative_Suite\x00a05_Master_Collection-AkamaiDLM.exe 1
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
Vielen Dank für Eure Hilfe |
| Themen zu Trojaner an Board: Win32:BProtect-D [Trj] System:Win7 |
| administrator, antivirus, avast, dll, dsl, fehlercode 0x81000006, fehlercode 22, fehlercode 43, firewall, flash player, helper, home, newtab, openvpn, realtek, registry, security, services.exe, system, this device cannot start. (code10), this device is disabled. (code 22), trojaner, vcredist, windows, winlogon.exe |
![Trojaner an Board: Win32:BProtect-D [Trj] System:Win7](iconimages/log-analyse-auswertung/trojaner-board-win32-bprotect-d-trj-system-win7_ltr.gif)
Baum-Darstellung