| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Internet explorer malwareWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
| |
15.07.2009, 12:04
| #1 |
| |  Internet explorer malware rest vom RSIT info: Code:
ATTFilter [NSRCG-->C:\WINDOWS\st6unst.exe -n "K:\Shadowrun\ST6UNST.LOG"
NVIDIA Drivers-->C:\Windows\system32\nvuninst.exe UninstallGUI
NVIDIA PhysX-->MsiExec.exe /X{B83FC356-B7C0-441F-8A4D-D71E088E7974}
NVIDIA Stereoscopic 3D Driver-->C:\Windows\system32\nvStInst.exe /uninstall /ask
Oblivion - Construction Set-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{23D683DD-93C6-48E6-B84E-78B57778F126}\setup.exe" -l0x9 -removeonly
Oblivion mod manager 1.1.8-->"C:\DATEN\TES4-Oblivion\obmm\uninstall\unins000.exe"
Oblivion-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{35CB6715-41F8-4F99-8881-6FC75BF054B0}\setup.exe" -l0x9 -removeonly
Open PLS in Windows Media Player 2.3.0-->"C:\Program Files\OpenPlsInWMP\unins000.exe"
OpenOffice.org 3.0-->MsiExec.exe /I{7EC19307-7C22-47A8-922B-3FA965291260}
Opera 9.25-->MsiExec.exe /X{C619B312-19F3-460A-9F7B-443248379F18}
Overlord-->C:\Program Files\InstallShield Installation Information\{259A8A5E-2886-4BED-9EF1-D5485282CCC3}\Setup.exe -runfromtemp -l0x0009 -removeonly
PC Connectivity Solution-->MsiExec.exe /I{99A40651-0BC2-4095-8F9A-A40FAB224FEF}
PDF Settings-->MsiExec.exe /I{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}
PowerDirector-->"C:\Program Files\InstallShield Installation Information\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}\Setup.exe" /z-uninstall
PowerDVD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall
PowerProducer-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B7A0CE06-068E-11D6-97FD-0050BACBF861}\Setup.exe" -uninstall
Prince of Persia-->"C:\Program Files\InstallShield Installation Information\{7C11154F-3539-4CB5-979D-EF7913473E53}\setup.exe" -runfromtemp -l0x0007 -removeonly
QT Lite 2.7.0-->"C:\Program Files\QT Lite\unins000.exe"
RagnarokOnline-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{27A295AF-334B-495E-9E54-71B77500ED70}\setup.exe" -l0x9 -removeonly
RealPlayer-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m
RGSS-RTP Standard-->MsiExec.exe /I{5A9FE525-8B8F-4701-A937-7F6745A4E9C7}
RPG Maker VX RTP-->"C:\Program Files\Common Files\Enterbrain\RGSS2\RPGVX\unins000.exe"
RPGXP-->MsiExec.exe /I{9B34CAC6-738F-4A20-B428-A115C3E3474C}
RTP for RM2K (Png, Wav, Midi, Fonts)-->C:\Windows\UnGins.exe "C:\Program Files\ASCII\RPG2000\RTP\install.log"
Sacred 2-->MsiExec.exe /I{1023383E-D9F6-478C-A965-23A4657B3C9A}
Safari-->MsiExec.exe /I{C3AE9DA1-2E44-4F11-803E-20977F0FE6B9}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for Excel 2007 (KB946974)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {85E83E2E-AF9B-439B-B4F9-EB9B7EF6A00E}
Security Update for Excel 2007 (KB946974)-->msiexec /package {91120000-0030-0000-0000-0000000FF1CE} /uninstall {85E83E2E-AF9B-439B-B4F9-EB9B7EF6A00E}
Security Update for Microsoft Office Publisher 2007 (KB950114)-->msiexec /package {91120000-0030-0000-0000-0000000FF1CE} /uninstall {F9C3CDBA-1F00-4D4D-959D-75C9D3ACDD85}
Security Update for Microsoft Office system 2007 (KB951808)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {8F375E11-4FD6-4B89-9E2B-A76D48B51E00}
Security Update for Microsoft Office system 2007 (KB951808)-->msiexec /package {91120000-0030-0000-0000-0000000FF1CE} /uninstall {8F375E11-4FD6-4B89-9E2B-A76D48B51E00}
Security Update for Microsoft Office Word 2007 (KB950113)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {AD72BABE-C733-4FCF-9674-4314466191B9}
Security Update for Microsoft Office Word 2007 (KB950113)-->msiexec /package {91120000-0030-0000-0000-0000000FF1CE} /uninstall {AD72BABE-C733-4FCF-9674-4314466191B9}
Security Update for Office 2007 (KB947801)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {02B5A17B-01BE-4BA6-95F1-1CBB46EBC76E}
Security Update for Office 2007 (KB947801)-->msiexec /package {91120000-0030-0000-0000-0000000FF1CE} /uninstall {02B5A17B-01BE-4BA6-95F1-1CBB46EBC76E}
Security Update for Outlook 2007 (KB946983)-->msiexec /package {91120000-0030-0000-0000-0000000FF1CE} /uninstall {66B9496E-C0C3-4065-9868-85CCA92126C3}
Security Update for Visio 2007 (KB947590)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {6BAD036C-261F-4BEF-96CF-C20678D07A41}
Sid Meier's Civilization 4 - Beyond the Sword-->C:\Program Files\InstallShield Installation Information\{32E4F0D2-C135-475E-A841-1D59A0D22989}\setup.exe -runfromtemp -l0x0007 -removeonly
Sid Meier's Civilization 4 - Warlords-->C:\Program Files\InstallShield Installation Information\{3E4B349F-10B5-4586-9D99-489A90A8B228}\setup.exe -runfromtemp -l0x0007 -removeonly
Sid Meier's Civilization 4-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CFBCE791-2D53-4FCE-B3FB-D6E01F4112E8}\setup.exe" -l0x7 -removeonly
Sophos Anti-Virus-->MsiExec.exe /X{034759DA-E21A-4795-BFB3-C66D17FAD183}
Sophos AutoUpdate-->MsiExec.exe /X{15C418EB-7675-42BE-B2B3-281952DA014D}
SPORE™-->"C:\Program Files\InstallShield Installation Information\{9DF0196F-B6B8-4C3A-8790-DE42AA530101}\SPORESetup.exe" -runfromtemp -l0x0007 -removeonly
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
SynthFont-->"C:\Program Files\SynthFont\unins000.exe"
System Requirements Lab-->C:\Program Files\SystemRequirementsLab\Uninstall.exe
TabTrax Demo 1.9-->"C:\Program Files\2112design\TabTrax Demo\uninstall.exe"
The Bard's Tale-->C:\Program Files\Ubisoft\inXile\The Bard's Tale\uninst.exe
The Core Media Player 4.0-->"C:\DATEN\CoreCodec\The Core Media Player\uninstall-tcmp4.exe"
Total Video Converter 3.11 070908-->"C:\DATEN\Total Video Converter\unins000.exe"
Two Worlds-->K:\Two Worlds\Uninst.exe /pid:{8BAD4440-26D7-4A40-B844-066D2AF3550C} /asd
Ultra Fractal 4.03-->C:\Program Files\Ultra Fractal 4\Uninst.exe
Uninstall 1.0.0.0-->"C:\Program Files\Common Files\DVDVideoSoft\unins000.exe"
Update for Office 2007 (KB946691)-->msiexec /package {91120000-002F-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278}
Update for Office 2007 (KB946691)-->msiexec /package {91120000-0030-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278}
Update for Outlook 2007 Junk Email Filter (kb950378)-->msiexec /package {91120000-0030-0000-0000-0000000FF1CE} /uninstall {F6296086-AED5-4EC0-938B-08EA0254F20E}
Urban Terror 4.1-->"C:\DATEN\Urban Terror\unins000.exe"
VC80CRTRedist - 8.0.50727.762-->MsiExec.exe /I{767CC44C-9BBC-438D-BAD3-FD4595DD148B}
VCRedistSetup-->MsiExec.exe /I{3921A67A-5AB1-4E48-9444-C71814CF3027}
VLC media player 0.9.8a-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Wecker 2.2 2.2-->C:\Windows\uninstall\Wecker 2.2\setup.exe
Winamp-->"C:\Program Files\Winamp\UninstWA.exe"
Windows Live Anmelde-Assistent-->MsiExec.exe /I{52B97218-98CB-4B8B-9283-D213C85E1AA4}
Windows Live Call-->MsiExec.exe /I{5FC68772-6D56-41C6-9DF1-24E868198AE6}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Essentials-->C:\Program Files\Windows Live\Installer\wlarp.exe
Windows Live Essentials-->MsiExec.exe /I{91E04CA7-0B13-4F8C-AA4D-2A573AC96D19}
Windows Live Messenger-->MsiExec.exe /X{837B6259-6FF5-4E66-87C1-A5A15ED36FF4}
Windows Live-Uploadtool-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
Windows-Treiberpaket - Nokia (WUDFRd) WPD (06/01/2007 6.84.33.0)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\Windows\System32\DriverStore\FileRepository\pccswpddriver.inf_a419b392\pccswpddriver.inf
Windows-Treiberpaket - Nokia Modem (02/15/2007 3.1)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\Windows\System32\DriverStore\FileRepository\pccs_bluetooth.inf_48f6f624\pccs_bluetooth.inf
Windows-Treiberpaket - Nokia Modem (02/15/2007 3.1)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\Windows\System32\DriverStore\FileRepository\pccs_bluetooth.inf_51d2d3e1\pccs_bluetooth.inf
Windows-Treiberpaket - Nokia Modem (05/24/2007 6.84.0.1)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\Windows\System32\DriverStore\FileRepository\nokbtmdm.inf_e5643fdd\nokbtmdm.inf
WinRAR-->C:\DATEN\WinRAR\uninstall.exe
X10 Hardware(TM)-->C:\Windows\UNWISE.EXE C:\PROGRA~1\X10HAR~1\Install.log
X264 H.264/AVC Video Codec (remove only)-->"C:\Windows\system32\x264-uninstall.exe"
XP Codec Pack-->C:\DATEN\XP Codec Pack\Uninstall.exe
Xvid 1.1.3 final uninstall-->"C:\Program Files\Xvid\unins000.exe"
=====HijackThis Backups=====
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) [2008-08-31]
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\HomeCinema\PowerDVD\PDVDServ.exe" [2008-08-31]
O4 - HKLM\..\Run: [TVEService] "C:\Program Files\HomeCinema\TV Enhance\TVEService.exe" [2008-08-31]
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\HomeCinema\PlayMovie\PMVService.exe" [2008-08-31]
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\HomeCinema\PowerDVD\Language\Language.exe" [2008-08-31]
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL (file missing) [2008-08-31]
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\DATEN\BitComet\tools\BitCometBHO_1.1.11.30.dll [2008-08-31]
O9 - Extra button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - http://rover.ebay.com/rover/1/707-37276-17534-15/4 (file missing) (HKCU) [2008-08-31]
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\DATEN\BitComet\tools\BitCometBHO_1.1.11.30.dll/206 (file missing) [2008-08-31]
O9 - Extra 'Tools' menuitem: eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - http://rover.ebay.com/rover/1/707-37276-17534-15/4 (file missing) (HKCU) [2008-08-31]
O13 - Gopher Prefix: [2008-08-31]
O23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe [2008-08-31]
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) [2009-07-14]
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe [2009-07-14]
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup [2009-07-14]
O4 - HKLM\..\Run: [Skytel] Skytel.exe [2009-07-14]
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2009-07-14]
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide [2009-07-14]
======Hosts File======
127.0.0.1 localhost
127.0.0.1 ad.a8.net
127.0.0.1 asy.a8ww.net
127.0.0.1 a9rhiwa.cn #[Google.Warning]
127.0.0.1 www.a9rhiwa.cn
127.0.0.1 acezip.net #[SiteAdvisor.acezip.net]
127.0.0.1 www.acezip.net #[Win32/Adware.180Solutions]
127.0.0.1 phpadsnew.abac.com
127.0.0.1 a.abnad.net
127.0.0.1 b.abnad.net
======System event log======
Computer Name: Dark
Event Code: 45
Message: Datei \Device\HarddiskVolume3\overlord-reloaded\rld-over. wurde nicht überprüft. Für Dateien, die größer als 4 GB sind, wird die On-Access-Überprüfung nicht unterstützt.
Record Number: 119418
Source Name: SAVOnAccess
Time Written: 20090715095256.977317-000
Event Type: Informationen
User:
Computer Name: Dark
Event Code: 3004
Message: Vom Windows-Defender-Echtzeitschutz-Agent wurden Änderungen erkannt. Microsoft empfiehlt, die Software, die diese Änderungen vorgenommen hat, zu analysieren, um potenzielle Risiken festzustellen. Sie können anhand der Informationen über die Funktionsweise dieser Programme entscheiden, ob die Software ausgeführt werden kann oder vom Computer entfernt werden soll. Lassen Sie nur Änderungen zu, wenn das Programm oder der Softwareherausgeber vertrauenswürdig ist. Windows-Defender kann Änderungen, die Sie zugelassen haben, nicht mehr rückgängig machen.
Weitere Informationen finden Sie im Folgenden:
Nicht zutreffend
Scan-ID: {59100FF8-2A96-4932-A84B-BBCC47D24D86}
Benutzer: Dark\Bernhard
Name: Unknown
ID:
Schweregrad-ID:
Kategorie-ID:
Gefundener Pfad: regkey:HKLM\SYSTEM\CURRENTCONTROLSET\SERV
Code:
ATTFilter µTorrent 14.02.2009 0,26MB
ABC (remove only) 07.05.2008 15,3MB
Activation Assistant for the 2007 Microsoft Office suites Microsoft Corporation 30.12.2007 14,0MB
Ad-Aware Lavasoft 30.08.2008 25,2MB
Adobe Flash Player 10 Plugin Adobe Systems Incorporated 20.05.2009
Adobe Flash Player 9 ActiveX Adobe Systems, Inc. 30.04.2008 3,05MB
Adobe Flash Player ActiveX Adobe Systems Incorporated 30.12.2007
Adobe Photoshop CS3 Adobe Systems Incorporated 18.02.2008 262,2MB
Adobe Reader 8.1.1 - Deutsch Adobe Systems Incorporated 06.01.2008
Adobe Shockwave Player 11 Adobe Systems, Inc. 09.08.2008
Apophysis 2.0 08.05.2009 4,80MB
Apple Software Update Apple Inc. 20.05.2009 2,16MB
AutoREALM 16.12.2008
Beat It 08.01.2009 0,61MB
CCleaner (remove only) Piriform 14.07.2009 2,55MB
ComicRack v0.9.80 cYo Soft 14.06.2008 4,22MB
Common RTP 1.0 15.09.2008 14,7MB
Die Siedler IV 21.02.2009 416,2MB
DivX Codec DivX, Inc. 09.06.2009 56,6MB
DivX Converter DivX, Inc. 09.06.2009 56,6MB
DivX Player DivX, Inc. 09.06.2009 56,6MB
DivX Plus DirectShow Filters DivX, Inc. 09.06.2009 1,22MB
DivX Web Player DivX,Inc. 09.06.2009 56,6MB
Drachenkrieg (with media and plugins), version 1.1.11 DwarClientDe 04.06.2009 184,8MB
Driver Checker v2.7.3 DriverChecker.com, Inc. 12.07.2009 13,9MB
ElectricSheep 2.6.6 27.07.2008
Electricsheep Screensaver 2.7b17 Electricsheep 15.06.2009 14,8MB
EVEREST Home Edition v2.20 Lavalys Inc 14.04.2009 6,58MB
Far Cry 2 Ubisoft 26.05.2009 3.219,4MB
Final Fantasy VII - Ultima Edition 07.03.2008 1.316,1MB
Finale NotePad 2008 MakeMusic 30.05.2008 57,3MB
Free MOV 2 AVI Free MOV 2 AVI 25.09.2007
Free Video Dub version 1.4 DVD Video Soft Limited. 06.06.2008 12,5MB
GIMP 2.4.1 30.12.2007 74,4MB
Google Chrome Google Inc. 20.05.2009 53,7MB
Google Earth Google 30.06.2008 33,3MB
GUILD WARS 13.07.2008 3.687,1MB
Haali Media Splitter 05.04.2008 0,73MB
Hamachi 1.0.2.5 19.04.2008 0,84MB
Heroes of Might and Magic® IV 18.04.2008 752,0MB
HijackThis 2.0.2 TrendMicro 30.08.2008 0,89MB
HP Customer Participation Program 9.0 HP 30.12.2007 212,2MB
HP Imaging Device Functions 9.0 HP 30.12.2007 4,21MB
HP OCR Software 9.0 HP 30.12.2007 4,21MB
HP Photosmart All-In-One Software 9.0 HP 30.12.2007 18,9MB
HP Photosmart Essential 2.01 HP 30.12.2007 4,21MB
HP Smart Web Printing Ihr Firmenname 30.12.2007 6,33MB
HP Solution Center 9.0 HP 30.12.2007 4,21MB
HP Update Hewlett-Packard 28.10.2008 3,71MB
HPSSupply Ihr Firmenname 30.12.2007 0,96MB
ICQ6.5 ICQ 14.03.2009 42,5MB
Intel(R) Matrix Storage Manager 30.12.2007 8,14MB
Intel(R) PRO Network Connections 12.2.41.0 Intel 22.10.2007 50,2MB
Intel® Viiv™ Software Intel Corporation 28.10.2007 34,0MB
IrfanView (remove only) 30.12.2007 1,38MB
JAP JAP-Team 12.06.2009 8,00MB
Java(TM) 6 Update 14 Sun Microsystems, Inc. 20.05.2009 94,5MB
Java(TM) 6 Update 3 Sun Microsystems, Inc. 20.05.2009 133,2MB
Java(TM) 6 Update 4 Sun Microsystems, Inc. 17.04.2008 137,7MB
Java(TM) 6 Update 5 Sun Microsystems, Inc. 20.03.2008 136,2MB
Java(TM) 6 Update 7 Sun Microsystems, Inc. 26.07.2008 136,2MB
Lightning Warrior Raidy 24.01.2009
Logitech Legacy USB Camera-Treiberpaket 17.02.2008
Logitech QuickCam Logitech Inc. 17.02.2008 29,4MB
Logitech QuickCam-Treiberpaket 17.02.2008
Macromedia Extension Manager Macromedia, Inc. 30.04.2008 4,88MB
Macromedia Flash 8 Macromedia 30.04.2008 246,2MB
Macromedia Flash 8 Video Encoder Macromedia 30.04.2008 11,4MB
Macromedia Flash Player 8 Macromedia 30.04.2008 1,42MB
Magic Set Editor 2 - 0.3.6b beta 29.06.2008 34,1MB
Magic Workstation 0.94f Magic Technology 19.01.2009 19,0MB
Malwarebytes' Anti-Malware Malwarebytes Corporation 14.07.2009 4,19MB
Microsoft .NET Framework 3.5 Language Pack - DEU Microsoft Corporation 19.01.2009 36,7MB
Microsoft .NET Framework 3.5 SP1 Microsoft Corporation 14.03.2009 36,7MB
Microsoft Office Enterprise 2007 Microsoft Corporation 27.06.2008 444,9MB
Microsoft Office Home and Student 2007 Microsoft Corporation 30.12.2007 444,9MB
Microsoft Office PowerPoint Viewer 2007 (German) Microsoft Corporation 30.12.2007
Microsoft Office Professional Edition 2003 Microsoft Corporation 23.06.2009 588,4MB
Microsoft Rise Of Nations Microsoft 27.06.2009 775,3MB
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 26.05.2009 0,41MB
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 20.05.2009 0,58MB
Microsoft Works Microsoft Corporation 22.10.2007 378,0MB
Mount&Blade 07.03.2009 520,2MB
Movie Converter V3 (remove only) 14.05.2008 8,43MB
Mozilla Firefox (3.0.11) Mozilla 12.06.2009 29,9MB
Mozilla Thunderbird (2.0.0.9) Mozilla 30.12.2007 27,0MB
MSXML 4.0 SP2 (KB925672) Microsoft Corporation 25.09.2007 1,24MB
MSXML 4.0 SP2 (KB927978) Microsoft Corporation 25.09.2007 1,24MB
MSXML 4.0 SP2 (KB936181) Microsoft Corporation 22.10.2007 6,20MB
MSXML 4.0 SP2 (KB941833) Microsoft Corporation 28.10.2007 1,27MB
MSXML4 Parser Microsoft Game Studios 12.07.2009 76,00KB
MTG Full Card Scans (up to Eventide) MWSHQ Pics Team 19.01.2009 562,3MB
MTG GamePack for Magic Workstation Magic Technology 19.01.2009 19,0MB
Nero 8 Essentials Nero AG 28.10.2007 1.775,2MB
Nokia Connectivity Cable Driver Nokia 14.08.2008 0,96MB
Nokia PC Suite Nokia 14.08.2008 27,6MB
NSRCG 15.12.2008
NVIDIA Drivers NVIDIA Corporation 13.07.2009
NVIDIA PhysX NVIDIA Corporation 13.07.2009 120,0MB
NVIDIA Stereoscopic 3D Driver NVIDIA Corporation 13.07.2009 3.300,6MB
Oblivion Bethesda Softworks 19.01.2008 4.484,9MB
Oblivion - Construction Set Bethesda Softworks 31.10.2008 5.465,8MB
Oblivion mod manager 1.1.8 Timeslip 21.01.2008 4.484,9MB
Open PLS in Windows Media Player 2.3.0 Jon Galloway 21.02.2009 0,74MB
OpenOffice.org 3.0 OpenOffice.org 25.02.2009 348,5MB
Opera 9.25 Opera Software ASA 30.12.2007 11,8MB
Overlord Codemasters 14.06.2009 3.654,5MB
PC Connectivity Solution Nokia 14.08.2008 8,91MB
PowerDirector CyberLink Corp. 28.10.2007 232,8MB
PowerDVD CyberLink Corporation 30.12.2007 115,2MB
PowerProducer 30.12.2007 190,2MB
Prince of Persia Ubisoft 05.06.2009 7.999,9MB
QT Lite 2.7.0 14.11.2008 39,0MB
RagnarokOnline Gravity 01.04.2008 1.331,7MB
RealPlayer RealNetworks 25.01.2008 41,8MB
Realtek High Definition Audio Driver Realtek Semiconductor Corp. 22.10.2007 15,4MB
RGSS-RTP Standard Enterbrain 24.08.2008 22,5MB
RPG Maker VX RTP Enterbrain 24.08.2008 43,1MB
RPGXP Enterbrain 24.08.2008 4,11MB
RTP for RM2K (Png, Wav, Midi, Fonts) 15.09.2008 15,0MB
Sacred 2 Ascaron Entertainment 14.04.2009 31,5MB
Safari Apple Inc. 20.05.2009 61,0MB
Sid Meier's Civilization 4 Firaxis Games 04.01.2009 3.588,1MB
Sid Meier's Civilization 4 - Beyond the Sword Firaxis Games 04.01.2009 1.477,9MB
Sid Meier's Civilization 4 - Warlords Firaxis Games 04.01.2009 561,4MB
Sophos Anti-Virus Sophos Plc 30.06.2009 16,1MB
Sophos AutoUpdate Sophos Plc 30.06.2009 8,22MB
SPORE™ Electronic Arts 23.09.2008 7.875,5MB
Spybot - Search & Destroy Safer Networking Limited 13.07.2009 45,9MB
SynthFont Kenneth Rundt 13.06.2009 8,20MB
System Requirements Lab 14.06.2009 0,63MB
TabTrax Demo 1.9 13.06.2009 2,68MB
The Bard's Tale inXile entertainment, Inc. 21.07.2008 7.536,5MB
The Core Media Player 4.0 30.01.2008 9,25MB
Total Video Converter 3.11 070908 EffectMatrix Inc. 18.03.2008 21,4MB
Two Worlds dopeman RIPS 26.05.2009 3.581,2MB
Ultra Fractal 4.03 15.06.2009 10,7MB
Uninstall 1.0.0.0 06.06.2008 5,97MB
Urban Terror 4.1 Frozen Sand LLC 04.07.2009 783,3MB
VLC media player 0.9.8a VideoLAN Team 28.02.2009 60,4MB
Wecker 2.2 2.2 Frederik Trinkmann 04.03.2009 0,78MB
Winamp Nullsoft, Inc 07.03.2009 26,8MB
Windows Live Anmelde-Assistent Microsoft Corporation 02.05.2009 1,93MB
Windows Live Essentials Microsoft Corporation 02.05.2009 44,0MB
Windows Live-Uploadtool Microsoft Corporation 02.05.2009 0,22MB
Windows Media Player Firefox Plugin Microsoft Corp 11.02.2008 0,29MB
Windows-Treiberpaket - Nokia (WUDFRd) WPD (06/01/2007 6.84.33.0) Nokia 14.08.2008
Windows-Treiberpaket - Nokia Modem (02/15/2007 3.1) Nokia 14.08.2008
Windows-Treiberpaket - Nokia Modem (05/24/2007 6.84.0.1) Nokia 14.08.2008
WinRAR 31.12.2007 3,66MB
X10 Hardware(TM) 30.12.2007 28,00KB
X264 H.264/AVC Video Codec (remove only) 05.04.2008
XP Codec Pack 31.12.2007 5,53MB
Xvid 1.1.3 final uninstall Xvid team (Koepi) 29.11.2008 0,77MB
|
|
15.07.2009, 12:50
| #2 |
| | Internet explorer malware so, hab den GMER doch ncoh zum laufen gebracht, hier die auswertung (allerdings ohne Devices)
__________________Code:
ATTFilter GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-07-15 13:48:54
Windows 6.0.6001 Service Pack 1
---- System - GMER 1.0.15 ----
INT 0x51 ? 8717CBF8
INT 0x62 ? 8717CBF8
INT 0x82 ? 8717CBF8
INT 0xA2 ? 8717CBF8
INT 0xA2 ? 8717CBF8
INT 0xA2 ? 8717CBF8
INT 0xB2 ? 84E1BBF8
INT 0xB2 ? 8717CBF8
INT 0xB2 ? 8717CBF8
INT 0xB2 ? 84E1BBF8
---- Kernel code sections - GMER 1.0.15 ----
? System32\Drivers\sprm.sys Das System kann den angegebenen Pfad nicht finden. !
.text USBPORT.SYS!DllUnload 8C32646F 5 Bytes JMP 8717C1D8
.text at41uuh9.SYS 8D599000 22 Bytes [26, F2, 5D, 82, 10, F1, 5D, ...]
.text at41uuh9.SYS 8D599017 46 Bytes [00, 32, 27, 79, 80, 3D, 25, ...]
.text at41uuh9.SYS 8D599046 58 Bytes [24, 82, 40, 25, 2D, 82, C0, ...]
.text at41uuh9.SYS 8D599081 53 Bytes [18, 27, 82, 58, 29, 2D, 82, ...]
.text at41uuh9.SYS 8D5990B7 22 Bytes [00, 00, 00, 00, 00, 00, 00, ...]
.text ...
? C:\Windows\system32\Drivers\RKREVEAL150.SYS Das System kann die angegebene Datei nicht finden. !
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\Windows\system32\nvvsvc.exe[3116] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile] [003B2F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Windows\system32\nvvsvc.exe[3116] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose] [003B2D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Windows\system32\nvvsvc.exe[3116] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [003B2CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Windows\system32\nvvsvc.exe[3116] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [003B2CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Windows\system32\Dwm.exe[3184] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00802F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Windows\system32\Dwm.exe[3184] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose] [00802D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Windows\system32\Dwm.exe[3184] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00802CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Windows\system32\Dwm.exe[3184] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00802CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Windows\Explorer.EXE[3452] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [73737BA4] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18000_none_9e752e5ac9c619f3\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3452] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [737798C5] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18000_none_9e752e5ac9c619f3\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3452] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [7373D3C8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18000_none_9e752e5ac9c619f3\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3452] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [7372F527] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18000_none_9e752e5ac9c619f3\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3452] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [73737599] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18000_none_9e752e5ac9c619f3\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3452] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [7372E43D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18000_none_9e752e5ac9c619f3\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3452] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [7376B33D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18000_none_9e752e5ac9c619f3\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3452] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [7373D68A] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18000_none_9e752e5ac9c619f3\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3452] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [7373012E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18000_none_9e752e5ac9c619f3\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3452] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [73730095] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18000_none_9e752e5ac9c619f3\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3452] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [737271F3] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18000_none_9e752e5ac9c619f3\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3452] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [737BD810] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18000_none_9e752e5ac9c619f3\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3452] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [737575E1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18000_none_9e752e5ac9c619f3\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3452] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [7372DAE1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18000_none_9e752e5ac9c619f3\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3452] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [7372668F] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18000_none_9e752e5ac9c619f3\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3452] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [737266BA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18000_none_9e752e5ac9c619f3\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3452] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [73731E45] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18000_none_9e752e5ac9c619f3\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3452] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile] [004D2F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Windows\Explorer.EXE[3452] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose] [004D2D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Windows\Explorer.EXE[3452] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [004D2CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Windows\Explorer.EXE[3452] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [004D2CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\gmer.exe[3924] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile] [01BC2F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\gmer.exe[3924] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose] [01BC2D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\gmer.exe[3924] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [01BC2CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\gmer.exe[3924] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [01BC2CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Windows\system32\UI0Detect.exe[5452] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00802F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Windows\system32\UI0Detect.exe[5452] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose] [00802D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Windows\system32\UI0Detect.exe[5452] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00802CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Windows\system32\UI0Detect.exe[5452] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00802CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Windows\system32\wuauclt.exe[5824] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile] [001C2F30] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Windows\system32\wuauclt.exe[5824] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose] [001C2D00] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Windows\system32\wuauclt.exe[5824] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [001C2CA0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Windows\system32\wuauclt.exe[5824] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [001C2CD0] C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll (Camera Helper Library./Logitech Inc.)
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\DATEN\Daemon\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x7E 0x77 0x8F 0xF9 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xD9 0x8D 0xCF 0xBA ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xA8 0x42 0xBA 0x9C ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0x5E 0x2C 0xFB 0x08 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\DATEN\Daemon\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x7E 0x77 0x8F 0xF9 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xD9 0x8D 0xCF 0xBA ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xA8 0x42 0xBA 0x9C ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0x5E 0x2C 0xFB 0x08 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{B6A930A0-A4F5-43A5-9B4E-6189A6C2B9E8}@\24!s!\24!y!c!`!s!i!\22!t!t!\22!i!c!s!j! 19583823
---- EOF - GMER 1.0.15 ----
|
|
15.07.2009, 15:13
| #3 |
| /// Helfer-Team    | Internet explorer malware hi
__________________1. Den kompletten Rechner zu überprüfen (Systemprüfung ohne säuberung) mit Kaspersky Online - Scanner: Internet Explorer-> Extras-> Internetoptionen-> Sicherheit: alles auf Standardstufe stellen Active X erlauben Speichere und poste das Logfile des Scans - speichere die Ergebnis als *.txt 2. Dein System schneller machen: Programme im Autostart sind Programme, die sofort mit Windows hochfahren. je mehr Programme hier aufgeführt sind, umso langsamer startet Windows! "Start→ ausführen→ "msconfig" (reinschreiben ohne ""→ OK" - it-academy.cc - pqtuning.de Einfach dort den Haken herausnehmen, dann die Programme starten nicht mehr automatisch. Du kannst aber jeder zeit manuell starten. Wird noch nach dem nächsten Neustart wieder ein Hinweisfenster erscheinen, da ist ein Haken setzen : `Meldung nicht mehr anzeigen und dieses Programm beim Windows-Star nicht mehr starten` - auf keinen Fall Grafiktreibers, Firewall und Anti-Viren-Programmen abschalten!! Auf den ersten Blick: Code:
ATTFilter O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NMSSupport] "C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" /startup
O4 - HKLM\..\Run: [CCUTRAYICON] C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ICQ] "C:\DATEN\ICQ6.5\ICQ.exe" silent
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-21-431142638-1955252653-234401500-1000\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'IUSR_NMPR')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
Code:
ATTFilter nicht nötig: O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
→ wird ungefragt mitinstalliert: O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
→ wird mit Magix ungefragt mitinstalliert.Falls existiert nicht mehr o. nutzt Du den nicht auch fixen!: O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - Unknown owner - C:\Program Files\Hofer Foto Service\Common\Database\bin\fbserver.exe (file missing)
Geändert von kira (15.07.2009 um 15:25 Uhr) |
|
15.07.2009, 21:02
| #4 |
| | Internet explorer malware Also erstens mal:  Das is mehr als nur wundervoll wie schnell der jetzt startet ^^ danke, das is genau was ich gebraucht hab ^^zweitens: Internet explorer hat auch aufgehört sich ungefragt zu öffnen. drittens: Kaspersky hat grad 2 Stunden rennen dürfen und ist mit 3% fertig, ich versuchs morgen nochmal ^^; - bzw. ist es noch sinnvoll? |
|
15.07.2009, 21:28
| #5 | |
| /// Helfer-Team | Internet explorer malwareZitat:
1. Alte Java-Versionen entfernen: - Lade Dir JavaRa von prm753 herunter - auf dem Desktop entpacken - die JavaRa.exe per Doppelklick starten - wähle "Remove Older Versions" und klicke auf "Yes - wird ein Log erstellt, kannst Du speichern (posten nicht nötig) 2. Installiere die Offline-Version von Java Java Runtime Environment (JRE) 6 Update aktuelle Version ) von http://www.trojaner-board.de/105213-java-update-einstellungen.html]SUN[/url] 3. alle Anwendungen schließen → Ordner für temporäre Dateien bitte leeren lösche nur den Inhalt der Ordner, nicht die Ordner selbst! - Dateien, die noch in Benutzung sind,nicht löschbar. c:\windows\temp - anschließend den Papierkorb leeren 4. reinige dein System mit Ccleaner:
5. - um dein System zu prüfen, lasse bitte mal alle drei Scanner laufen: Code:
ATTFilter bitdefender emsisoft f-secure - Active X erlauben - nach jedem Scanvorgang starte dein system neu auf - speichere und poste das Logfile des Scans - die Ergebnisse als*.txt Datei speichern Geändert von kira (15.07.2009 um 22:15 Uhr) |
|
| Themen zu Internet explorer malware |
| abgesicherten modus, ad-aware, adobe, alert, antivir, avg, avira, bho, bonjour, browser, computer, defender, ebay, firefox, hijack, hkus\s-1-5-18, internet, internet explorer, magix, malwar, malware, mozilla, problem, rundll, server, software, solution, system, temp-ordner, tracker, vista, windows |
Hybrid-Darstellung
