| |
| |||||||
Log-Analyse und Auswertung: virus will einfach nicht verschwindenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
08.02.2009, 20:14
| #24 |
 |  virus will einfach nicht verschwinden oki hab ich =( ComboFix 09-02-07.01 - ***** 2009-02-08 20:01:53.1 - NTFSx86 Microsoft® Windows Vista™ Home Premium *************** [GMT 1:00] ausgeführt von:: c:\users\*****\Desktop\ComboFix.exe AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Updated) * Neuer Wiederherstellungspunkt wurde erstellt . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\gaopdxcounter D:\Autorun.inf d:\recycler\S-3-8-49-100029251-100015219-100016303-9347.com . ((((((((((((((((((((((( Dateien erstellt von 2009-01-08 bis 2009-02-08 )))))))))))))))))))))))))))))) . 2009-02-08 18:27 . 2009-02-08 18:27 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware 2009-02-08 18:27 . 2009-01-14 16:11 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys 2009-02-08 18:27 . 2009-01-14 16:11 15,504 --a------ c:\windows\System32\drivers\mbam.sys 2009-02-08 17:41 . 2009-02-08 17:41 250 --a------ c:\windows\gmer.ini 2009-02-08 01:10 . 2009-02-08 01:10 <DIR> d-------- c:\users\All Users\SUPERAntiSpyware.com 2009-02-08 01:09 . 2009-02-08 17:21 <DIR> d-------- c:\users\Rukisama\AppData\Roaming\SUPERAntiSpyware.com 2009-02-08 01:09 . 2009-02-08 17:20 <DIR> d-------- c:\program files\SUPERAntiSpyware 2009-02-08 00:00 . 2009-02-08 00:00 <DIR> d-------- c:\users\*****\AppData\Roaming\Malwarebytes 2009-02-08 00:00 . 2009-02-08 00:00 <DIR> d-------- c:\users\All Users\Malwarebytes 2009-02-07 18:56 . 2009-02-07 19:37 <DIR> d-------- c:\program files\Unlocker 2009-02-07 17:45 . 2009-02-07 23:50 <DIR> d-------- c:\program files\AmoK 2009-02-07 16:24 . 2009-02-07 16:24 <DIR> d-------- c:\program files\Trend Micro 2009-02-07 15:53 . 2009-02-08 09:14 <DIR> d-------- c:\users\All Users\Lavasoft 2009-02-06 15:23 . 2009-02-08 18:10 <DIR> d-------- c:\program files\WinClamAVShield 2009-02-06 15:10 . 2009-02-08 16:00 <DIR> d-------- c:\users\*****\AppData\Roaming\Spyware Terminator 2009-02-06 15:10 . 2009-02-08 16:03 <DIR> d-------- c:\users\All Users\Spyware Terminator 2009-02-06 15:10 . 2009-02-08 16:03 <DIR> d-------- c:\program files\Spyware Terminator 2009-02-06 15:10 . 2009-02-06 15:10 142,592 --a------ c:\windows\System32\drivers\sp_rsdrv2.sys 2009-01-25 13:41 . 2009-01-25 13:41 <DIR> d-------- c:\program files\SystemRequirementsLab 2009-01-25 13:17 . 2009-02-01 12:00 <DIR> d-------- c:\users\All Users\FLEXnet 2009-01-25 13:14 . 2009-01-25 13:14 <DIR> d-------- c:\users\******\AppData\Roaming\SYSTEMAX Software Development 2009-01-25 13:14 . 2009-01-25 13:14 <DIR> d-------- c:\users\All Users\SYSTEMAX Software Development 2009-01-25 13:09 . 2009-01-25 13:09 <DIR> d-------- c:\program files\Adobe Media Player 2009-01-25 13:05 . 2009-01-25 13:05 <DIR> d-------- c:\program files\Common Files\Adobe AIR 2009-01-25 09:45 . 2009-02-02 20:24 <DIR> d-------- c:\users\*****\AppData\Roaming\Download Manager 2009-01-25 09:14 . 2009-01-25 09:14 <DIR> d-------- c:\users\****\AppData\Roaming\Corel 2009-01-25 09:14 . 2009-01-25 09:15 2,828 --ahs---- c:\users\All Users\KGyGaAvL.sys 2009-01-25 09:14 . 2009-01-25 09:15 2,828 --ahs---- c:\programdata\KGyGaAvL.sys 2009-01-25 09:14 . 2009-01-25 09:15 88 -r-hs---- c:\users\All Users\F705BFA2F0.sys 2009-01-25 09:14 . 2009-01-25 09:15 88 -r-hs---- c:\programdata\F705BFA2F0.sys 2009-01-25 09:11 . 2009-01-25 09:25 <DIR> d-------- c:\users\All Users\Corel 2009-01-25 08:48 . 2009-01-25 08:48 <DIR> d-------- c:\program files\Common Files\Corel 2009-01-25 00:00 . 2009-01-25 00:01 <DIR> d-------- c:\program files\Serif 2009-01-15 10:15 . 2008-12-16 03:42 288,768 --a------ c:\windows\System32\drivers\srv.sys 2009-01-12 12:27 . 2009-01-12 12:27 <DIR> d-------- c:\program files\Common Files\Scanner . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-08 17:10 --------- d-----w c:\users\******\AppData\Roaming\OpenOffice.org2 2009-02-08 15:03 --------- d-----w c:\programdata\Spyware Terminator 2009-02-08 08:14 --------- d-----w c:\programdata\Lavasoft 2009-02-08 00:10 --------- d-----w c:\programdata\SUPERAntiSpyware.com 2009-02-07 23:00 --------- d-----w c:\programdata\Malwarebytes 2009-02-07 22:18 --------- d-----w c:\program files\Google 2009-02-07 22:09 --------- d-----w c:\program files\AskBarDis 2009-02-07 10:21 --------- d-----w c:\programdata\Idol Surf Love 2009-02-07 10:20 --------- d-----w c:\programdata\That Face Camp Shim 2009-02-07 10:19 --------- d-----w c:\program files\MSN Messenger 2009-02-07 10:19 --------- d-----w c:\program files\Messenger Plus! Live 2009-02-07 10:19 --------- d-----w c:\program files\Circle Developement 2009-02-05 20:41 --------- d-----w c:\programdata\Spybot - Search & Destroy 2009-02-05 20:37 --------- d-----w c:\program files\Spybot - Search & Destroy 2009-02-03 20:37 --------- d-----w c:\program files\Common Files\Adobe 2009-02-01 11:00 --------- d-----w c:\programdata\FLEXnet 2009-01-25 13:00 --------- d-----w c:\programdata\NVIDIA 2009-01-25 12:14 --------- d-----w c:\programdata\SYSTEMAX Software Development 2009-01-25 08:25 --------- d-----w c:\programdata\Corel 2009-01-25 08:06 --------- d-----w c:\program files\Corel 2009-01-24 23:09 --------- d-----w c:\users\Rukisama\AppData\Roaming\gtk-2.0 2009-01-24 23:01 --------- d--h--w c:\program files\InstallShield Installation Information 2009-01-15 10:05 911,872 ----a-w c:\windows\System32\wininet.dll 2009-01-15 10:05 43,008 ----a-w c:\windows\System32\licmgr10.dll 2009-01-15 10:04 18,944 ----a-w c:\windows\System32\corpol.dll 2009-01-15 10:04 132,096 ----a-w c:\windows\System32\ieUnatt.exe 2009-01-15 10:04 109,568 ----a-w c:\windows\System32\PDMSetup.exe 2009-01-15 10:04 109,056 ----a-w c:\windows\System32\iesysprep.dll 2009-01-15 10:04 107,520 ----a-w c:\windows\System32\RegisterIEPKEYs.exe 2009-01-15 10:04 107,008 ----a-w c:\windows\System32\SetIEInstalledDate.exe 2009-01-15 10:04 103,936 ----a-w c:\windows\System32\SetDepNx.exe 2009-01-15 10:03 72,704 ----a-w c:\windows\System32\admparse.dll 2009-01-15 10:03 71,680 ----a-w c:\windows\System32\iesetup.dll 2009-01-15 10:03 66,560 ----a-w c:\windows\System32\wextract.exe 2009-01-15 10:03 420,352 ----a-w c:\windows\System32\vbscript.dll 2009-01-15 10:02 169,472 ----a-w c:\windows\System32\iexpress.exe 2009-01-15 10:01 34,304 ----a-w c:\windows\System32\imgutil.dll 2009-01-15 10:00 48,128 ----a-w c:\windows\System32\mshtmler.dll 2009-01-15 10:00 45,568 ----a-w c:\windows\System32\mshta.exe 2009-01-15 09:50 156,160 ----a-w c:\windows\System32\msls31.dll 2009-01-15 09:21 --------- d-----w c:\program files\Windows Mail 2009-01-07 10:28 453,152 ----a-w c:\windows\System32\NVUNINST.EXE 2009-01-05 16:08 --------- d-----w c:\program files\CCleaner 2008-12-13 18:38 --------- d-----w c:\users\******\AppData\Roaming\Ahead 2008-06-08 08:20 174 --sha-w c:\program files\desktop.ini 2007-06-13 15:29 44,227,910 ----a-w c:\users\*****\FF X - Lösungen für Mana-sama.zip . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ccleaner"="c:\program files\CCleaner\ccleaner.exe" [2008-12-19 1434864] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-01-21 68856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSConfig"="c:\windows\system32\msconfig.exe" [2008-01-19 227840] "SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472] "PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-01-29 30248] "IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-01-29 46632] "PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 255528] "BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2007-03-12 663552] "ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-01-26 65536] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-15 13683232] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-15 92704] "SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2009-02-06 2267136] c:\users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OpenOffice.org 2.3.lnk - c:\program files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 393216] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ BTTray.lnk - c:\program files\ANYCOM\Blue USB-200-250\BTTray.exe [2007-01-19 711472] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Google Updater.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Google Updater.lnk backup=c:\windows\pss\Google Updater.lnk.CommonStartup backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WinZip Quick Pick.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Quick Pick.lnk backup=c:\windows\pss\WinZip Quick Pick.lnk.CommonStartup backupExtension=.CommonStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ADMINTICK] c:\programdata\Bags team team.piwgey0 [X] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CAMP SHIM EXIT HECK] c:\programdata\Settings Fast Setup.5vh5us [X] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-10-15 01:04 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Painter Essentials 21a] --a------ 2004-03-18 16:19 733184 c:\program files\Corel\Corel Painter Essentials 2\registration.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2006-01-12 15:40 155648 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] --a------ 2009-01-15 08:19 13683232 c:\windows\System32\nvcpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] --a------ 2009-01-15 08:19 92704 c:\windows\System32\nvmctray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvSvc] --a------ 2009-01-15 08:19 641568 c:\windows\System32\nvsvc.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] --a------ 2008-01-21 16:07 68856 c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] --a------ 2006-05-25 18:35 35328 c:\program files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{2623317E-E514-4E02-8133-E1306FC3D638}"= UDP:c:\program files\Common Files\aol\acs\AOLDial.exe:AOL Optimized Dial-In "{90AD48A2-48A6-4B8E-8629-ED1EC0E3CE01}"= TCP:c:\program files\Common Files\aol\acs\AOLDial.exe:AOL Optimized Dial-In "{30A2F0E8-FDF3-4049-96B1-8C47BDD96536}"= UDP:c:\program files\Common Files\aol\acs\AOLacsd.exe:AOL Optimized Dial-In "{30985F1F-088B-4378-AC72-B4D461824FDD}"= TCP:c:\program files\Common Files\aol\acs\AOLacsd.exe:AOL Optimized Dial-In "{DB73D4C3-F34C-4A5C-9DD1-5167A77D5CC1}"= UDP:c:\program files\AOL 9.0 VR\waol.exe:AOL "{2D17821F-A832-411A-B90D-C8819612D622}"= TCP:c:\program files\AOL 9.0 VR\waol.exe:AOL "{15BD0A84-C2F8-4DD9-8D78-552ABD76430C}"= UDP:c:\program files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe:AOL TopSpeed "{1FF14F72-AF40-4D30-93BE-4260AA892646}"= TCP:c:\program files\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe:AOL TopSpeed "{C8434D74-9CC9-461F-846E-48EB83B57395}"= UDP:c:\program files\Common Files\aol\Loader\aolload.exe:AOL Loader "{60DF8DA8-243A-496F-9920-633FFF0ECD05}"= TCP:c:\program files\Common Files\aol\Loader\aolload.exe:AOL Loader "{E4CD0D24-3935-4549-B17C-18B1FBF540B8}"= UDP:c:\program files\Common Files\aol\System Information\sinf.exe:AOL System Information "{FC4AA18C-2302-4CAA-BD5B-2B4E1BB11833}"= TCP:c:\program files\Common Files\aol\System Information\sinf.exe:AOL System Information "{177042F4-AA0D-435F-BEDB-6228A1D86C82}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone) "{6F37A576-E0CA-4414-840C-2203FACF2227}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone) "{6EA87918-B3CB-4220-AC00-81A82B1D2295}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone) "{E55CF1AB-9B1F-4023-A9A1-3CDB95C99579}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire "{4FE8CDA4-7BE4-4429-B0A3-DF279DC54648}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire "TCP Query User{93841736-17B2-4AD8-A0C8-DA622C6D5BBE}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{F41F1645-52BA-4AC6-93CC-8D932E1ED65C}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "TCP Query User{9522BB89-F5F5-4936-9807-FC8C7E9BB120}c:\\users\\****\\appdata\\local\\virtualstore\\program files\\metin2_germany\\metin2.bin"= UDP:c:\users\****\appdata\local\virtualstore\program files\metin2_germany\metin2.bin:metin2.bin "UDP Query User{908AE2E3-322B-4878-AB28-FE9492526B87}c:\\users\\****\\appdata\\local\\virtualstore\\program files\\metin2_germany\\metin2.bin"= TCP:c:\users\*****\appdata\local\virtualstore\program files\metin2_germany\metin2.bin:metin2.bin "TCP Query User{9FC80991-DCFC-4D0F-A4D3-0BC1E807D3A6}c:\\users\\****\\appdata\\local\\virtualstore\\program files\\metin2_germany\\metin2.bin"= UDP:c:\users\***\appdata\local\virtualstore\program files\metin2_germany\metin2.bin:metin2.bin "UDP Query User{712F2345-FB9C-458A-BC21-E0A326086058}c:\\users\\*****\\appdata\\local\\virtualstore\\program files\\metin2_germany\\metin2.bin"= TCP:c:\users\****\appdata\local\virtualstore\program files\metin2_germany\metin2.bin:metin2.bin "TCP Query User{CDB298AC-D337-4E05-87C7-2C57D9DE835B}c:\\program files\\metin2_germany\\metin2.bin"= UDP:c:\program files\metin2_germany\metin2.bin:metin2 "UDP Query User{66F6024F-26DC-4970-8FA8-CAE7633DDE2C}c:\\program files\\metin2_germany\\metin2.bin"= TCP:c:\program files\metin2_germany\metin2.bin:metin2 "TCP Query User{C53622E6-FC82-4B04-BF91-0143610CFBDA}c:\\program files\\icqlite\\icqlite.exe"= UDP:c:\program files\icqlite\icqlite.exe:ICQLite "UDP Query User{144D6735-DAD2-4E4A-A732-05C625C4C7B3}c:\\program files\\icqlite\\icqlite.exe"= TCP:c:\program files\icqlite\icqlite.exe:ICQLite "{2C995458-0870-4A5F-8D37-3A752DEDAC15}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger "{E849F722-E114-4571-B7EF-70172692E0FE}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger "{B31EA56A-71A5-4C69-948B-7E27694208AC}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server "{51394488-0735-4B32-A940-2BCA9E26B4D9}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server "TCP Query User{DE01C0AB-B07E-497C-9F9E-747F11D6C451}c:\\users\\****\\emule\\emule.exe"= UDP:c:\users\rukisama\emule\emule.exe:emule.exe "UDP Query User{612D9EDD-2E08-437A-8D4A-FB4B2AFDCDEC}c:\\users\\*****\\emule\\emule.exe"= TCP:c:\users\rukisama\emule\emule.exe:emule.exe "TCP Query User{6874ABA9-5524-47C0-931A-D4AB79F91463}c:\\users\\*****\\appdata\\local\\temp\\temp1_vbalink1.zip\\visualboyadvance.exe"= UDP:c:\users\rukisama\appdata\local\temp\temp1_vbalink1.zip\visualboyadvance.exe:visualboyadvance.exe "UDP Query User{FAAF3C28-53F1-4B19-8B5D-4806E74C6BD2}c:\\users\\****\\appdata\\local\\temp\\temp1_vbalink1.zip\\visualboyadvance.exe"= TCP:c:\users\rukisama\appdata\local\temp\temp1_vbalink1.zip\visualboyadvance.exe:visualboyadvance.exe "TCP Query User{03AAEC0D-3F74-40C3-A34F-D54B078BEB91}c:\\users\\****\\appdata\\local\\temp\\temp4_vbalink1.zip\\visualboyadvance.exe"= UDP:c:\users\rukisama\appdata\local\temp\temp4_vbalink1.zip\visualboyadvance.exe:visualboyadvance.exe "UDP Query User{B4B36B41-683B-455A-B7F5-14E9E172CD8A}c:\\users\\****\\appdata\\local\\temp\\temp4_vbalink1.zip\\visualboyadvance.exe"= TCP:c:\users\rukisama\appdata\local\temp\temp4_vbalink1.zip\visualboyadvance.exe:visualboyadvance.exe "TCP Query User{38A01691-0E10-42C0-B850-6DEF1C1A9153}c:\\users\\*****\\appdata\\local\\temp\\temp6_vbalink2.zip\\visualboyadvance.exe"= UDP:c:\users\rukisama\appdata\local\temp\temp6_vbalink2.zip\visualboyadvance.exe:visualboyadvance.exe "UDP Query User{5699461F-2C75-43EB-86DE-1F5C1B550500}c:\\users\\****\\appdata\\local\\temp\\temp6_vbalink2.zip\\visualboyadvance.exe"= TCP:c:\users\rukisama\appdata\local\temp\temp6_vbalink2.zip\visualboyadvance.exe:visualboyadvance.exe "TCP Query User{3B814CAC-7733-4283-B6AF-72140C2F5A79}c:\\users\\*****\\appdata\\local\\temp\\temp10_vbalink1.zip\\visualboyadvance.exe"= UDP:c:\users\rukisama\appdata\local\temp\temp10_vbalink1.zip\visualboyadvance.exe:visualboyadvance.exe "UDP Query User{BD9E6784-D756-48D0-A566-937BC7D056DD}c:\\users\\****\\appdata\\local\\temp\\temp10_vbalink1.zip\\visualboyadvance.exe"= TCP:c:\users\rukisama\appdata\local\temp\temp10_vbalink1.zip\visualboyadvance.exe:visualboyadvance.exe R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\System32\drivers\sp_rsdrv2.sys [2009-02-06 142592] --- Andere Dienste/Treiber im Speicher --- *Deregistered* - avgio *Deregistered* - avipbb [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{19c86c72-c018-11db-9d48-806e6f6e6963}] \shell\AutoRun\command - H:\Autorun.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP . Inhalt des "geplante Tasks" Ordners 2009-02-08 c:\windows\Tasks\Auf Updates für Windows Live Toolbar prüfen.job - c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20] 2009-02-08 c:\windows\Tasks\User_Feed_Synchronization-{D82A5C8A-8E4B-492A-BCF5-F85C17D021C6}.job - c:\windows\system32\msfeedssync.exe [2009-01-15 11:01] . - - - - Entfernte verwaiste Registrierungseinträge - - - - MSConfigStartUp-ICQ Lite - c:\program files\ICQLite\ICQLite.exe MSConfigStartUp-Performance Center - c:\program files\Ascentive\Performance Center\APCMain.exe MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre1.6.0_05\bin\jusched.exe . ------- Zusätzlicher Suchlauf ------- . uStart Page = hxxp://www.google.de/ mStart Page = hxxp://de.yahoo.com uSearchURL,(Default) = hxxp://de.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://de.search.yahoo.com IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm IE: Bild an &Bluetooth-Gerät senden... - c:\program files\ANYCOM\Blue USB-200-250\btsendto_ie_ctx.htm IE: Seite an &Bluetooth-Gerät senden... - c:\program files\ANYCOM\Blue USB-200-250\btsendto_ie.htm FF - ProfilePath - c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\btiijb5u.default\ FF - prefs.js: browser.search.selectedEngine - FF - prefs.js: keyword.URL - hxxp://www.crawler.com/search/dispatcher.aspx?tp=aus&tbid=60341&qkw= 1 Datei(en) verschoben. FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ---- FIREFOX Richtlinien ---- FF - user.js: yahoo.homepage.dontask - true. ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-08 20:05:25 Windows 6.0.6001 Service Pack 1 NTFS Scanne versteckte Prozesse... Scanne versteckte Autostarteinträge... Scanne versteckte Dateien... Scan erfolgreich abgeschlossen versteckte Dateien: 0 ************************************************************************** . Zeit der Fertigstellung: 2009-02-08 20:07:46 ComboFix-quarantined-files.txt 2009-02-08 19:07:44 Vor Suchlauf: 19 Verzeichnis(se), 406.900.367.360 Bytes frei Nach Suchlauf: 19 Verzeichnis(se), 407,041,138,688 Bytes frei 249 --- E O F --- 2009-01-30 14:38:42 Geändert von ArmeRuki (08.02.2009 um 21:01 Uhr) |
| Themen zu virus will einfach nicht verschwinden |
| 0 bytes, ad-aware, adobe, antivir, avg, avira, bho, controlcenter, dll, down, explorer, helper, hijack, hijackthis, internet, internet explorer, object, pdf, pop-up-blocker, problem, programdata, rundll, software, spyware, spyware terminator, system, virus, virus eingefangen, vista, windows |
Baum-Darstellung