| |  Bitte mal checken
Hallo Björn
Dank dir für deine klasse schnelle antwort. erledigt! Zitat: |
-Ist der Eintrag "(Standard) mit dem gesetzten Wert "http://" vorhanden?
| Ja ist so! Hab ich hat nichts gefunden!
Hier der Bericht: Zitat:
Malwarebytes' Anti-Malware 1.31
Datenbank Version: 1590
Windows 6.0.6001 Service Pack 1
02.01.2009 00:29:13
mbam-log-2009-01-02 (00-29-13).txt
Scan-Methode: Vollständiger Scan (C:\|D:\|)
Durchsuchte Objekte: 129555
Laufzeit: 36 minute(s), 24 second(s)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
| Das Scannen der Datei conime.exe hat folgendes ergeben: Zitat:
Antivirus Version letzte aktualisierung Ergebnis
a-squared 4.0.0.73 2009.01.01 -
AhnLab-V3 2008.12.31.0 2009.01.01 -
AntiVir 7.9.0.45 2009.01.01 -
Authentium 5.1.0.4 2009.01.01 -
Avast 4.8.1281.0 2009.01.01 -
AVG 8.0.0.199 2009.01.01 -
BitDefender 7.2 2009.01.01 -
CAT-QuickHeal 10.00 2009.01.01 -
ClamAV 0.94.1 2009.01.01 -
Comodo 859 2009.01.01 -
DrWeb 4.44.0.09170 2009.01.02 -
eTrust-Vet 31.6.6287 2009.01.01 -
Ewido 4.0 2008.12.31 -
F-Prot 4.4.4.56 2009.01.01 -
F-Secure 8.0.14470.0 2009.01.01 -
Fortinet 3.117.0.0 2009.01.01 -
GData 19 2009.01.01 -
Ikarus T3.1.1.45.0 2009.01.01 -
K7AntiVirus 7.10.572 2008.12.31 -
Kaspersky 7.0.0.125 2009.01.01 -
McAfee 5481 2009.01.02 -
McAfee+Artemis 5481 2009.01.01 -
Microsoft 1.4205 2009.01.01 -
NOD32 3731 2009.01.01 -
Norman 5.80.02 2009.01.01 -
Panda 9.0.0.4 2009.01.01 -
PCTools 4.4.2.0 2009.01.01 -
Prevx1 V2 2009.01.02 -
Rising 21.10.22.00 2008.12.31 -
SecureWeb-Gateway 6.7.6 2009.01.01 -
Sophos 4.37.0 2009.01.01 -
Sunbelt 3.2.1809.2 2008.12.22 -
Symantec 10 2009.01.02 -
TheHacker 6.3.1.4.204 2009.01.01 -
TrendMicro 8.700.0.1004 2009.01.01 -
VBA32 3.12.8.10 2009.01.01 -
ViRobot 2008.12.30.1540 2008.12.31 -
VirusBuster 4.5.11.0 2009.01.01 -
weitere Informationen
File size: 69120 bytes
MD5...: f96ebc5a624349d81dcc7600a3c5dc43
SHA1..: 97b4c1c6e8cd9707b2b67ed012e53581692b7514
SHA256: 7812184afc24f7a245d3d140eb0c1a4a23e73b34bc0a8c1556715368086f0376
SHA512: 933f3eddd29b1537ecdc9f4bfa087db535aebdf27571b6dd4e4d4d7a908cc715
346dcb8ef21831c97dc27355d2b63c1917d59f364976356abd7c69915e6d09fb
ssdeep: 1536:extaxyH2MPen708vhuSyKjEs5/Z/rZ0ZW5lKRgidu5Lk0:smyH2MPK7BhuS
y2pFidD
PEiD..: -
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x100ec7d
timedatestamp.....: 0x47918c4d (Sat Jan 19 05:36:13 2008)
machinetype.......: 0x14c (I386)
( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xf248 0xf400 6.57 89e2f77ae606d88dc541e9dd54d63570
.data 0x11000 0x56c 0x200 3.38 cc385fc56e8a4be70599de6e5dc91772
.rsrc 0x12000 0x8d8 0xa00 2.88 1d705b5a55918e5b78da8384ab01661b
.reloc 0x13000 0x9ce 0xa00 5.81 523278da76752c3fa3ba850fe4fed74c
( 10 imports )
> ADVAPI32.dll: RegQueryValueExW, RegOpenKeyExW, RegCloseKey
> KERNEL32.dll: lstrlenA, MultiByteToWideChar, VirtualQuery, RegisterConsoleIME, InterlockedExchange, Sleep, GetSystemInfo, VirtualAlloc, VirtualProtect, GetVersionExW, InterlockedDecrement, InterlockedIncrement, lstrlenW, WideCharToMultiByte, GetCommandLineW, RegisterApplicationRestart, HeapSetInformation, SetEvent, CreateThread, GetCurrentThreadId, OpenEventW, WaitForSingleObject, CloseHandle, GetACP, LocalAlloc, LocalReAlloc, LocalFree, UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, GetSystemTimeAsFileTime, GetCurrentProcessId, GetTickCount, QueryPerformanceCounter, GetModuleHandleA, SetUnhandledExceptionFilter, GetStartupInfoA, InterlockedCompareExchange, UnregisterConsoleIME
> GDI32.dll: GetStockObject, TranslateCharsetInfo
> USER32.dll: IsWindowEnabled, EnableWindow, UnregisterClassW, CreateWindowExW, RegisterClassW, LoadCursorW, SetForegroundWindow, RegisterWindowMessageW, DispatchMessageW, TranslateMessage, GetMessageW, GetKeyState, GetKeyboardLayoutNameW, PostQuitMessage, DefWindowProcW, GetGUIThreadInfo, IsWindow, DestroyWindow, SetTimer, LoadIconW, PostMessageW, SendMessageTimeoutW, KillTimer, AttachThreadInput, ActivateKeyboardLayout
> msvcrt.dll: _vsnwprintf, memset, malloc, free, _amsg_exit, memcpy, _local_unwind4, __getmainargs, _cexit, _exit, _XcptFilter, _ismbblead, _acmdln, _initterm, _controlfp, _terminate@@YAXXZ, _onexit, _lock, __dllonexit, _unlock, _except_handler4_common, __set_app_type, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, memmove, exit
> ole32.dll: CoUninitialize, CoCreateInstance, CoInitializeEx
> OLEAUT32.dll: -, -, -, -, -, -, -
> UxTheme.dll: SetThemeAppProperties
> IMM32.dll: ImmCreateContext, ImmReleaseContext, ImmGetContext, ImmGetGuideLineW, ImmGetConversionStatus, ImmGetOpenStatus, ImmSetConversionStatus, ImmGetProperty, ImmAssociateContext, ImmSimulateHotKey, ImmTranslateMessage, ImmCallImeConsoleIME, ImmGetIMEFileNameW, ImmEscapeW, ImmNotifyIME, ImmGetCandidateListW, ImmGetCompositionStringW, ImmGetHotKey, ImmSetActiveContextConsoleIME, ImmDestroyContext, ImmSetOpenStatus
> MSCTF.dll: TF_IsCtfmonRunning, TF_WaitForInitialized, TF_Notify
( 0 exports )
ThreatExpert info: <a href='http://www.threatexpert.com/report.aspx?md5=f96ebc5a624349d81dcc7600a3c5dc43' target='_blank'>http://www.threatexpert.com/report.aspx?md5=f96ebc5a624349d81dcc7600a3c5dc43</a>
| Und zum schluss noch mal den neuen bericht von HiJack nach neustart: Zitat:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:47:16, on 02.01.2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\FreePDF_XP\fpassist.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Users\DENNIS~1\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\ICQ6\ICQ.exe
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\HiJackThis\HijackThis.exe
C:\Windows\system32\NOTEPAD.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h++p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h++p://de.intl.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h++p://de.intl.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h++p://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h++p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h++p://de.intl.acer.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [FreePDF Assistant] C:\Program Files\FreePDF_XP\fpassist.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6\ICQ.exe" silent
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Faktura32\Firebird\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Faktura32\Firebird\bin\fbserver.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
--
End of file - 7047 bytes
| Freundliche Grüße
Dennis
|
01.01.2009, 22:37
Linear-Darstellung
