Einstellungen lassen sich nciht mehr ändern, div. webseiten lassen sich nicht öffnen

Drakath · 21.02.2009, 15:58

Hier dann die aktuellen Logs vom PC.

Zitat:

GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2009-02-21 15:51:55
Windows 5.1.2600 Service Pack 3

---- System - GMER 1.0.14 ----

SSDT spqo.sys ZwCreateKey [0xF72870E0]
SSDT spqo.sys ZwEnumerateKey [0xF72A5CA2]
SSDT spqo.sys ZwEnumerateValueKey [0xF72A6030]
SSDT spqo.sys ZwOpenKey [0xF72870C0]
SSDT spqo.sys ZwQueryKey [0xF72A6108]
SSDT spqo.sys ZwQueryValueKey [0xF72A5F88]
SSDT spqo.sys ZwSetValueKey [0xF72A619A]
SSDT \??\C:\Programme\SUPERAntiSpyware\SASKUTIL.sys (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0xAE6D7F20]

INT 0x62 ? 8A3C9BF8
INT 0x63 ? 8A3C9BF8
INT 0x73 ? 8A3C9BF8
INT 0x82 ? 8A3C9BF8
INT 0xA4 ? 8A439BF8
INT 0xB4 ? 8A439BF8

---- Kernel code sections - GMER 1.0.14 ----

? dkmhj.sys Das System kann die angegebene Datei nicht finden. !
? spqo.sys Das System kann die angegebene Datei nicht finden. !
.text USBPORT.SYS!DllUnload F601F8AC 5 Bytes JMP 8A4391D8
.text aff56qoe.SYS F5410386 35 Bytes [ 00, 00, 00, 00, 00, 00, 20, ... ]
.text aff56qoe.SYS F54103AA 24 Bytes [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text aff56qoe.SYS F54103C4 3 Bytes [ 00, 70, 02 ]
.text aff56qoe.SYS F54103C9 1 Byte [ 2E ]
.text aff56qoe.SYS F54103CB 9 Bytes [ 00, 00, 5C, 02, 00, 00, 00, ... ]
.text ...

---- Kernel IAT/EAT - GMER 1.0.14 ----

IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!KfAcquireSpinLock] 4B8BDF8B
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!READ_PORT_UCHAR] 8D3F0304
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!KeGetCurrentIrql] CB033043
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!KfRaiseIrql] 0673C13B
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!KfLowerIrql] C13B0003
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!HalGetInterruptVector] 8366FA72
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!HalTranslateBusAddress] 75000E7B
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!KeStallExecutionProcessor] 0B7D80E3
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!KfReleaseSpinLock] 307B8D00
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!READ_PORT_BUFFER_USHORT] 00AA840F
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!READ_PORT_USHORT] 83660000
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT] 6A000E7A
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[HAL.dll!WRITE_PORT_UCHAR] C6647400
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[WMILIB.SYS!WmiSystemControl] 4F8B0200
IAT \SystemRoot\System32\Drivers\aff56qoe.SYS[WMILIB.SYS!WmiCompleteRequest] 968D5140
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F7298048] spqo.sys

---- Devices - GMER 1.0.14 ----

Device \FileSystem\Ntfs \Ntfs 8A3C81F8
Device \FileSystem\Fastfat \FatCdrom 89CD6500
Device \FileSystem\Udfs \UdfsCdRom 89D45500
Device \FileSystem\Udfs \UdfsDisk 89D45500
Device \Driver\sptd \Device\4210415302 spqo.sys
Device \Driver\usbohci \Device\USBPDO-0 8A1B21F8
Device \Driver\usbehci \Device\USBPDO-1 8A1B11F8
Device \Driver\NetBT \Device\NetBT_Tcpip_{325DA82C-A080-47FD-9DFD-9070D80C9EF2} 88FAE1F8
Device \Driver\prodrv06 \Device\ProDrv06 E1D78C30
Device \Driver\Ftdisk \Device\HarddiskVolume1 8A3CA1F8
Device \Driver\nvatabus \Device\00000071 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\Ftdisk \Device\HarddiskVolume2 8A3CA1F8
Device \Driver\Cdrom \Device\CdRom0 8A173500
Device \Driver\Ftdisk \Device\HarddiskVolume3 8A3CA1F8
Device \Driver\Cdrom \Device\CdRom1 8A173500
Device \Driver\prohlp02 \Device\ProHlp02 E1017398
Device \Driver\NetBT \Device\NetBt_Wins_Export 88FAE1F8
Device \Driver\NetBT \Device\NetbiosSmb 88FAE1F8
Device \Driver\usbstor \Device\00000079 89D17500
Device \Driver\usbstor \Device\00000079 sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\PCI_PNP0302 \Device\0000004f spqo.sys
Device \Driver\usbohci \Device\USBFDO-0 8A1B21F8
Device \Driver\nvatabus \Device\0000006d prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\nvatabus \Device\NvAta0 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\usbehci \Device\USBFDO-1 8A1B11F8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 89CFA1F8
Device \Driver\nvatabus \Device\NvAta1 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\nvatabus \Device\0000006e prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\usbstor \Device\0000007b 89D17500
Device \Driver\usbstor \Device\0000007b sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \FileSystem\MRxSmb \Device\LanmanRedirector 89CFA1F8
Device \Driver\nvatabus \Device\NvAta2 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\usbstor \Device\0000007c 89D17500
Device \Driver\usbstor \Device\0000007c sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\Ftdisk \Device\FtControl 8A3CA1F8
Device \Driver\usbstor \Device\0000007d 89D17500
Device \Driver\usbstor \Device\0000007d sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\usbstor \Device\0000007e 89D17500
Device \Driver\usbstor \Device\0000007e sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\usbstor \Device\0000007f 89D17500
Device \Driver\usbstor \Device\0000007f sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\aff56qoe \Device\Scsi\aff56qoe1Port3Path0Target0Lun0 89D931F8
Device \Driver\aff56qoe \Device\Scsi\aff56qoe1Port3Path0Target0Lun0 sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\aff56qoe \Device\Scsi\aff56qoe1 89D931F8
Device \Driver\aff56qoe \Device\Scsi\aff56qoe1 sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \FileSystem\Fastfat \Fat 89CD6500
Device \FileSystem\Cdfs \Cdfs 89C06500

---- Registry - GMER 1.0.14 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch@Epoch 11481
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x20 0x2A 0x20 0x18 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xD3 0xD4 0xE2 0x68 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x67 0x83 0xED 0x78 ...
Reg HKLM\SYSTEM\ControlSet002\Services\kwdyf@DisplayName Shell Support
Reg HKLM\SYSTEM\ControlSet002\Services\kwdyf@Type 32
Reg HKLM\SYSTEM\ControlSet002\Services\kwdyf@Start 2
Reg HKLM\SYSTEM\ControlSet002\Services\kwdyf@ErrorControl 0
Reg HKLM\SYSTEM\ControlSet002\Services\kwdyf@ImagePath %SystemRoot%\system32\svchost.exe -k netsvcs
Reg HKLM\SYSTEM\ControlSet002\Services\kwdyf@ObjectName LocalSystem
Reg HKLM\SYSTEM\ControlSet002\Services\kwdyf@Description Speichert Sicherheitsinformationen f?r lokale Benutzerkonten.
Reg HKLM\SYSTEM\ControlSet002\Services\kwdyf\Parameters
Reg HKLM\SYSTEM\ControlSet002\Services\kwdyf\Parameters@ServiceDll C:\WINDOWS\system32\hxiiuhx.dll
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x20 0x2A 0x20 0x18 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xD3 0xD4 0xE2 0x68 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x67 0x83 0xED 0x78 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x20 0x2A 0x20 0x18 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xD3 0xD4 0xE2 0x68 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x67 0x83 0xED 0x78 ...

---- EOF - GMER 1.0.14 ----

Drakath · 21.02.2009, 16:00

Hier noch der andere Log

Zitat:

ComboFix 09-02-19.01 - Kai 2009-02-21 15:53:19.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1031.18.2047.1589 [GMT 1:00]
ausgeführt von:: c:\dokumente und einstellungen\Kai\Desktop\gmer\ComboFix.exe
AV: BitDefender Antivirus *On-access scanning disabled* (Updated)
FW: BitDefender Firewall *disabled*

Achtung - Auf diesem PC ist keine Wiederherstellungskonsole installiert !!
.

((((((((((((((((((((((( Dateien erstellt von 2009-01-21 bis 2009-02-21 ))))))))))))))))))))))))))))))
.

2009-02-21 10:55 . 2009-02-21 10:55 4,352 --a------ c:\windows\system32\drivers\cleanhelper.sys
2009-02-21 09:23 . 2009-02-21 12:23 81,984 --a------ c:\windows\system32\bdod.bin
2009-02-21 09:18 . 2009-02-21 09:18 850 --a------ c:\windows\system32\ProductTweaks.xml
2009-02-21 09:18 . 2009-02-21 09:18 385 --a------ c:\windows\system32\user_gensett.xml
2009-02-20 23:16 . 2009-02-20 23:16 <DIR> d-------- c:\programme\BitDefender
2009-02-20 23:16 . 2009-02-20 23:47 <DIR> d-------- c:\dokumente und einstellungen\All Users\Anwendungsdaten\BitDefender
2009-02-20 23:15 . 2009-02-21 12:23 <DIR> d-------- c:\programme\Gemeinsame Dateien\BitDefender
2009-02-20 22:23 . 2009-02-20 22:23 216 --a------ c:\windows\system32\spupdsvc.inf
2009-02-20 22:14 . 2009-02-20 22:14 <DIR> d-------- c:\programme\MSXML 4.0
2009-02-20 22:11 . 2009-02-20 22:11 <DIR> d-------- c:\dokumente und einstellungen\Kai\Anwendungsdaten\Safer Networking
2009-02-20 20:44 . 2009-02-20 20:44 <DIR> d-------- c:\windows\system32\de
2009-02-20 20:44 . 2009-02-20 20:44 <DIR> d-------- c:\windows\system32\bits
2009-02-20 20:44 . 2009-02-20 20:44 <DIR> d-------- c:\windows\l2schemas
2009-02-20 20:43 . 2009-02-20 20:43 <DIR> d-------- c:\windows\ServicePackFiles
2009-02-20 20:40 . 2009-02-20 20:40 <DIR> d-------- c:\windows\EHome
2009-02-20 20:37 . 2008-12-11 11:57 333,952 -----c--- c:\windows\system32\dllcache\srv.sys
2009-02-20 20:36 . 2008-12-12 18:01 3,088,896 -----c--- c:\windows\system32\dllcache\mshtml.dll
2009-02-20 20:36 . 2008-10-16 02:00 1,499,136 -----c--- c:\windows\system32\dllcache\shdocvw.dll
2009-02-20 20:36 . 2008-10-16 02:00 671,744 -----c--- c:\windows\system32\dllcache\wininet.dll
2009-02-20 20:36 . 2008-10-16 02:00 620,544 -----c--- c:\windows\system32\dllcache\urlmon.dll
2009-02-20 20:36 . 2008-06-14 18:32 273,024 -----c--- c:\windows\system32\dllcache\bthport.sys
2009-02-20 20:35 . 2008-08-14 14:19 2,191,488 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2009-02-20 20:35 . 2008-08-14 14:19 2,147,840 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-02-20 20:35 . 2008-08-14 14:19 2,068,352 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2009-02-20 20:35 . 2008-08-14 14:19 2,026,496 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2009-02-20 20:35 . 2008-09-15 16:24 1,846,528 -----c--- c:\windows\system32\dllcache\win32k.sys
2009-02-20 20:33 . 2004-08-03 22:41 1,041,536 --------- c:\windows\system32\drivers\hsfdpsp2.sys
2009-02-20 20:29 . 2008-05-08 15:02 203,136 -----c--- c:\windows\system32\dllcache\rmcast.sys
2009-02-20 20:28 . 2008-09-04 18:15 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
2009-02-20 20:28 . 2008-04-11 20:04 691,712 -----c--- c:\windows\system32\dllcache\inetcomm.dll
2009-02-20 20:28 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2009-02-20 20:28 . 2008-10-15 17:35 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll
2009-02-20 20:28 . 2008-05-01 15:34 331,776 -----c--- c:\windows\system32\dllcache\msadce.dll
2009-02-20 20:23 . 2008-10-16 14:08 27,672 --a------ c:\windows\system32\wuapi.dll.mui
2009-02-20 13:49 . 2009-02-20 13:49 7,680 --ahs---- c:\windows\Thumbs.db
2009-02-19 22:53 . 2009-02-19 22:53 <DIR> d-------- c:\programme\CCleaner
2009-02-19 22:51 . 2009-02-19 22:51 <DIR> d-------- c:\dokumente und einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com
2009-02-19 22:50 . 2009-02-19 22:50 <DIR> d-------- c:\programme\SUPERAntiSpyware
2009-02-19 22:50 . 2009-02-19 22:50 <DIR> d-------- c:\programme\Malwarebytes' Anti-Malware
2009-02-19 22:50 . 2009-02-19 22:50 <DIR> d-------- c:\dokumente und einstellungen\Kai\Anwendungsdaten\SUPERAntiSpyware.com
2009-02-19 22:50 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-19 22:50 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-19 19:54 . 2009-02-21 15:46 250 --a------ c:\windows\gmer.ini
2009-02-19 08:16 . 2009-02-19 08:16 <DIR> d-------- c:\dokumente und einstellungen\Kai\Anwendungsdaten\Malwarebytes
2009-02-19 08:12 . 2009-02-19 08:12 <DIR> d-------- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2009-02-18 21:32 . 2009-02-18 21:32 <DIR> d-------- c:\programme\Trend Micro
2009-02-18 20:14 . 2009-02-18 20:14 <DIR> d-------- c:\dokumente und einstellungen\Kai\Anwendungsdaten\Ashampoo
2009-02-18 20:08 . 2009-02-18 20:08 <DIR> d-------- c:\programme\Ashampoo
2009-02-18 20:08 . 2009-02-18 20:08 <DIR> d-------- c:\dokumente und einstellungen\All Users\Anwendungsdaten\ashampoo
2009-02-18 17:44 . 2009-02-18 17:44 <DIR> d-------- c:\programme\Real
2009-02-18 17:44 . 2009-02-18 17:44 <DIR> d-------- c:\programme\Gemeinsame Dateien\Real
2009-02-18 17:44 . 2009-02-18 17:44 <DIR> d-------- C:\Program Files
2009-02-17 18:08 . 2009-02-17 18:08 <DIR> d-------- c:\programme\Alex Feinman
2009-02-17 17:54 . 2009-02-17 17:54 <DIR> d-------- c:\dokumente und einstellungen\All Users\Anwendungsdaten\TrueCrypt
2009-02-17 17:15 . 2009-02-19 15:15 <DIR> d-------- c:\programme\TrueCrypt
2009-02-16 16:15 . 2009-02-16 16:16 <DIR> d-------- c:\programme\ICQ6.5
2009-02-16 13:36 . 2009-02-19 22:19 <DIR> d-------- c:\programme\Lavasoft
2009-02-16 13:36 . 2009-02-16 13:36 <DIR> d-------- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Lavasoft
2009-02-16 11:07 . 2009-02-16 11:07 <DIR> d--h----- c:\windows\system32\CanonIJ Uninstaller Information
2009-02-16 11:07 . 2009-02-16 11:07 <DIR> d--h----- c:\programme\CanonBJ
2009-02-16 11:07 . 2009-02-16 11:07 <DIR> d--h----- c:\dokumente und einstellungen\All Users\Anwendungsdaten\CanonBJ
2009-02-16 11:07 . 2006-06-22 21:00 163,840 --a------ c:\windows\system32\CNMLM89.DLL
2009-02-16 11:00 . 2008-04-13 19:47 25,856 --a------ c:\windows\system32\drivers\usbprint.sys
2009-02-14 18:43 . 2009-02-14 18:43 <DIR> d-------- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Azureus
2009-02-14 18:42 . 2009-02-14 19:16 <DIR> d-------- c:\dokumente und einstellungen\Kai\Anwendungsdaten\Azureus
2009-02-10 15:35 . 2009-02-10 15:35 <DIR> d-------- c:\dokumente und einstellungen\Kai\Anwendungsdaten\DivX
2009-02-06 17:48 . 2009-02-06 17:53 <DIR> d-------- c:\programme\DivX
2009-02-05 14:14 . 2009-02-19 22:23 <DIR> d-------- C:\Downloads
2009-02-04 19:36 . 2009-02-10 15:26 <DIR> d-------- c:\programme\Free Download Manager
2009-01-23 23:31 . 2009-01-23 23:31 <DIR> d-------- c:\dokumente und einstellungen\Kai\Anwendungsdaten\Stardock
2009-01-23 23:30 . 2009-01-23 23:30 <DIR> d-------- c:\programme\Stardock
2009-01-23 23:30 . 2009-01-23 23:30 <DIR> d-------- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Stardock
2009-01-23 23:30 . 2009-01-23 23:30 <DIR> d--h-c--- c:\dokumente und einstellungen\All Users\Anwendungsdaten\{1EB63B4B-5639-4477-8E24-05C31B5F8019}

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-21 14:53 --------- d-----w c:\programme\PeerGuardian2
2009-02-21 09:55 --------- d-----w c:\programme\MultiRes
2009-02-20 22:47 --------- d-----w c:\programme\Mozilla Thunderbird
2009-02-19 21:47 --------- d-----w c:\programme\Spybot - Search & Destroy
2009-02-19 21:36 --------- d-----w c:\programme\Gemeinsame Dateien\Wise Installation Wizard
2009-02-19 21:25 --------- d-----w c:\dokumente und einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2009-02-19 14:17 --------- d-----w c:\programme\TV-Browser
2009-02-18 15:12 --------- d--h--w c:\programme\InstallShield Installation Information
2009-02-16 15:16 --------- d-----w c:\programme\ICQ6Toolbar
2009-02-13 14:35 --------- d-----w c:\dokumente und einstellungen\Kai\Anwendungsdaten\teamspeak2
2009-02-03 22:23 --------- d-----w c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft Help
2009-01-12 19:11 --------- d-----w c:\programme\Realtek AC97
2009-01-12 19:10 --------- d-----w c:\programme\AMD
2009-01-10 18:52 --------- d-----w c:\programme\eRightSoft
2009-01-07 06:17 --------- d-----w c:\programme\DAEMON Tools Toolbar
2009-01-07 06:17 --------- d-----w c:\programme\DAEMON Tools Lite
2009-01-06 18:37 --------- d-----w c:\dokumente und einstellungen\All Users\Anwendungsdaten\SweetIM
2009-01-06 11:01 --------- d-----w c:\dokumente und einstellungen\Kai\Anwendungsdaten\Samsung
2009-01-06 10:57 5,632 ----a-w c:\windows\system32\drivers\StarOpen.sys
2009-01-06 10:44 --------- d-----w c:\programme\Samsung
2009-01-06 10:43 --------- d-----w c:\programme\Gemeinsame Dateien\Adobe
2009-01-05 20:54 --------- d-----w c:\programme\JoWooD
2009-01-01 16:58 171,520 ----a-w c:\windows\patchw32.dll
2008-12-29 19:19 --------- d-----w c:\dokumente und einstellungen\Kai\Anwendungsdaten\gtk-2.0
2008-12-27 18:00 --------- d-----w c:\programme\Oblivion Improved
2008-12-27 17:53 1,700,352 ----a-w c:\windows\system32\gdiplus.dll
2008-12-26 16:15 --------- d-----w c:\dokumente und einstellungen\Kai\Anwendungsdaten\Magic Set Editor
2008-12-26 16:14 --------- d-----w c:\programme\Magic Set Editor 2
2008-12-21 16:26 --------- d-----w c:\dokumente und einstellungen\Kai\Anwendungsdaten\dvdcss
2008-12-21 15:34 --------- d-----w c:\programme\PSP Pandora Deluxe
2008-12-11 00:33 86,016 ----a-w c:\windows\system32\dpl100.dll
2008-12-11 00:33 200,704 ----a-w c:\windows\system32\dtu100.dll
2008-12-09 02:28 593,920 ----a-w c:\windows\system32\dpuGUI11.dll
2008-12-09 02:28 57,344 ----a-w c:\windows\system32\dpv11.dll
2008-12-09 02:28 344,064 ----a-w c:\windows\system32\dpus11.dll
2008-12-09 02:28 294,912 ----a-w c:\windows\system32\dpu11.dll
2008-11-30 22:43 73,216 ----a-w c:\windows\cadkasdeinst01.exe
2006-05-03 10:06 163,328 --sh--r c:\windows\system32\flvDX.dll
2007-02-21 11:47 31,232 --sh--r c:\windows\system32\msfDX.dll
2008-03-16 13:30 216,064 --sh--r c:\windows\system32\nbDX.dll
.

((((((((((((((((((((((((((((( SnapShot_2009-02-21_12.27.28,95 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-02-21 11:32:27 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_53c.dat
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MobMapUpdater"="e:\world of warcraft\MobMapUpdater\MobMapUpdater.exe" [2008-11-05 1770624]
"BLASC"="c:\programme\buffed\BLASC.exe" [2009-02-20 2246656]
"PeerGuardian"="c:\programme\PeerGuardian2\pg2.exe" [2005-09-18 1421824]
"ICQ"="c:\programme\ICQ6.5\ICQ.exe" [2008-12-17 172792]
"DAEMON Tools Lite"="c:\programme\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560]
"SUPERAntiSpyware"="c:\programme\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-01-15 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="c:\programme\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"QuickTime Task"="c:\programme\QuickTime\QTTask.exe" [2008-09-06 413696]
"SunJavaUpdateSched"="c:\programme\Java\jre6\bin\jusched.exe" [2008-11-10 136600]
"AtiPTA"="atiptaxx.exe" [2006-02-22 c:\windows\system32\atiptaxx.exe]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 c:\windows\soundman.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\programme\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 c:\programme\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i420vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"e:\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Programme\\Java\\jre6\\bin\\java.exe"=
"e:\\SpellForce 2 - Shadow Wars\\spellforce2.exe"=
"e:\\Neverwinter Nights 2\\nwn2main.exe"=
"e:\\Neverwinter Nights 2\\nwn2main_amdxp.exe"=
"e:\\Neverwinter Nights 2\\nwupdate.exe"=
"e:\\Neverwinter Nights 2\\nwn2server.exe"=
"e:\\World of Warcraft\\Launcher.exe"=
"c:\\Programme\\ICQ6.5\\ICQ.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"1846:TCP"= 1846:TCP:vsnzuwu

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R1 SASDIFSV;SASDIFSV;c:\programme\SUPERAntiSpyware\sasdifsv.sys [2009-01-15 8944]
R1 SASKUTIL;SASKUTIL;c:\programme\SUPERAntiSpyware\SASKUTIL.SYS [2009-01-15 55024]
R3 SASENUM;SASENUM;c:\programme\SUPERAntiSpyware\SASENUM.SYS [2009-01-15 7408]
S3 fsbl;F-Secure BlackLight Engine Driver;\??\c:\dokumente und einstellungen\Kai\Desktop\fsbldrv.sys --> c:\dokumente und einstellungen\Kai\Desktop\fsbldrv.sys [?]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\programme\NOS\bin\getPlus_HelperSvc.exe [2008-10-10 33752]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
kwdyf
.
Inhalt des "geplante Tasks" Ordners

2009-02-16 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\programme\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe []
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://start.icq.com/
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: {325DA82C-A080-47FD-9DFD-9070D80C9EF2} = 192.168.0.1
FF - ProfilePath - c:\dokumente und einstellungen\Kai\Anwendungsdaten\Mozilla\Firefox\Profiles\k80wh876.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT498395&SearchSource=3&q=
FF - prefs.js: browser.search.selectedEngine - Wikipedia (de)
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/webhp?rls=org.mozilla:de

fficial&hl=de&sa=N&tab=fw
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=
FF - component: c:\dokumente und einstellungen\Kai\Anwendungsdaten\Mozilla\Firefox\Profiles\k80wh876.default\extensions\{fb7d98cb-b228-4ecb-acac-e7101156338e}\components\FFAlert.dll
FF - component: c:\programme\DAEMON Tools Toolbar\FirefoxDTT\components\DTToolbarFF.dll
FF - plugin: c:\programme\Mozilla Firefox\plugins\npgcplug.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-21 15:54:12
Windows 5.1.2600 Service Pack 3 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_USERS\S-1-5-21-1078081533-2145122553-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:07,3b,24,bf,92,a5,92,f8,f1,a1,2b,7e,76,5d,bb,ee,8c,ab,44,e6,a8,96,2e,
2c,d5,64,38,ef,ac,81,55,f5,a0,74,15,bf,e3,29,3b,b4,07,e3,e5,86,38,88,79,20,\
"??"=hex:41,e0,42,8c,cf,55,c7,95,2b,14,4d,f8,66,7b,0c,1b

[HKEY_USERS\S-1-5-21-1078081533-2145122553-839522115-1004\Software\SecuROM\License information*]
"datasecu"=hex:4c,24,a4,a4,55,c0,73,f4,e6,eb,e1,b4,0c,0d,9b,87,03,16,fc,73,52,
9c,a9,9f,b5,8c,4f,39,93,17,cf,87,81,aa,af,4c,63,5b,4f,81,31,ec,e0,2e,c4,7e,\
"rkeysecu"=hex:f5,0e,23,b5,bc,e0,7d,78,45,12,bc,7a,3d,73,04,a4
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'winlogon.exe'(816)
c:\programme\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
.
Zeit der Fertigstellung: 2009-02-21 15:55:26
ComboFix-quarantined-files.txt 2009-02-21 14:55:07
ComboFix2.txt 2009-02-21 11:28:22
ComboFix3.txt 2009-02-19 22:04:02

Vor Suchlauf: 17 Verzeichnis(se), 46.838.583.296 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 46,829,305,856 Bytes frei

238

john.doe · 21.02.2009, 16:35

Ich habe gerade nach einer automatischen Möglichkeit gesucht aber keine gefunden. Jetzt kommt sehr viel Handarbeit auf dich zu. Du musst jeden einzelen der Einträge von Hand entsperren.

1. Starte gmer
2. Scan
3. Karte: > > >
4. Karte: Registry
5. Pfad entlanghangeln: HKey_Local_Machine\SYSTEM\ControlSet002\Services\kwdyf
6. Screenshot machen, beim imagehoster hochladen und Link posten.

ciao, andreas

Drakath · 21.02.2009, 16:55

So in Ordnung?

john.doe · 21.02.2009, 17:05

Klick noch auf das Plus vor kwdyf und poste ein neuen Screenshot.

Jetzt machst du auf jeden der roten Einträge einen Doppelklick und löscht den Wert oder setzt ihn auf 0. Jede Warnmeldung, die von GMER kommt, mit Enter übergehen.

Deinstalliere vorübergehend die Daemon-Tools (kannst du zum Schluss wieder installieren). Deinstalliere AdAware und Spybot. Die versauen jedes Log.

Wenn du alle Einträge geändert hast, dann einen Neustart machen.

Folgendes Avengerskript ausführen:

Code:

ATTFilter

Drivers to delete:
kwdyf 

registry keys to delete: 
HKLM\SYSTEM\ControlSet002\Services\kwdyf

Neues Gmer-Log posten.

ciao, andreas

Drakath · 21.02.2009, 17:09

AdAware und Spybot habe ich gar nicht mehr auf meinem Rechner die sind seid Donnerstag weg.

Drakath · 21.02.2009, 17:27

Logfile of The Avenger Version 2.0, (c) by Swandog46
h**p://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\kwdyf" not found!
Deletion of driver "kwdyf" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

Registry key "HKLM\SYSTEM\ControlSet002\Services\kwdyf" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Zitat:

GMER 1.0.14.14536 - h**p://www.gmer.net
Rootkit scan 2009-02-21 17:32:01
Windows 5.1.2600 Service Pack 3

---- System - GMER 1.0.14 ----

SSDT spyo.sys ZwCreateKey [0xF72870E0]
SSDT spyo.sys ZwEnumerateKey [0xF72A5CA2]
SSDT spyo.sys ZwEnumerateValueKey [0xF72A6030]
SSDT spyo.sys ZwOpenKey [0xF72870C0]
SSDT spyo.sys ZwQueryKey [0xF72A6108]
SSDT spyo.sys ZwQueryValueKey [0xF72A5F88]
SSDT spyo.sys ZwSetValueKey [0xF72A619A]
SSDT \??\C:\Programme\SUPERAntiSpyware\SASKUTIL.sys (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0xAE6D7F20]

INT 0x01 \SystemRoot\system32\DRIVERS\ati2mtag.sys (ATI Radeon WindowsNT Miniport Driver/ATI Technologies Inc.) F53824F6
INT 0x03 \SystemRoot\system32\DRIVERS\ati2mtag.sys (ATI Radeon WindowsNT Miniport Driver/ATI Technologies Inc.) F538259C
INT 0x62 ? 8A3CABF8
INT 0x63 ? 8A3CABF8
INT 0x73 ? 8A3CABF8
INT 0x82 ? 8A3CABF8
INT 0xA4 ? 8A438BF8
INT 0xB4 ? 8A438BF8

---- Kernel code sections - GMER 1.0.14 ----

? tlvrsj.sys Das System kann die angegebene Datei nicht finden. !
? spyo.sys Das System kann die angegebene Datei nicht finden. !
.text USBPORT.SYS!DllUnload F59C58AC 5 Bytes JMP 8A4381D8

---- Kernel IAT/EAT - GMER 1.0.14 ----

IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F7298048] spyo.sys

---- Devices - GMER 1.0.14 ----

Device \FileSystem\Ntfs \Ntfs 8A3C91F8
Device \Driver\usbohci \Device\USBPDO-0 8A2711F8
Device \Driver\usbehci \Device\USBPDO-1 8A1B91F8
Device \Driver\NetBT \Device\NetBT_Tcpip_{325DA82C-A080-47FD-9DFD-9070D80C9EF2} 88F681F8
Device \Driver\prodrv06 \Device\ProDrv06 E1E65AA8
Device \Driver\Ftdisk \Device\HarddiskVolume1 8A3CB1F8
Device \Driver\Ftdisk \Device\HarddiskVolume2 8A3CB1F8
Device \Driver\Cdrom \Device\CdRom0 8A1811F8
Device \Driver\nvatabus \Device\00000072 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\Ftdisk \Device\HarddiskVolume3 8A3CB1F8
Device \Driver\prohlp02 \Device\ProHlp02 E101BE38
Device \Driver\NetBT \Device\NetBt_Wins_Export 88F681F8
Device \Driver\NetBT \Device\NetbiosSmb 88F681F8
Device \Driver\usbstor \Device\00000079 88F111F8
Device \Driver\usbstor \Device\00000079 sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\usbohci \Device\USBFDO-0 8A2711F8
Device \Driver\usbehci \Device\USBFDO-1 8A1B91F8
Device \Driver\nvatabus \Device\NvAta0 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 88F4F1F8
Device \Driver\nvatabus \Device\0000006e prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\usbstor \Device\0000007b 88F111F8
Device \Driver\usbstor \Device\0000007b sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\nvatabus \Device\NvAta1 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \FileSystem\MRxSmb \Device\LanmanRedirector 88F4F1F8
Device \Driver\usbstor \Device\0000007c 88F111F8
Device \Driver\usbstor \Device\0000007c sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\nvatabus \Device\0000006f prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\nvatabus \Device\NvAta2 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\usbstor \Device\0000007d 88F111F8
Device \Driver\usbstor \Device\0000007d sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\Ftdisk \Device\FtControl 8A3CB1F8
Device \Driver\usbstor \Device\0000007e 88F111F8
Device \Driver\usbstor \Device\0000007e sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \Driver\usbstor \Device\0000007f 88F111F8
Device \Driver\usbstor \Device\0000007f sfsync04.sys (FrontLine Synchronization Driver/Protection Technology (StarForce))
Device \FileSystem\Cdfs \Cdfs 89DAF1F8

---- Registry - GMER 1.0.14 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xEC 0x3F 0x08 0x24 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x20 0x2A 0x20 0x18 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xD3 0xD4 0xE2 0x68 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x67 0x83 0xED 0x78 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xEC 0x3F 0x08 0x24 ...

---- Files - GMER 1.0.14 ----

File C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb 65536 bytes

---- EOF - GMER 1.0.14 ----

Einstellungen lassen sich nciht mehr ändern, div. webseiten lassen sich nicht öffnen

Plagegeister aller Art und deren Bekämpfung: Einstellungen lassen sich nciht mehr ändern, div. webseiten lassen sich nicht öffnen