| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Problem mit Trojaner...Tdss.Z.301Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
| |
08.09.2009, 21:08
| #1 |
 |  Problem mit Trojaner...Tdss.Z.301 Hallo erstmal.. Ich bin froh dass es sowas eigentlich gibt und bedanke mich jetzt schon für die Hilfe.. Mein Problem: Betriebssystem: Vista Home Premium Antivirus Programm: avira antivir freeware. Seit gestern meldet avira mir die ganze zeit: C:\Windows\System32\rotscxjbsprbdr.dll Ist das Trojanische Pferd TR/PCK.Tdss.Z.301 Löschen geht nicht. Hab daraufhin HijackThis benutzt. Der findet nichts. Was soll ich tun? Ich hoffe mir kann jemand helfen. Danke im voraus |
|
08.09.2009, 21:12
| #2 |
  | Problem mit Trojaner...Tdss.Z.301 Hallo und
__________________ Rootkitwarnung! Du hast eine schwere Infektion die nur mit sehr hohem Zeitaufwand zu bereinigen ist. Deshalb empfehle ich dir die schnelle und sichere Methode => http://www.trojaner-board.de/51262-a...sicherung.html Solltest du trotzdem die Bereinigung vorziehen, dann beginne mit RSIT. Vorher solltest du jedoch deine Daten auf externe Medien oder andere Partitionen sichern. 1.) Poste beide Logs von http://www.trojaner-board.de/74910-a...tion-tool.html 2.) Solltest du noch irgendetwas mit dem Computer verbinden, wie Memorysticks, Speicherkarten, Digitalkameras, Handy, externe Laufwerke, ... dann stecke vor dem Scan alles an. ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!ciao, andreas
__________________ |
|
08.09.2009, 21:27
| #3 |
| | Problem mit Trojaner...Tdss.Z.301 so das sind mal die logs von rsit:
__________________log.txt teil 1 Logfile of random's system information tool 1.06 (written by random/random) Run by Lani at 2009-09-08 22:17:41 Microsoft® Windows Vista™ Home Premium Service Pack 1 System drive C: has 86 GB (58%) free of 148 GB Total RAM: 3066 MB (60% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:18:00, on 08.09.2009 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v8.00 (8.00.6001.18813) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe C:\Windows\System32\rundll32.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\Launch Manager\QtZgAcer.EXE C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe C:\Windows\system32\SearchFilterHost.exe C:\Users\Lani\Desktop\RSIT.exe C:\Program Files\trend micro\Lani.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0c07&s=2&o=vp32&d=1008&m=aspire_7730g R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://suche.aon.at R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.telekom.at R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0c07&s=2&o=vp32&d=1008&m=aspire_7730g R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0c07&s=2&o=vp32&d=1008&m=aspire_7730g R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Telekom Austria TA AG R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8088 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.30.0\gears.dll O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE O4 - HKLM\..\Run: [ZPdtWzdVitaKey MC3000] "C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe" show O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" O4 - HKLM\..\Run: [ProductReg] "C:\Program Files\Acer\WR_PopUp\ProductReg.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST') O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: BTTray.lnk = ? O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.30.0\gears.dll O9 - Extra 'Tools' menuitem: &Gears-Einstellungen - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.30.0\gears.dll O9 - Extra button: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe O9 - Extra 'Tools' menuitem: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer\Acer Bio Protection\PwdBank.exe O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O13 - Gopher Prefix: O20 - Winlogon Notify: AWinNotifyVitaKey MC3000 - C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe O23 - Service: CLHNService - Unknown owner - C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe O23 - Service: Google Update Service (gupdate1c9a67fd9624cba) (gupdate1c9a67fd9624cba) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iGroupTec Service (IGBASVC) - Unknown owner - C:\Program Files\Acer\Acer Bio Protection\BASVC.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009\RpcAgentSrv.exe -- End of file - 9570 bytes ======Scheduled tasks folder====== C:\Windows\tasks\GoogleUpdateTaskMachineCore.job C:\Windows\tasks\GoogleUpdateTaskMachineUA.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23 62080] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}] Windows Live Anmelde-Hilfsprogramm - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53}] Google Gears Helper - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.30.0\gears.dll [2009-07-17 2097152] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - Acer eDataSecurity Management - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll [2008-03-04 142896] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-21 1008184] "ePower_DMC"=C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe [2008-04-23 397312] "eDataSecurity Loader"=C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe [2008-03-04 526896] "IAAnotif"=C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [2008-07-20 182808] "NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2008-08-07 13543968] "NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2008-08-07 92704] "LManager"=C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE [2008-07-02 821768] "eRecoveryService"= [] "ZPdtWzdVitaKey MC3000"=C:\Program Files\Acer\Acer Bio Protection\PdtWzd.exe [2008-10-17 3607040] "CLMLServer"=C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe [2008-05-12 167936] "PlayMovie"=C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe [2008-05-12 167936] "ProductReg"=C:\Program Files\Acer\WR_PopUp\ProductReg.exe [2008-09-23 6144] "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-10-15 39792] "QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-01-05 413696] "avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-21 202240] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-10-15 39792] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcadeDeluxeAgent] C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [2008-05-12 147456] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BkupTray] C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe [2008-04-06 34040] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eAudio] C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe [2008-03-07 544768] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl] C:\Windows\RtHDVCpl.exe [2008-04-28 6111232] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2008-01-18 1033512] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tuloxFreeWBE] C:\Program Files\tuloxFreeWBE\FreeDict.exe AUTOSTART [] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AWinNotifyVitaKey MC3000] C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll [2008-10-17 2972160] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] "notification packages"=scecli C:\Program Files\Acer\Acer Bio Protection\PwdFilter [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "EnableUIADesktopToggle"=0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSfsu.exe"="C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSfsu.exe:*:Enabled:eDSfsu" "C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\encryption.exe"="C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\encryption.exe:*:Enabled:encryption" "C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\decryption.exe"="C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\decryption.exe:*:Enabled:decryption" "C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSMgr.exe"="C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSMgr.exe:*:Enabled:eDSMgr" "C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStbmngr.exe"="C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStbmngr.exe:*:Enabled:eDStbmngr" "C:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\eDSfsu.exe"="C:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\eDSfsu.exe:*:Enabled:eDSfsu" "C:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\encryption.exe"="C:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\encryption.exe:*:Enabled:encryption" "C:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\decryption.exe"="C:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\decryption.exe:*:Enabled:decryption" "C:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\eDSMgr.exe"="C:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\eDSMgr.exe:*:Enabled:eDSMgr" "C:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\eDStbmngr.exe"="C:\Program Files\Acer\Empowering Technology\eDataSecurity\x64\eDStbmngr.exe:*:Enabled:eDStbmngr" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2217e42f-2dec-11de-b034-001e68f21ba8}] shell\AutoRun\command - F:\setup.exe shell\install\command - F:\setup.exe ======File associations====== .js - edit - C:\Windows\System32\Notepad.exe %1 .js - open - C:\Windows\System32\WScript.exe "%1" %* ======List of files/folders created in the last 1 months====== 2009-09-08 22:17:44 ----D---- C:\Program Files\trend micro 2009-09-08 22:17:41 ----D---- C:\rsit 2009-09-08 19:11:48 ----A---- C:\Windows\ntbtlog.txt 2009-09-07 19:57:20 ----A---- C:\Windows\Robota.INI 2009-09-07 19:57:05 ----D---- C:\Users\Lani\AppData\Roaming\MAGIX 2009-09-07 19:33:02 ----A---- C:\Windows\system32\TTIC32.dll 2009-09-07 19:33:02 ----A---- C:\Windows\system32\TTI32.dll 2009-09-07 19:33:02 ----A---- C:\Windows\system32\STRING32.dll 2009-09-07 19:33:02 ----A---- C:\Windows\system32\MXRestore.exe 2009-09-07 19:33:02 ----A---- C:\Windows\system32\mgxcdr.txt 2009-09-07 19:33:02 ----A---- C:\Windows\system32\mgxasio2.dll 2009-09-07 19:33:02 ----A---- C:\Windows\system32\DLLTPO32.dll 2009-09-07 19:33:02 ----A---- C:\Windows\system32\DLLRES32.dll 2009-09-07 19:33:02 ----A---- C:\Windows\system32\DLLRD32.dll 2009-09-07 19:33:02 ----A---- C:\Windows\system32\DLLPTL32.dll 2009-09-07 19:33:02 ----A---- C:\Windows\system32\DLLPRJ32.dll 2009-09-07 19:33:02 ----A---- C:\Windows\system32\DLLPRF32.dll 2009-09-07 19:33:02 ----A---- C:\Windows\system32\DLLPNT32.dll 2009-09-07 19:33:02 ----A---- C:\Windows\system32\DLLMSC32.dll 2009-09-07 19:33:02 ----A---- C:\Windows\system32\DLLIX.dll 2009-09-07 19:33:02 ----A---- C:\Windows\system32\DLLISO32.dll 2009-09-07 19:33:02 ----A---- C:\Windows\system32\DLLIO32.dll 2009-09-07 19:33:02 ----A---- C:\Windows\system32\DLLIMG32.dll 2009-09-07 19:33:02 ----A---- C:\Windows\system32\DLLDRV32.dll 2009-09-07 19:33:02 ----A---- C:\Windows\system32\DLLDIR32.dll 2009-09-07 19:33:02 ----A---- C:\Windows\system32\DLLDEV32.dll 2009-09-07 19:33:02 ----A---- C:\Windows\system32\DLLCPY32.dll 2009-09-07 19:33:02 ----A---- C:\Windows\system32\DLLCDF32.dll 2009-09-07 19:33:02 ----A---- C:\Windows\system32\DLLCDA32.dll 2009-09-07 19:33:02 ----A---- C:\Windows\system32\DLLAV32.dll 2009-09-07 19:31:59 ----D---- C:\ProgramData\MAGIX 2009-09-07 19:31:23 ----D---- C:\Program Files\MAGIX 2009-09-07 19:31:23 ----A---- C:\Windows\system32\DLLDEV32i.dll 2009-09-07 19:31:10 ----D---- C:\Windows\system32\MAGIX 2009-09-07 19:31:10 ----A---- C:\Windows\system32\mgxoschk.dll 2009-09-07 19:31:10 ----A---- C:\Windows\mgxoschk.ini 2009-09-07 06:55:23 ----D---- C:\ProgramData\NtiDvdCopy 2009-09-05 00:40:02 ----D---- C:\Program Files\Sony Setup 2009-09-03 03:17:52 ----D---- C:\Windows\system32\IOSUBSYS 2009-09-03 00:30:21 ----A---- C:\Windows\system32\Apphlpdm.dll 2009-09-03 00:30:20 ----A---- C:\Windows\system32\GameUXLegacyGDFs.dll 2009-08-26 03:01:17 ----A---- C:\Windows\system32\tzres.dll 2009-08-13 02:58:26 ----A---- C:\Windows\system32\atl.dll 2009-08-13 02:58:25 ----A---- C:\Windows\system32\mstscax.dll 2009-08-13 02:58:23 ----A---- C:\Windows\system32\wkssvc.dll 2009-08-13 02:58:21 ----A---- C:\Windows\system32\avifil32.dll 2009-08-13 02:58:17 ----A---- C:\Windows\system32\wmp.dll 2009-08-13 02:58:16 ----A---- C:\Windows\system32\wmpdxm.dll 2009-08-13 02:58:16 ----A---- C:\Windows\system32\spwmp.dll 2009-08-13 02:58:16 ----A---- C:\Windows\system32\dxmasf.dll 2009-08-13 02:58:15 ----A---- C:\Windows\system32\wmploc.DLL 2009-08-12 02:14:06 ----D---- C:\ProgramData\Age of Empires 3 ======List of files/folders modified in the last 1 months====== 2009-09-08 22:17:57 ----D---- C:\Windows\Prefetch 2009-09-08 22:17:48 ----D---- C:\Windows\Temp 2009-09-08 22:17:44 ----RD---- C:\Program Files 2009-09-08 21:14:06 ----D---- C:\hijack 2009-09-08 21:13:38 ----D---- C:\Windows\system32\WDI 2009-09-08 21:06:51 ----D---- C:\Windows\System32 2009-09-08 21:06:51 ----D---- C:\Windows\inf 2009-09-08 21:06:51 ----A---- C:\Windows\system32\PerfStringBackup.INI 2009-09-08 20:52:42 ----D---- C:\Program Files\Mozilla Firefox 2009-09-08 19:11:48 ----D---- C:\Windows 2009-09-07 20:57:58 ----D---- C:\Windows\system32\drivers 2009-09-07 19:57:27 ----RSD---- C:\Windows\Fonts 2009-09-07 19:34:03 ----SHD---- C:\Windows\Installer 2009-09-07 19:34:03 ----D---- C:\Windows\Help 2009-09-07 19:34:03 ----D---- C:\Program Files\Common Files\microsoft shared 2009-09-07 19:33:59 ----SHD---- C:\System Volume Information 2009-09-07 19:31:59 ----HD---- C:\ProgramData 2009-09-06 11:01:05 ----D---- C:\Users\Lani\AppData\Roaming\uTorrent 2009-09-05 11:04:02 ----D---- C:\Program Files\Microsoft Games 2009-09-05 11:02:30 ----D---- C:\Program Files\Bus Simulator 2009-09-03 12:16:21 ----D---- C:\Windows\winsxs 2009-09-03 12:06:04 ----D---- C:\Windows\system32\catroot 2009-09-03 12:06:02 ----D---- C:\Windows\system32\catroot2 2009-09-03 12:03:46 ----D---- C:\Windows\AppPatch 2009-09-03 03:17:48 ----D---- C:\Program Files\Google 2009-08-26 03:25:45 ----D---- C:\Windows\rescache 2009-08-26 03:07:28 ----D---- C:\Windows\system32\de-DE 2009-08-26 03:00:48 ----D---- C:\Program Files\Internet Explorer 2009-08-23 04:04:43 ----D---- C:\ProgramData\Messenger Plus! 2009-08-13 03:19:45 ----D---- C:\Program Files\Windows Media Player 2009-08-13 03:01:32 ----D---- C:\Program Files\Windows Mail 2009-08-13 01:28:55 ----D---- C:\Windows\system32\Tasks 2009-08-12 02:08:18 ----D---- C:\Temp 2009-08-12 01:55:06 ----HD---- C:\Program Files\InstallShield Installation Information 2009-08-12 01:55:00 ----RSD---- C:\Windows\assembly 2009-08-12 01:42:58 ----D---- C:\Program Files\Common Files\InstallShield |
|
08.09.2009, 21:29
| #4 |
| | Problem mit Trojaner...Tdss.Z.301 log.txt teil 2 ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys [2009-02-13 11608] R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2009-04-28 96104] R1 ISODrive;ISO DVD/CD-ROM Device Driver; \??\C:\Program Files\UltraISO\drivers\ISODrive.sys [2009-02-10 82320] R1 ssmdrv;ssmdrv; C:\Windows\system32\DRIVERS\ssmdrv.sys [2009-06-09 28520] R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; \??\C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl [2008-05-09 61424] R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2009-08-08 55656] R2 int15;int15; \??\C:\Windows\system32\drivers\int15.sys [2007-01-26 69632] R2 NTIPPKernel;NTIPPKernel; \??\C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys [2008-01-16 122368] R2 PSDNServ;PSDNServ; C:\Windows\system32\DRIVERS\PSDNServ.sys [2008-03-04 16944] R2 psdvdisk;PSDVdisk; C:\Windows\system32\DRIVERS\PSDVdisk.sys [2008-03-04 60464] R3 AgereSoftModem;Agere Systems Soft Modem; C:\Windows\system32\DRIVERS\AGRSM.sys [2008-02-29 1202560] R3 ATSWPDRV;AuthenTec TruePrint USB Driver (SwipeSensor); C:\Windows\system32\DRIVERS\ATSwpDrv.sys [2008-04-25 146688] R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2008-03-28 210432] R3 CmBatt;Treiber für Microsoft-ACPI-Kontrollmethodenkompatible Batterie; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-21 14208] R3 DKbFltr;Dritek Keyboard Filter Driver; C:\Windows\system32\DRIVERS\DKbFltr.sys [2008-07-02 21264] R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-04-28 2127512] R3 JMCR;JMCR; C:\Windows\system32\DRIVERS\jmcr.sys [2008-04-21 81296] R3 NETw5v32;Intel(R) Wireless WiFi Link Adaptertreiber für Windows Vista 32-Bit; C:\Windows\system32\DRIVERS\NETw5v32.sys [2008-04-28 3658752] R3 NTIDrvr;Upper Class Filter Driver; C:\Windows\system32\DRIVERS\NTIDrvr.sys [2008-01-30 14848] R3 NVHDA;Service for NVIDIA High Definition Audio Driver; C:\Windows\system32\drivers\nvhda32v.sys [2008-08-07 44064] R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2008-08-07 7545824] R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2008-01-18 196784] R3 usbvideo;USB-Videogerät (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-21 134016] R3 winbondcir;Winbond IR Transceiver; C:\Windows\system32\DRIVERS\winbondcir.sys [2007-03-28 43008] R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2008-01-21 11264] S3 A310;AVerMedia A310 DVB-T; C:\Windows\system32\DRIVERS\AVerA310USB.sys [2008-04-15 25856] S3 ablbu9i2;ablbu9i2; C:\Windows\system32\drivers\ablbu9i2.sys [] S3 BDASwCap;AVerMedia A310 BDA DVBT Capture Device; C:\Windows\system32\drivers\AVerA310Cap.sys [2008-04-15 42880] S3 BthEnum;Bluetooth-Anforderungsblocktreiber; C:\Windows\system32\DRIVERS\BthEnum.sys [2008-01-21 19456] S3 BthPan;Bluetooth-Gerät (PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2008-01-21 92160] S3 BthPort;Bluetooth-Porttreiber; C:\Windows\System32\Drivers\BTHport.sys [2008-04-29 220160] S3 BTHUSB;USB-Treiber für Bluetooth-Funkgerät; C:\Windows\System32\Drivers\BTHUSB.sys [2008-04-29 29184] S3 btwaudio;Bluetooth-Audiogerät; C:\Windows\system32\drivers\btwaudio.sys [2008-02-14 80424] S3 btwavdt;Bluetooth AVDT Service; C:\Windows\system32\drivers\btwavdt.sys [2007-07-16 80936] S3 btwrchid;btwrchid; C:\Windows\system32\DRIVERS\btwrchid.sys [2007-07-16 16168] S3 drmkaud;Microsoft Kernel-DRM-Audioentschlüsselung; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632] S3 HdAudAddService;Microsoft 1.1 UAA-Funktionstreiber für High Definition Audio-Dienst; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520] S3 MarvinBus;Pinnacle Marvin Bus; C:\Windows\system32\DRIVERS\MarvinBus.sys [2005-09-23 171520] S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192] S3 MSPCLOCK;Microsoft Proxy für Streaming Clock; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888] S3 MSPQM;Microsoft Proxy für Streaming Quality Manager; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504] S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016] S3 RFCOMM;Bluetooth-Gerät (RFCOMM-Protokoll-TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2008-01-21 49664] S3 SANDRA;SANDRA; \??\C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009\WNt500x86\Sandra.sys [2008-07-29 21920] S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM); C:\Windows\system32\DRIVERS\ss_bus.sys [2007-05-02 83592] S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter; C:\Windows\system32\DRIVERS\ss_mdfl.sys [2007-05-02 15112] S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers; C:\Windows\system32\DRIVERS\ss_mdm.sys [2007-05-02 109704] S3 VMnetAdapter;VMware Virtual Ethernet Adapter Driver; C:\Windows\system32\DRIVERS\vmnetadapter.sys [] S3 WSDPrintDevice;WSD-Druckunterstützung durch UMB; C:\Windows\system32\DRIVERS\WSDPrint.sys [2008-01-21 16896] S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328] S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656] S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616] S4 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2008-01-21 88576] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 AgereModemAudio;Agere Modem Call Progress Audio; C:\Windows\system32\agrsmsvc.exe [2008-03-18 13312] R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-06-09 108289] R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-08-08 185089] R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2008-01-21 21504] R2 BUNAgentSvc;NTI Backup Now 5 Agent Service; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [2008-03-03 16384] R2 CLHNService;CLHNService; C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [2008-01-16 81504] R2 eDataSecurity Service;eDataSecurity Service; C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe [2008-03-04 500784] R2 ETService;Empowering Technology Service; C:\Program Files\Acer\Empowering Technology\Service\ETService.exe [2008-03-21 24576] R2 IAANTMON;Intel(R) Matrix Storage Event Monitor; C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe [2008-07-20 354840] R2 IGBASVC;iGroupTec Service; C:\Program Files\Acer\Acer Bio Protection\BASVC.exe [2008-10-17 3471360] R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2007-01-17 61440] R2 MobilityService;MobilityService; C:\Acer\Mobility Center\MobilityService.exe [2007-12-06 110592] R2 NTIBackupSvc;NTI Backup Now 5 Backup Service; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-04-06 50424] R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-04-04 131072] R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2008-08-07 196608] R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\Cyberlink\Shared files\RichVideo.exe [2007-01-09 272024] S2 gupdate1c9a67fd9624cba;Google Update Service (gupdate1c9a67fd9624cba); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-03-16 133104] S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance; C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe [2005-11-17 1527900] S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-20 136120] S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632] S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136] S3 SandraAgentSrv;SiSoftware Deployment Agent Service; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009\RpcAgentSrv.exe [2008-09-08 98488] -----------------EOF----------------- |
|
08.09.2009, 21:30
| #5 |
| | Problem mit Trojaner...Tdss.Z.301 info txt info.txt logfile of random's system information tool 1.06 2009-09-08 22:18:03 ======Uninstall list====== -->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A450831D-25F6-4F42-9662-D000B25E0D82}\Setup.exe" -uninstall -->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AA4BF92B-2AAF-11DA-9D78-000129760D75}\Setup.exe" -uninstall 3ivx D4 4.5.1 (remove only)-->"C:\Program Files\3ivx\3ivx D4 4.5.1\uninstall.exe" Acer Arcade Deluxe-->"C:\Program Files\InstallShield Installation Information\{2637C347-9DAD-11D6-9EA2-00055D0CA761}\Setup.exe" /z-uninstall Acer Arcade Deluxe-->"C:\Program Files\InstallShield Installation Information\{2637C347-9DAD-11D6-9EA2-00055D0CA761}\Setup.exe" /z-uninstall Acer Bio Protection AAA 6.0.00.13-->"C:\Program Files\Acer\Acer Bio Protection\uninstall.exe" Acer Crystal Eye Webcam 2.0.8-->C:\Program Files\InstallShield Installation Information\{A77255C4-AFCB-44A3-BF0F-2091A71FFD9E}\setup.exe -runfromtemp -l0x0007 -removeonly Acer eAudio Management-->"C:\Program Files\InstallShield Installation Information\{57265292-228A-41FA-9AEC-4620CBCC2739}\Setup.exe" -uninstall Acer eDataSecurity Management-->C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSnstHelper.exe -Operation UNINSTALL Acer Empowering Technology-->"C:\Program Files\InstallShield Installation Information\{8F1B6239-FEA0-450A-A950-B05276CE177C}\setup.exe" -runfromtemp -l0x0007 -removeonly Acer ePower Management-->"C:\Program Files\InstallShield Installation Information\{58E5844B-7CE2-413D-83D1-99294BF6C74F}\setup.exe" -runfromtemp -l0x0007 -removeonly Acer eRecovery Management-->"C:\Program Files\InstallShield Installation Information\{7F811A54-5A09-4579-90E1-C93498E230D9}\setup.exe" -runfromtemp -l0x0007 -removeonly Acer eSettings Management-->"C:\Program Files\InstallShield Installation Information\{13D85C14-2B85-419F-AC41-C7F21E68B25D}\setup.exe" -runfromtemp -l0x0007 -removeonly Acer GridVista-->C:\Windows\GVUni.exe GridV.UNI Acer Mobility Center Plug-In-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{11316260-6666-467B-AC34-183FCB5D4335}\setup.exe" -l0x7 -removeonly Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe Adobe Flash Player ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe Adobe Photoshop CS-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EFB21DE7-8C19-4A88-BB28-A766E16493BC}\setup.exe" -l0x7 Adobe Reader 8.1.4-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81300000003} Adobe Shockwave Player 11-->C:\Windows\system32\adobe\SHOCKW~1\UNWISE.EXE C:\Windows\system32\Adobe\SHOCKW~1\Install.log Age of Empires III-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{7B9CC60A-9B81-46A3-A953-76B6BF9EEC97} Age of Mythology-->"C:\Program Files\Microsoft Games\Age of Mythology\UNINSTAL.EXE" /runtemp /addremove Agere Systems HDA Modem-->agrsmdel Audacity 1.2.6-->"C:\Program Files\Audacity\unins000.exe" AuthenTec Fingerprint Sensor Minimum Install-->MsiExec.exe /X{31A5ED9F-E07B-4F6E-8179-27325BAAC502} AVerMedia A310 (MiniCard, DVB-T) 1.1.0.27-->C:\Program Files\AVerMedia\AVerMedia A310 (MiniCard, DVB-T)\uninst.exe Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir Desktop\setup.exe /REMOVE AVS Video Converter 6-->"C:\Program Files\AVS4YOU\AVSVideoConverter6\unins000.exe" AVS4YOU Software Navigator 1.3-->"C:\Program Files\AVS4YOU\AVSSoftwareNavigator\unins000.exe" Broadcom Gigabit Integrated Controller-->MsiExec.exe /X{A64A5576-D862-44F8-89DC-2B17FCC9B86E} Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E} Compatibility Pack for the 2007 Office system-->MsiExec.exe /X{90120000-0020-0409-0000-0000000FF1CE} Das Latein-Wörterbuch 2.1.1-->"C:\Program Files\Latein-Wörterbuch\unins000.exe" DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER DivX Plus DirectShow Filters-->C:\Program Files\DivX\DivXDSFiltersUninstall.exe /DSFILTERS DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN DSS DJ 5.6-->"C:\Program Files\MyXOFT\DSS DJ\unins000.exe" eSobi v2-->C:\Program Files\InstallShield Installation Information\{15D967B5-A4BE-42AE-9E84-64CD062B25AA}\setup.exe -runfromtemp -l0x0407 Euro Truck Simulator-->C:\Program Files\Euro Truck Simulator\Uninstal_EuroTruckSimulator.exe Firebird SQL Server - MAGIX Edition-->C:\Program Files\MAGIX\Common\Database\unwise.exe Free Video to Mp3 Converter version 2.8-->"C:\Program Files\DVDVideoSoft\Free Video to Mp3 Converter\unins000.exe" Google Gears-->MsiExec.exe /I{F724042F-367A-3B58-9BE3-8EF7A6F058D6} Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2} HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT="" Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT="" Intel® Matrix Storage Manager-->C:\Program Files\Intel\Intel Matrix Storage Manager\Uninstall\imsmudlg.exe -uninstall JMicron JMB38X Flash Media Controller-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{26604C7E-A313-4D12-867F-7C6E7820BE4C}\setup.exe" -l0x7 -removeonly Launch Manager-->C:\Windows\UnInst32.exe QtZgAcer.UNI MAGIX Music Maker 15 Premium Trial 15.0.1.5 (UK)-->C:\Program Files\MAGIX\MusicMaker15Premium_Download_version\unwise.exe MAGIX Screenshare 4.3.6.1987 (UK)-->C:\Program Files\MAGIX\PCVisit\unwise.exe Messenger Plus! Live-->"C:\Program Files\Messenger Plus! Live\Uninstall.exe" Microsoft .NET Framework 3.5 Language Pack SP1 - DEU-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - deu\setup.exe Microsoft .NET Framework 3.5 Language Pack SP1 - deu-->MsiExec.exe /I{052FDD78-A6EA-3187-8386-C82F4CA3A929} Microsoft .NET Framework 3.5 SP1-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} Microsoft Games for Windows - LIVE Redistributable-->MsiExec.exe /X{59E4543A-D49D-4489-B445-473D763C79AF} Microsoft Office Professional Edition 2003-->MsiExec.exe /I{90110407-6000-11D3-8CFE-0150048383C9} Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118} Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d} Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148-->MsiExec.exe /X{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C} Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475} Microsoft Works-->MsiExec.exe /I{4EA2F95F-A537-4D17-9E7F-6B3FF8D9BBE3} Mozilla Firefox (3.5.2)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94} MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71} MSXML4 Parser-->MsiExec.exe /I{01501EBA-EC35-4F9F-8889-3BE346E5DA13} NTI Backup Now 5-->C:\Program Files\InstallShield Installation Information\{12EFA1A4-AC3B-443C-8143-237EDE760403}\setup.exe -runfromtemp -l0x0407 NTI Media Maker 8-->C:\Program Files\InstallShield Installation Information\{2413930C-8309-47A6-BC61-5EF27A4222BC}\setup.exe -runfromtemp -l0x0407 NVIDIA Drivers-->C:\Windows\system32\NVUNINST.EXE UninstallGUI Orion-->MsiExec.exe /X{5B63A470-9334-44D1-AF61-6CE2DB565AE9} PhotoNow!-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D36DD326-7280-11D8-97C8-000129760CBE}\Setup.exe" -uninstall Picasa 3-->"C:\Program Files\Google\Picasa3\Uninstall.exe" PowerDirector-->"C:\Program Files\InstallShield Installation Information\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}\setup.exe" /z-uninstall QuickTime-->MsiExec.exe /I{216AB108-2AE1-4130-B3D5-20B2C4C80F8F} Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\setup.exe" -removeonly SAMSUNG Mobile Composite Device Software-->C:\Windows\system32\Samsung_USB_Drivers\6\SSBCUninstall.exe SAMSUNG Mobile Modem Driver Set-->C:\Windows\system32\Samsung_USB_Drivers\3\SSCDUninstall.exe Samsung Mobile phone USB driver Software-->C:\Windows\system32\Samsung_USB_Drivers\5\SSSDUninstall.exe SAMSUNG Mobile USB Modem 1.0 Software-->C:\Windows\system32\Samsung_USB_Drivers\1\SS_Uninstall.exe SAMSUNG Mobile USB Modem Software-->C:\Windows\system32\Samsung_USB_Drivers\2\SSM_Uninstall.exe Samsung PC Studio 3 USB Driver Installer-->"C:\Program Files\InstallShield Installation Information\{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}\setup.exe" -runfromtemp -l0x0007 -removeonly SiSoftware Sandra Lite 2009-->"C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009\unins000.exe" Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall Teachmaster 3.3-->"C:\Program Files\Teachmaster\unins000.exe" Text-To-Speech-Runtime-->MsiExec.exe /X{7B3F0113-E63C-4D6D-AF19-111A3165CCA2} UltraISO Premium V9.33-->"C:\Program Files\UltraISO\unins000.exe" Uninstall 1.0.0.0-->"C:\Program Files\Common Files\DVDVideoSoft\unins000.exe" Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT="" VC80CRTRedist - 8.0.50727.762-->MsiExec.exe /I{767CC44C-9BBC-438D-BAD3-FD4595DD148B} WIDCOMM Bluetooth Software 6.0.1.6300-->MsiExec.exe /X{03D1988F-469F-4843-8E6E-E5FE9D17889D} Winbond CIR Device Drivers-->MsiExec.exe /I{10F498FF-5392-4DF3-8F73-FE172A9F3800} Windows Live Anmelde-Assistent-->MsiExec.exe /I{52B97218-98CB-4B8B-9283-D213C85E1AA4} Windows Live Call-->MsiExec.exe /I{5FC68772-6D56-41C6-9DF1-24E868198AE6} Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52} Windows Live Essentials-->C:\Program Files\Windows Live\Installer\wlarp.exe Windows Live Essentials-->MsiExec.exe /I{91E04CA7-0B13-4F8C-AA4D-2A573AC96D19} Windows Live Messenger-->MsiExec.exe /X{837B6259-6FF5-4E66-87C1-A5A15ED36FF4} Windows Live-Uploadtool-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238} Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4} WinRAR-->C:\Program Files\WinRAR\uninstall.exe ======Security center information====== AS: Windows Defender ======System event log====== Computer Name: Lani-PC Event Code: 7036 Message: Dienst "WinHTTP-Web Proxy Auto-Discovery-Dienst" befindet sich jetzt im Status "Beendet". Record Number: 118717 Source Name: Service Control Manager Time Written: 20090908192748.000000-000 Event Type: Informationen User: Computer Name: Lani-PC Event Code: 1103 Message: Dem Computer wurde erfolgreich eine Netzwerkadresse zugeteilt. Eine Verbindung mit anderen Computern kann nun hergestellt werden. Record Number: 118718 Source Name: Microsoft-Windows-Dhcp-Client Time Written: 20090908195915.000000-000 Event Type: Informationen User: Computer Name: Lani-PC Event Code: 102 Message: Der Dienst hat das Veröffentlichen aufgrund eines Stromversorgungsereignisses vorübergehend beendet. Record Number: 118719 Source Name: Microsoft-Windows-ResourcePublication Time Written: 20090908195919.179104-000 Event Type: Informationen User: NT-AUTORITÄT\LOKALER DIENST Computer Name: Lani-PC Event Code: 104 Message: Der Dienst veröffentlicht in das Netzwerk. Record Number: 118720 Source Name: Microsoft-Windows-ResourcePublication Time Written: 20090908195950.333104-000 Event Type: Informationen User: NT-AUTORITÄT\LOKALER DIENST Computer Name: Lani-PC Event Code: 7036 Message: Dienst "WinHTTP-Web Proxy Auto-Discovery-Dienst" befindet sich jetzt im Status "Ausgeführt". Record Number: 118721 Source Name: Service Control Manager Time Written: 20090908201237.000000-000 Event Type: Informationen User: =====Application event log===== Computer Name: Lani-PC Event Code: 4113 Message: AntiVir erkannte in der Datei C:\Windows\System32\rotscxjbsprbdr.dll verdächtigen Code mit der Bezeichnung 'TR/PCK.Tdss.Z.301'! Record Number: 19901 Source Name: Avira AntiVir Time Written: 20090908201723.000000-000 Event Type: Warnung User: NT-AUTORITÄT\SYSTEM Computer Name: Lani-PC Event Code: 4113 Message: AntiVir erkannte in der Datei C:\Windows\System32\rotscxjbsprbdr.dll verdächtigen Code mit der Bezeichnung 'TR/PCK.Tdss.Z.301'! Record Number: 19902 Source Name: Avira AntiVir Time Written: 20090908201741.000000-000 Event Type: Warnung User: NT-AUTORITÄT\SYSTEM Computer Name: Lani-PC Event Code: 4113 Message: AntiVir erkannte in der Datei C:\Windows\System32\rotscxjbsprbdr.dll verdächtigen Code mit der Bezeichnung 'TR/PCK.Tdss.Z.301'! Record Number: 19903 Source Name: Avira AntiVir Time Written: 20090908201744.000000-000 Event Type: Warnung User: NT-AUTORITÄT\SYSTEM Computer Name: Lani-PC Event Code: 4113 Message: AntiVir erkannte in der Datei C:\Windows\System32\rotscxjbsprbdr.dll verdächtigen Code mit der Bezeichnung 'TR/PCK.Tdss.Z.301'! Record Number: 19904 Source Name: Avira AntiVir Time Written: 20090908201747.000000-000 Event Type: Warnung User: NT-AUTORITÄT\SYSTEM Computer Name: Lani-PC Event Code: 5 Message: Unsupported service control request (see data below) Record Number: 19905 Source Name: LightScribeService Time Written: 20090908201802.000000-000 Event Type: Informationen User: =====Security event log===== Computer Name: Lani-PC Event Code: 5038 Message: Die Codeintegrität hat festgestellt, dass der Abbildhash einer Datei nicht gültig ist. Die Datei wurde möglicherweise durch eine nicht autorisierte Änderung beschädigt. Dieses Problem kann auch auf einen potenziellen Fehler des Datenträgergeräts hinweisen. Dateiname: \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys Record Number: 27638 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20090908201759.636504-000 Event Type: Überwachung gescheitert User: Computer Name: Lani-PC Event Code: 5038 Message: Die Codeintegrität hat festgestellt, dass der Abbildhash einer Datei nicht gültig ist. Die Datei wurde möglicherweise durch eine nicht autorisierte Änderung beschädigt. Dieses Problem kann auch auf einen potenziellen Fehler des Datenträgergeräts hinweisen. Dateiname: \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys Record Number: 27639 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20090908201759.667704-000 Event Type: Überwachung gescheitert User: Computer Name: Lani-PC Event Code: 5038 Message: Die Codeintegrität hat festgestellt, dass der Abbildhash einer Datei nicht gültig ist. Die Datei wurde möglicherweise durch eine nicht autorisierte Änderung beschädigt. Dieses Problem kann auch auf einen potenziellen Fehler des Datenträgergeräts hinweisen. Dateiname: \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys Record Number: 27640 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20090908201759.698904-000 Event Type: Überwachung gescheitert User: Computer Name: Lani-PC Event Code: 5038 Message: Die Codeintegrität hat festgestellt, dass der Abbildhash einer Datei nicht gültig ist. Die Datei wurde möglicherweise durch eine nicht autorisierte Änderung beschädigt. Dieses Problem kann auch auf einen potenziellen Fehler des Datenträgergeräts hinweisen. Dateiname: \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys Record Number: 27641 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20090908201759.730104-000 Event Type: Überwachung gescheitert User: Computer Name: Lani-PC Event Code: 5038 Message: Die Codeintegrität hat festgestellt, dass der Abbildhash einer Datei nicht gültig ist. Die Datei wurde möglicherweise durch eine nicht autorisierte Änderung beschädigt. Dieses Problem kann auch auf einen potenziellen Fehler des Datenträgergeräts hinweisen. Dateiname: \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys Record Number: 27642 Source Name: Microsoft-Windows-Security-Auditing Time Written: 20090908201759.776904-000 Event Type: Überwachung gescheitert User: ======Environment variables====== "ComSpec"=%SystemRoot%\system32\cmd.exe "FP_NO_HOST_CHECK"=NO "OS"=Windows_NT "Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Acer\Empowering Technology\eDataSecurity\;C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86;C:\Program Files\Acer\Empowering Technology\eDataSecurity\x64;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\Common Files\DivX Shared\;C:\Program Files\Common Files\Ulead Systems\MPEG "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC "PROCESSOR_ARCHITECTURE"=x86 "TEMP"=%SystemRoot%\TEMP "TMP"=%SystemRoot%\TEMP "USERNAME"=SYSTEM "windir"=%SystemRoot% "PROCESSOR_LEVEL"=6 "PROCESSOR_IDENTIFIER"=x86 Family 6 Model 23 Stepping 6, GenuineIntel "PROCESSOR_REVISION"=1706 "NUMBER_OF_PROCESSORS"=2 "TRACE_FORMAT_SEARCH_PATH"=\\NTREL202.ntdev.corp.microsoft.com\4F18C3A5-CA09-4DBD-B6FC-219FDD4C6BE0\TraceFormat "DFSTRACINGON"=FALSE "Pathtem"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Acer\Empowering Technology\eDataSecurity\;C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86;C:\Program Files\Acer\Empowering Technology\eDataSecurity\x64 "NTIPath"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Acer\Empowering Technology\eDataSecurity\;C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86;C:\Program Files\Acer\Empowering Technology\eDataSecurity\x64;C:\Program Files\NewTech Infosystems\NTI Backup Now 5\; "SAN_DIR"=C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009 "CLASSPATH"=.;C:\Program Files\QuickTime\QTSystem\QTJava.zip "QTJAVA"=C:\Program Files\QuickTime\QTSystem\QTJava.zip -----------------EOF----------------- |
|
08.09.2009, 22:52
| #6 |
| | Problem mit Trojaner...Tdss.Z.301 so hab CCleaner benutzt und das ist die log datei teil 1 von cofi ComboFix 09-09-08.01 - Lani 08.09.2009 23:01.1.2 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.43.1031.18.3066.2219 [GMT 2:00] ausgeführt von:: c:\users\Lani\Desktop\cofi.exe SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . c:\$recycle.bin\S-1-5-21-2186939400-4108186658-686649013-500 c:\recycler\S-1-5-21-1454471165-1972579041-1801674531-1003 c:\users\Lani\AppData\Roaming\.# c:\users\Lani\AppData\Roaming\.#\MBX@AC@1EA2990.### c:\users\Lani\AppData\Roaming\.#\MBX@AC@1EA29C0.### c:\users\Lani\AppData\Roaming\.#\MBX@AC@1EA29F0.### c:\windows\Installer\2b28b0.msi c:\windows\Installer\5f587.msi c:\windows\Suyin.reg c:\windows\system32\drivers\rotscxeejuxtkr.sys c:\windows\system32\rotscxihcyywpb.dat c:\windows\system32\rotscxqiberkiy.dat c:\windows\system32\rotscxwipyekhr.dll c:\windows\UA000019.DLL . ((((((((((((((((((((((((((((((((((((((( Treiber/Dienste ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_rotscxftppqpum ((((((((((((((((((((((( Dateien erstellt von 2009-08-08 bis 2009-09-08 )))))))))))))))))))))))))))))) . 2009-09-08 21:06 . 2009-09-08 21:10 -------- d-----w- c:\users\Lani\AppData\Local\temp 2009-09-08 21:06 . 2009-09-08 21:06 -------- d-----w- c:\users\Default\AppData\Local\temp 2009-09-08 21:06 . 2009-09-08 21:06 -------- d-----w- c:\users\CuLi\AppData\Local\temp 2009-09-08 20:36 . 2009-09-08 20:36 -------- d-----w- c:\program files\CCleaner 2009-09-08 20:17 . 2009-09-08 20:18 -------- d-----w- c:\program files\trend micro 2009-09-08 20:17 . 2009-09-08 20:18 -------- d-----w- C:\rsit 2009-09-07 17:57 . 2009-09-07 17:57 -------- d-----w- c:\users\Lani\AppData\Roaming\MAGIX 2009-09-07 17:31 . 2007-04-27 07:43 120200 ----a-w- c:\windows\system32\DLLDEV32i.dll 2009-09-07 17:31 . 2009-09-07 17:33 -------- d-----w- c:\windows\system32\MAGIX 2009-09-07 17:31 . 2008-04-15 13:14 700416 ----a-w- c:\windows\system32\mgxoschk.dll 2009-09-07 04:55 . 2009-09-07 04:55 -------- d-----w- c:\programdata\NtiDvdCopy 2009-09-04 22:40 . 2009-09-04 22:40 -------- d-----w- c:\program files\Sony Setup 2009-09-03 01:17 . 2009-09-03 01:17 -------- d-----w- c:\windows\system32\IOSUBSYS 2009-09-02 22:30 . 2009-08-28 12:39 28672 ----a-w- c:\windows\system32\Apphlpdm.dll 2009-09-02 22:30 . 2009-08-28 10:15 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll 2009-08-26 01:01 . 2009-06-22 10:22 2048 ----a-w- c:\windows\system32\tzres.dll 2009-08-13 00:58 . 2009-07-17 14:35 71680 ----a-w- c:\windows\system32\atl.dll 2009-08-13 00:58 . 2009-06-04 12:34 2066432 ----a-w- c:\windows\system32\mstscax.dll 2009-08-13 00:58 . 2009-06-10 12:12 160256 ----a-w- c:\windows\system32\wkssvc.dll 2009-08-13 00:58 . 2009-06-10 12:07 91136 ----a-w- c:\windows\system32\avifil32.dll 2009-08-13 00:58 . 2009-07-14 13:00 313344 ----a-w- c:\windows\system32\wmpdxm.dll 2009-08-13 00:58 . 2009-07-14 12:59 4096 ----a-w- c:\windows\system32\dxmasf.dll 2009-08-13 00:58 . 2009-07-14 12:58 7680 ----a-w- c:\windows\system32\spwmp.dll 2009-08-13 00:58 . 2009-07-14 10:59 8147456 ----a-w- c:\windows\system32\wmploc.DLL 2009-08-12 00:14 . 2009-08-12 00:14 -------- d-----w- c:\programdata\Age of Empires 3 . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-09-08 21:07 . 2009-02-22 23:28 12 ----a-w- c:\windows\bthservsdp.dat 2009-09-08 21:01 . 2008-01-21 07:15 618442 ----a-w- c:\windows\system32\perfh007.dat 2009-09-08 21:01 . 2008-01-21 07:15 122842 ----a-w- c:\windows\system32\perfc007.dat 2009-09-08 16:27 . 2008-10-17 13:13 150576 ----a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT 2009-09-07 17:33 . 2009-09-07 17:31 -------- d-----w- c:\programdata\MAGIX 2009-09-07 17:33 . 2009-09-07 17:31 -------- d-----w- c:\program files\MAGIX 2009-09-06 09:01 . 2009-02-27 00:24 -------- d-----w- c:\users\Lani\AppData\Roaming\uTorrent 2009-09-05 09:04 . 2006-11-02 12:37 -------- d-----w- c:\program files\Microsoft Games 2009-09-05 09:02 . 2009-07-20 07:48 -------- d-----w- c:\program files\Bus Simulator 2009-09-03 01:17 . 2008-10-17 14:08 -------- d-----w- c:\program files\Google 2009-08-31 22:12 . 2009-02-21 23:33 146728 ----a-w- c:\programdata\nvModes.dat 2009-08-23 02:04 . 2009-03-01 22:31 -------- d-----w- c:\programdata\Messenger Plus! 2009-08-13 01:01 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail 2009-08-11 23:55 . 2008-04-18 08:42 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-08-11 23:42 . 2008-04-18 08:42 -------- d-----w- c:\program files\Common Files\InstallShield 2009-08-07 23:24 . 2009-04-25 23:11 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2009-07-21 21:52 . 2009-07-28 23:28 915456 ----a-w- c:\windows\system32\wininet.dll 2009-07-21 21:47 . 2009-07-28 23:28 109056 ----a-w- c:\windows\system32\iesysprep.dll 2009-07-21 21:47 . 2009-07-28 23:28 71680 ----a-w- c:\windows\system32\iesetup.dll 2009-07-21 20:13 . 2009-07-28 23:28 133632 ----a-w- c:\windows\system32\ieUnatt.exe 2009-07-17 23:31 . 2009-02-24 20:05 1621 ----a-w- c:\programdata\xml5C7A.tmp 2009-07-17 23:31 . 2009-04-10 00:56 13723 ----a-w- c:\programdata\xml6BFE.tmp 2009-07-17 23:31 . 2009-02-24 20:05 8858 ----a-w- c:\programdata\xml38F1.tmp 2009-07-17 21:20 . 2009-07-17 21:20 -------- d-----w- c:\program files\Euro Truck Simulator 2009-07-16 23:46 . 2009-05-24 23:20 -------- d-----w- c:\program files\Pinnacle 2009-07-16 23:43 . 2009-05-24 23:17 -------- d-----w- c:\programdata\Pinnacle 2009-07-16 23:36 . 2009-05-24 23:30 -------- d-----w- c:\users\Lani\AppData\Roaming\proDAD 2009-07-16 23:36 . 2009-05-31 21:33 -------- d-----w- c:\program files\Rockstar Games 2009-07-13 00:16 . 2009-02-28 23:10 -------- d-----w- c:\program files\Messenger Plus! Live 2009-06-15 15:24 . 2009-07-14 20:36 156672 ----a-w- c:\windows\system32\t2embed.dll 2009-06-15 15:20 . 2009-07-14 20:36 72704 ----a-w- c:\windows\system32\fontsub.dll 2009-06-15 15:20 . 2009-07-14 20:36 10240 ----a-w- c:\windows\system32\dciman32.dll 2009-06-15 12:52 . 2009-07-14 20:36 289792 ----a-w- c:\windows\system32\atmfd.dll 2009-06-13 19:47 . 2009-04-09 23:16 183112 ------w- c:\windows\system32\PnkBstrB.exe 2009-04-07 00:29 . 2009-04-07 00:29 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll 2009-04-07 00:29 . 2009-04-07 00:29 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP] @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}" [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}] 2008-03-04 21:38 121392 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184] "ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-04-23 397312] "eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-03-04 526896] "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-07-20 182808] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-08-07 13543968] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-08-07 92704] "LManager"="c:\progra~1\LAUNCH~1\QtZgAcer.EXE" [2008-07-02 821768] "ZPdtWzdVitaKey MC3000"="c:\program files\Acer\Acer Bio Protection\PdtWzd.exe" [2008-10-17 3607040] "CLMLServer"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2008-05-12 167936] "PlayMovie"="c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2008-05-12 167936] "ProductReg"="c:\program files\Acer\WR_PopUp\ProductReg.exe" [2008-09-23 6144] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-3-23 113664] BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-2-12 723496] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AWinNotifyVitaKey MC3000] 2008-10-17 14:13 2972160 ----a-w- c:\program files\Acer\Acer Bio Protection\WinNotify.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "mixer3"=wdmaud.drv [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{379EC35C-E9AE-4E04-9C29-8B26F5F447C0}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{449624C0-B221-4970-955C-3D36E9B3DF7E}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{455A26F0-C6B0-46EF-82ED-33468C2FB9C7}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector "{8737DBFA-FFA7-4D38-9D17-1590EC698208}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe "{BC3D4632-0058-4489-A7E2-05D654ED0601}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe "{12184E5A-9CE2-4B47-95F3-2A883A973399}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe "{A0C311F6-01FE-46EE-BBBB-A31546E2C522}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe "{30725DB0-FE78-43B2-8FD1-45C1599AB623}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe "{DBC71D6E-5325-45CF-8F72-EA52CE052DCC}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe "{995B8410-56C4-4B60-8F0C-902B00358B08}"= c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe "{474C307C-FF41-47AA-8B7B-2014F2D018D8}"= c:\program files\Acer Arcade Deluxe\PlayMovie\PlayMovie.exe:Acer Play Movie "{3CA4144D-C1CD-44B4-BE9C-EEAB20F86C1C}"= c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe:Acer Play Movie Resident Program "{1FAA1FAD-4F39-46A5-9780-84FD542472FE}"= c:\program files\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe:Acer HomeMedia "{82C11B34-CA23-4283-B7D1-B4F0914F6FA0}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In) "{0DA6C270-32A6-46D2-A929-EC77296D12A0}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In) "{6C57DA9B-1CD9-49E9-B2D7-96717452DFC9}"= UDP:c:\windows\Temp\Installer.exe:Breitband-Internet-Installation "{D984A04B-4F02-4C71-A2B4-D4850B495D21}"= TCP:c:\windows\Temp\Installer.exe:Breitband-Internet-Installation "{A060B1D4-BCC2-4640-8B37-6224AF86409A}"= UDP:c:\windows\Temp\Installer.exe:Breitband-Internet-Installation "{E9A4C066-B5F1-4917-B367-36628CC4FE76}"= TCP:c:\windows\Temp\Installer.exe:Breitband-Internet-Installation "{F26F45A7-4A3E-4F2D-BDFA-711C90AE6D8D}"= UDP:c:\program files\Ubisoft Entertainment\Wheelman\Binaries\WheelmanGame-Final.exe:Wheelman "{AE5765C2-5F80-4DEC-8623-5E9A46E4400B}"= TCP:c:\program files\Ubisoft Entertainment\Wheelman\Binaries\WheelmanGame-Final.exe:Wheelman "{DCAFD8C4-8B80-4CF5-AF11-1FA31E273A3C}"= UDP:c:\program files\aon\aonController\aonController.exe:Controller "{328FB0C4-6B72-4F20-9613-69EC2E208A1B}"= TCP:c:\program files\aon\aonController\aonController.exe:Controller "TCP Query User{A600E109-D9AA-4F87-AB68-942ABEDC7984}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:µTorrent "UDP Query User{C29867AE-9167-4690-827F-28A8F1DBA28A}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:µTorrent "{F5735993-0620-4935-A283-B84C843BB2E9}"= UDP:c:\program files\VMware\VMware Server\vmware-authd.exe:VMware Authd "{127B5991-BC6E-4D55-A061-816166A269AB}"= TCP:c:\program files\VMware\VMware Server\vmware-authd.exe:VMware Authd "{58FC3574-0DF6-45A3-9CEE-E2C9601D9AF6}"= UDP:c:\program files\VMware\VMware Server\vmware-hostd.exe:VMware Hostd "{CB0C8BA9-6D21-4CB0-BAE5-0406785A5696}"= TCP:c:\program files\VMware\VMware Server\vmware-hostd.exe:VMware Hostd "{3F3C0197-4205-44FF-9FA5-D815F37F415B}"= UDP:c:\program files\Pinnacle\Studio 12\Programs\RM.exe:Render Manager "{B5FF1400-F268-4AA5-9EAB-B92F19D5446C}"= TCP:c:\program files\Pinnacle\Studio 12\Programs\RM.exe:Render Manager "{1D9AE81A-1DEF-4CC2-A613-96284766ED24}"= UDP:c:\program files\Pinnacle\Studio 12\Programs\Studio.exe:Studio "{35389883-8465-4C60-B96F-BBC89D11419F}"= TCP:c:\program files\Pinnacle\Studio 12\Programs\Studio.exe:Studio "{C908743B-3BFE-4A30-A8BD-B90A40F45491}"= UDP:c:\program files\Pinnacle\Studio 12\Programs\umi.exe:umi "{C20A00C2-660E-48C6-A58A-F17EEBFD05C2}"= TCP:c:\program files\Pinnacle\Studio 12\Programs\umi.exe:umi "TCP Query User{CF07B334-548C-4AE1-9D0F-D6B9C245D3E9}c:\\program files\\microsoft games\\age of empires ii\\age2_x1\\age2_x1.exe"= UDP:c:\program files\microsoft games\age of empires ii\age2_x1\age2_x1.exe:Age of Empires II Expansion "UDP Query User{9404E6F0-2E93-459C-AE5E-CF7BFF47A15D}c:\\program files\\microsoft games\\age of empires ii\\age2_x1\\age2_x1.exe"= TCP:c:\program files\microsoft games\age of empires ii\age2_x1\age2_x1.exe:Age of Empires II Expansion "TCP Query User{AB7925EE-3024-451C-A252-4AB5A3895C56}c:\\users\\lani\\downloads\\empire earth-extract and play-flippco media\\empire earth--extract&play..flippcomedia\\empire earth--extract&play..flippcomedia\\empire earth.exe"= UDP:c:\users\lani\downloads\empire earth-extract and play-flippco media\empire earth--extract&play..flippcomedia\empire earth--extract&play..flippcomedia\empire earth.exe:empire earth.exe "UDP Query User{8758885D-B5DE-459F-9F2F-F6B2E46102BF}c:\\users\\lani\\downloads\\empire earth-extract and play-flippco media\\empire earth--extract&play..flippcomedia\\empire earth--extract&play..flippcomedia\\empire earth.exe"= TCP:c:\users\lani\downloads\empire earth-extract and play-flippco media\empire earth--extract&play..flippcomedia\empire earth--extract&play..flippcomedia\empire earth.exe:empire earth.exe "TCP Query User{837FE332-84B0-422E-9366-14EDD1FFDE5F}c:\\program files\\microsoft games\\age of empires ii\\empires2.exe"= UDP:c:\program files\microsoft games\age of empires ii\empires2.exe:Age of Empires II "UDP Query User{AABF3E68-093C-47C6-A521-8CAD1A7A361C}c:\\program files\\microsoft games\\age of empires ii\\empires2.exe"= TCP:c:\program files\microsoft games\age of empires ii\empires2.exe:Age of Empires II "TCP Query User{D585F96F-BAED-44A2-A0D1-FD13853F4222}c:\\windows\\system32\\dplaysvr.exe"= UDP:c:\windows\system32\dplaysvr.exe:Microsoft DirectPlay-Helfer "UDP Query User{D76BDC4B-8522-4AED-BA8A-04D715C473A2}c:\\windows\\system32\\dplaysvr.exe"= TCP:c:\windows\system32\dplaysvr.exe:Microsoft DirectPlay-Helfer "TCP Query User{F7C0F7DE-1524-42A3-93EB-1A5121622763}c:\\program files\\microsoft games\\age of empires ii\\empires2.exe"= UDP:c:\program files\microsoft games\age of empires ii\empires2.exe:Age of Empires II "UDP Query User{3C34E8CE-2353-429C-9B34-D28D0BDCCC84}c:\\program files\\microsoft games\\age of empires ii\\empires2.exe"= TCP:c:\program files\microsoft games\age of empires ii\empires2.exe:Age of Empires II "TCP Query User{91B56E71-D9BE-49E0-92CA-C62A76B275D9}c:\\program files\\microsoft games\\age of mythology\\aom.exe"= UDP:c:\program files\microsoft games\age of mythology\aom.exe:Age of Mythology "UDP Query User{B2D81F79-7A1D-4E1D-B112-BE228DCA102E}c:\\program files\\microsoft games\\age of mythology\\aom.exe"= TCP:c:\program files\microsoft games\age of mythology\aom.exe:Age of Mythology "{FACBC6DB-E056-4DF2-8C74-261B7BB7CFB3}"= UDP:46304:utorrent "{D01DD49A-5EDC-465E-BF93-18FC9A729BFD}"= TCP:46304:utorrent [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List] "c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x86\\eDSfsu.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSfsu.exe:*:Enabled:eDSfsu "c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x86\\encryption.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x86\encryption.exe:*:Enabled:encryption "c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x86\\decryption.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x86\decryption.exe:*:Enabled:decryption "c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x86\\eDSMgr.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSMgr.exe:*:Enabled:eDSMgr "c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x86\\eDStbmngr.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDStbmngr.exe:*:Enabled:eDStbmngr "c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x64\\eDSfsu.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x64\eDSfsu.exe:*:Enabled:eDSfsu "c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x64\\encryption.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x64\encryption.exe:*:Enabled:encryption "c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x64\\decryption.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x64\decryption.exe:*:Enabled:decryption "c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x64\\eDSMgr.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x64\eDSMgr.exe:*:Enabled:eDSMgr "c:\\Program Files\\Acer\\Empowering Technology\\eDataSecurity\\x64\\eDStbmngr.exe"= c:\program files\Acer\Empowering Technology\eDataSecurity\x64\eDStbmngr.exe:*:Enabled:eDStbmngr R0 AlfaFF;AlfaFF File System mini-filter;c:\windows\System32\drivers\AlfaFF.sys [17.10.2008 16:13 43184] R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl [17.10.2008 16:24 61424] R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [26.04.2009 01:11 108289] R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [03.03.2008 13:11 16384] R2 CLHNService;CLHNService;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [17.10.2008 16:27 81504] R2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [18.04.2008 10:52 24576] R2 IGBASVC;iGroupTec Service;c:\program files\Acer\Acer Bio Protection\BASVC.exe [17.10.2008 16:13 3471360] R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [06.04.2008 22:42 50424] R2 NTIPPKernel;NTIPPKernel;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys [17.10.2008 16:27 122368] R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [04.04.2008 03:03 131072] R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\b57nd60x.sys [28.03.2008 04:44 210432] R3 JMCR;JMCR;c:\windows\System32\drivers\jmcr.sys [18.04.2008 20:25 81296] R3 NETw5v32;Intel(R) Wireless WiFi Link Adaptertreiber für Windows Vista 32-Bit;c:\windows\System32\drivers\NETw5v32.sys [18.04.2008 20:25 3658752] R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\System32\drivers\nvhda32v.sys [05.09.2008 11:31 44064] R3 winbondcir;Winbond IR Transceiver;c:\windows\System32\drivers\winbondcir.sys [28.03.2007 07:51 43008] S2 gupdate1c9a67fd9624cba;Google Update Service (gupdate1c9a67fd9624cba);c:\program files\Google\Update\GoogleUpdate.exe [16.03.2009 23:40 133104] S3 A310;AVerMedia A310 DVB-T;c:\windows\System32\drivers\AVerA310USB.sys [18.04.2008 10:50 25856] S3 BDASwCap;AVerMedia A310 BDA DVBT Capture Device;c:\windows\System32\drivers\AVerA310Cap.sys [18.04.2008 10:50 42880] S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [07.09.2009 19:33 1527900] S3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Lite 2009\RpcAgentSrv.exe [24.02.2009 22:05 98488] S3 WSDPrintDevice;WSD-Druckunterstützung durch UMB;c:\windows\System32\drivers\WSDPrint.sys [21.01.2008 04:23 16896] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP . Inhalt des "geplante Tasks" Ordners 2009-09-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-03-16 21:40] 2009-09-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-03-16 21:40] . - - - - Entfernte verwaiste Registrierungseinträge - - - - HKLM-Run-eRecoveryService - (no file) |
|
| Themen zu Problem mit Trojaner...Tdss.Z.301 |
| antivirus, avira, avira antivir, gestern, hijack, hijackthis, hoffe, home, home premium, melde, meldet, pferd, premium, problem, programm, system32, troja, trojanische, trojanische pferd, vista, vista home premium, windows |
Hybrid-Darstellung
