Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
IE öffnet automatisch werbung + langsamer pc

IE öffnet automatisch werbung + langsamer pc


Log-Analyse und Auswertung: IE öffnet automatisch werbung + langsamer pc

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML

Antwort
Seite 2 von 3 1 2 3
Alt 04.11.2009, 21:01   #16
Lucky_Ace
 
IE öffnet automatisch werbung + langsamer pc - Standard

IE öffnet automatisch werbung + langsamer pc


Nabend Chris,

der folgenden Pfad c:/Dokumente und Einstellungen/Michael/Lokale Einstellungen/Temp <-Ggf. Pfad richtig anpassen! gibt es nicht... es gab mal einen Benutzer namens Michael aber den gibt es nciht mehr und wenn ich auf c:/Dokumente und Einstellungen/ gehe kommt nur
- 3 Benutzer namen (2ehemalige)
- All user
- 2 Administrator ordner
- default user
- network service
-local service
-gast
-temp(2)

ich weiß auch nciht welche datei du meinst die ich mit avenger löschen soll...

Gruß Lucky_Ace

Alt 05.11.2009, 07:25   #17
Chris4You
 
IE öffnet automatisch werbung + langsamer pc - Standard

IE öffnet automatisch werbung + langsamer pc


Hi,

ist nicht so schlimm, der Treiber ist gestoppt...

So, probiere jetzt noch mal, ob GMER läuft, ich brauche unbedingt das Log von ihm...

Alternativ:
Avira-Antirootkit
Downloade Avira Antirootkit und Scanne dein system, poste das logfile.
http://dl.antivir.de/down/windows/antivir_rootkit.zip

chris
__________________

__________________
Alt 05.11.2009, 19:23   #18
Lucky_Ace
 
IE öffnet automatisch werbung + langsamer pc - Standard

IE öffnet automatisch werbung + langsamer pc


Nabend Chris,

wie meinst du das mit dem der treiber ist gestoppt?

leider ging das antivirrootkit nicht habe es wieder mit GMER verscuht un die partitionen einzeln scannen lassen und siehe da wenige minuten gings... hoff ich mal^^

die logs sind in der reihenfolge c:/ d:/ e:/

GMER 1.0.15.15163 - http://www.gmer.net
Rootkit scan 2009-11-05 18:38:44
Windows 5.1.2600 Service Pack 2
Running: 8komv53u.exe; Driver: C:\WINDOWS\TEMP\fxqcifow.sys


---- System - GMER 1.0.15 ----

SSDT \??\C:\WINDOWS\system32\drivers\SLEE401.sys ZwClose [0xF3A1EE60]
SSDT \??\C:\WINDOWS\system32\drivers\SLEE401.sys ZwCreateFile [0xF3A1EEF5]
SSDT spqg.sys ZwCreateKey [0xF84640E0]
SSDT F8C5AD1C ZwCreateThread
SSDT spqg.sys ZwEnumerateKey [0xF8482CA4]
SSDT spqg.sys ZwEnumerateValueKey [0xF8483032]
SSDT \??\C:\WINDOWS\system32\drivers\SLEE401.sys ZwOpenFile [0xF3A1F105]
SSDT spqg.sys ZwOpenKey [0xF84640C0]
SSDT F8C5AD08 ZwOpenProcess
SSDT F8C5AD0D ZwOpenThread
SSDT spqg.sys ZwQueryKey [0xF848310A]
SSDT spqg.sys ZwQueryValueKey [0xF8482F8A]
SSDT \??\C:\WINDOWS\system32\drivers\SLEE401.sys ZwSetInformationFile [0xF3A1EE90]
SSDT spqg.sys ZwSetValueKey [0xF848319C]
SSDT F8C5AD17 ZwTerminateProcess
SSDT F8C5AD12 ZwWriteVirtualMemory

INT 0x62 ? 82570BF8
INT 0x82 ? 82570BF8
INT 0xB4 ? 821E7F00
INT 0xB4 ? 821E7F00
INT 0xB4 ? 821E7F00
INT 0xB4 ? 821E7F00
INT 0xB4 ? 821E7F00
INT 0xB4 ? 821E7F00

---- Kernel code sections - GMER 1.0.15 ----

? spqg.sys Das System kann die angegebene Datei nicht finden. !
.text USBPORT.SYS!DllUnload F714862C 5 Bytes JMP 821E74E0
.text aafn7or4.SYS F700D386 35 Bytes [00, 00, 00, 00, 00, 00, 20, ...]
.text aafn7or4.SYS F700D3AA 24 Bytes [00, 00, 00, 00, 00, 00, 00, ...]
.text aafn7or4.SYS F700D3C4 3 Bytes [00, 70, 02] {ADD [EAX+0x2], DH}
.text aafn7or4.SYS F700D3C9 1 Byte [30]
.text aafn7or4.SYS F700D3C9 11 Bytes [30, 00, 00, 00, 5C, 02, 00, ...] {XOR [EAX], AL; ADD [EAX], AL; POP ESP; ADD AL, [EAX]; ADD [EAX], AL; ADD [EAX], AL}
.text ...

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F8465042] spqg.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F846513E] spqg.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F84650C0] spqg.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F8465800] spqg.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F84656D6] spqg.sys
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!KfAcquireSpinLock] 0C8D1C46
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!READ_PORT_UCHAR] B08B8932
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!KeGetCurrentIrql] 89000001
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!KfRaiseIrql] 0001BC83
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!KfLowerIrql] 24468B00
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!HalGetInterruptVector] 89820C8D
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!HalTranslateBusAddress] D18BF84D
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!KeStallExecutionProcessor] 860F1639
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!KfReleaseSpinLock] 000000BD
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!READ_PORT_BUFFER_USHORT] 0208B389
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!READ_PORT_USHORT] 83660000
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT] 7400067E
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!WRITE_PORT_UCHAR] 89D60320
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[WMILIB.SYS!WmiSystemControl] 8D168B00
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[WMILIB.SYS!WmiCompleteRequest] F0003284
IAT \SystemRoot\System32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F8474E9C] spqg.sys

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 8256F1F8

AttachedDevice \FileSystem\Ntfs \Ntfs avgntmgr.sys (Avira AntiVir File Filter Driver Manager/Avira GmbH)

Device \FileSystem\Fastfat \FatCdrom 81C871F8
Device \Driver\NetBT \Device\NetBT_Tcpip_{1240E108-AD10-4E53-BFA0-8EF8616A2D67} 81D581F8
Device \Driver\usbuhci \Device\USBPDO-0 821E51F8
Device \Driver\usbuhci \Device\USBPDO-1 821E51F8
Device \Driver\usbuhci \Device\USBPDO-2 821E51F8
Device \Driver\usbuhci \Device\USBPDO-3 821E51F8
Device \Driver\usbehci \Device\USBPDO-4 821B81F8
Device \Driver\PCI_PNP0518 \Device\00000055 spqg.sys
Device \Driver\prodrv06 \Device\ProDrv06 E1D04008
Device \Driver\Ftdisk \Device\HarddiskVolume1 825DD1F8
Device \Driver\Cdrom \Device\CdRom0 822001F8
Device \Driver\Ftdisk \Device\HarddiskVolume2 825DD1F8
Device \Driver\Cdrom \Device\CdRom1 822001F8
Device \Driver\Ftdisk \Device\HarddiskVolume3 825DD1F8
Device \Driver\atapi \Device\Ide\IdePort0 825701F8
Device \Driver\atapi \Device\Ide\IdePort0 AnyDVD.sys (AnyDVD Filter Driver/SlySoft, Inc.)
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 825701F8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 AnyDVD.sys (AnyDVD Filter Driver/SlySoft, Inc.)
Device \Driver\atapi \Device\Ide\IdePort1 825701F8
Device \Driver\atapi \Device\Ide\IdePort1 AnyDVD.sys (AnyDVD Filter Driver/SlySoft, Inc.)
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c 825701F8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c AnyDVD.sys (AnyDVD Filter Driver/SlySoft, Inc.)
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-17 825701F8
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-17 AnyDVD.sys (AnyDVD Filter Driver/SlySoft, Inc.)
Device \Driver\Cdrom \Device\CdRom2 822001F8
Device \Driver\usbstor \Device\00000081 81C681F8
Device \Driver\usbstor \Device\00000081 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\usbstor \Device\00000082 81C681F8
Device \Driver\usbstor \Device\00000082 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\prohlp02 \Device\ProHlp02 E10239A0
Device \Driver\usbstor \Device\00000083 81C681F8
Device \Driver\usbstor \Device\00000083 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\NetBT \Device\NetBt_Wins_Export 81D581F8
Device \Driver\sptd \Device\3241379268 spqg.sys
Device \Driver\usbstor \Device\00000084 81C681F8
Device \Driver\usbstor \Device\00000084 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\NetBT \Device\NetbiosSmb 81D581F8
Device \Driver\usbstor \Device\00000085 81C681F8
Device \Driver\usbstor \Device\00000085 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\usbuhci \Device\USBFDO-0 821E51F8
Device \Driver\usbuhci \Device\USBFDO-1 821E51F8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 81C851F8
Device \Driver\usbuhci \Device\USBFDO-2 821E51F8
Device \FileSystem\MRxSmb \Device\LanmanRedirector 81C851F8
Device \Driver\usbuhci \Device\USBFDO-3 821E51F8
Device \Driver\usbehci \Device\USBFDO-4 821B81F8
Device \Driver\Ftdisk \Device\FtControl 825DD1F8
Device \Driver\aafn7or4 \Device\Scsi\aafn7or41Port2Path0Target0Lun0 823A3500
Device \Driver\aafn7or4 \Device\Scsi\aafn7or41Port2Path0Target0Lun0 AnyDVD.sys (AnyDVD Filter Driver/SlySoft, Inc.)
Device \Driver\aafn7or4 \Device\Scsi\aafn7or41 823A3500
Device \Driver\aafn7or4 \Device\Scsi\aafn7or41 AnyDVD.sys (AnyDVD Filter Driver/SlySoft, Inc.)
Device \FileSystem\Fastfat \Fat 81C871F8

AttachedDevice \FileSystem\Fastfat \Fat avgntmgr.sys (Avira AntiVir File Filter Driver Manager/Avira GmbH)

Device \FileSystem\Cdfs \Cdfs 81C261F8

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 2
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 D:\Programme\Daemon Update\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x95 0x84 0x26 0x7A ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xBE 0x6B 0xBB 0x08 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x97 0xF8 0x91 0x7E ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 D:\Programme\Neuer Ordner\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 D:\Programme\Daemon Update\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x95 0x84 0x26 0x7A ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xBE 0x6B 0xBB 0x08 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x97 0xF8 0x91 0x7E ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 D:\Programme\Neuer Ordner\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OOSAFEERASE04.00.00.01MSWINDOWS 44C6913E471845F3458589CD82C2F685EEE6CD21842DB365F81FC490A43549FAB124D405D866C47B53BBC8C5CF2EE89B69524B8E2158A0163B21688401649580D5AB286D90A1CFE91B02B1 3C33215C5963DE83EFFB78928B338D38C0294E6207FA21E1172ABC2D046C80695FC005BB9F58BA0C21240937E02435DAECC122B88A4F9B5999833E6B427EB21AD3AED2360526E700EF471A 7B6A37BFFCA513A5EABAE1096A009E405CD06DEA71ADD71BBDD1133CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC7 4CA6A0AC4980AC7933C038D530D6EB3452A6A0AC4980AC7933A9C6AECB7A5D140799AFA4FA00A9C0CAE05D5F95129189682803D4E7D3262947EF3036BA548C32928394A69534C775D1E9CB D2EE91ECDF42D37A1E2D8B24EE8127BBD8FACC00348413D910602BA1E55EB861653BD52C805C5EF57679940AFCEA3706DDAC168292523EC13AECCE1B03B8946B4701675007047EF00A6737 15B8F6E8D88B255BAD19B37B83A261CC4C25FEC52ED05B148EF25A71DA28A905B768EA0671C8C78D517B3549C6EBF8168386A01B617D7B6F50A8D5F197C5824F1AB9635F01A30D5FF0CDB6 A72C5C825F3EC4E365ADEBA24FB4ED414580F94BAD94BD4EC72C4E03CA450A6A9AC35C5DA2B4E25F7A345EA8CC0C70B832E08070FBB6E66E180B9ACB8BB

---- EOF - GMER 1.0.15 ----
__________________
Alt 05.11.2009, 19:24   #19
Lucky_Ace
 
IE öffnet automatisch werbung + langsamer pc - Standard

IE öffnet automatisch werbung + langsamer pc


GMER 1.0.15.15163 - http://www.gmer.net
Rootkit scan 2009-11-05 19:11:52
Windows 5.1.2600 Service Pack 2
Running: 8komv53u.exe; Driver: C:\WINDOWS\TEMP\fxqcifow.sys


---- System - GMER 1.0.15 ----

SSDT \??\C:\WINDOWS\system32\drivers\SLEE401.sys ZwClose [0xF3A1EE60]
SSDT \??\C:\WINDOWS\system32\drivers\SLEE401.sys ZwCreateFile [0xF3A1EEF5]
SSDT spqg.sys ZwCreateKey [0xF84640E0]
SSDT F8C5AD1C ZwCreateThread
SSDT spqg.sys ZwEnumerateKey [0xF8482CA4]
SSDT spqg.sys ZwEnumerateValueKey [0xF8483032]
SSDT \??\C:\WINDOWS\system32\drivers\SLEE401.sys ZwOpenFile [0xF3A1F105]
SSDT spqg.sys ZwOpenKey [0xF84640C0]
SSDT F8C5AD08 ZwOpenProcess
SSDT F8C5AD0D ZwOpenThread
SSDT spqg.sys ZwQueryKey [0xF848310A]
SSDT spqg.sys ZwQueryValueKey [0xF8482F8A]
SSDT \??\C:\WINDOWS\system32\drivers\SLEE401.sys ZwSetInformationFile [0xF3A1EE90]
SSDT spqg.sys ZwSetValueKey [0xF848319C]
SSDT F8C5AD17 ZwTerminateProcess
SSDT F8C5AD12 ZwWriteVirtualMemory

INT 0x62 ? 82570BF8
INT 0x82 ? 82570BF8
INT 0xB4 ? 821E7F00
INT 0xB4 ? 821E7F00
INT 0xB4 ? 821E7F00
INT 0xB4 ? 821E7F00
INT 0xB4 ? 821E7F00
INT 0xB4 ? 821E7F00

---- Kernel code sections - GMER 1.0.15 ----

? spqg.sys Das System kann die angegebene Datei nicht finden. !
.text USBPORT.SYS!DllUnload F714862C 5 Bytes JMP 821E74E0
.text aafn7or4.SYS F700D386 35 Bytes [00, 00, 00, 00, 00, 00, 20, ...]
.text aafn7or4.SYS F700D3AA 24 Bytes [00, 00, 00, 00, 00, 00, 00, ...]
.text aafn7or4.SYS F700D3C4 3 Bytes [00, 70, 02] {ADD [EAX+0x2], DH}
.text aafn7or4.SYS F700D3C9 1 Byte [30]
.text aafn7or4.SYS F700D3C9 11 Bytes [30, 00, 00, 00, 5C, 02, 00, ...] {XOR [EAX], AL; ADD [EAX], AL; POP ESP; ADD AL, [EAX]; ADD [EAX], AL; ADD [EAX], AL}
.text ...

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F8465042] spqg.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F846513E] spqg.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F84650C0] spqg.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F8465800] spqg.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F84656D6] spqg.sys
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!KfAcquireSpinLock] 0C8D1C46
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!READ_PORT_UCHAR] B08B8932
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!KeGetCurrentIrql] 89000001
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!KfRaiseIrql] 0001BC83
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!KfLowerIrql] 24468B00
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!HalGetInterruptVector] 89820C8D
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!HalTranslateBusAddress] D18BF84D
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!KeStallExecutionProcessor] 860F1639
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!KfReleaseSpinLock] 000000BD
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!READ_PORT_BUFFER_USHORT] 0208B389
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!READ_PORT_USHORT] 83660000
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT] 7400067E
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!WRITE_PORT_UCHAR] 89D60320
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[WMILIB.SYS!WmiSystemControl] 8D168B00
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[WMILIB.SYS!WmiCompleteRequest] F0003284
IAT \SystemRoot\System32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F8474E9C] spqg.sys

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 8256F1F8

AttachedDevice \FileSystem\Ntfs \Ntfs avgntmgr.sys (Avira AntiVir File Filter Driver Manager/Avira GmbH)

Device \FileSystem\Fastfat \FatCdrom 81C871F8
Device \Driver\NetBT \Device\NetBT_Tcpip_{1240E108-AD10-4E53-BFA0-8EF8616A2D67} 81D581F8
Device \Driver\usbuhci \Device\USBPDO-0 821E51F8
Device \Driver\usbuhci \Device\USBPDO-1 821E51F8
Device \Driver\usbuhci \Device\USBPDO-2 821E51F8
Device \Driver\usbuhci \Device\USBPDO-3 821E51F8
Device \Driver\PCI_PNP0518 \Device\00000055 spqg.sys
Device \Driver\usbehci \Device\USBPDO-4 821B81F8
Device \Driver\prodrv06 \Device\ProDrv06 E1D04008
Device \Driver\Ftdisk \Device\HarddiskVolume1 825DD1F8
Device \Driver\Cdrom \Device\CdRom0 822001F8
Device \Driver\Ftdisk \Device\HarddiskVolume2 825DD1F8
Device \Driver\Cdrom \Device\CdRom1 822001F8
Device \Driver\Ftdisk \Device\HarddiskVolume3 825DD1F8
Device \Driver\atapi \Device\Ide\IdePort0 825701F8
Device \Driver\atapi \Device\Ide\IdePort0 AnyDVD.sys (AnyDVD Filter Driver/SlySoft, Inc.)
Device \Driver\atapi \Device\Ide\IdePort1 825701F8
Device \Driver\atapi \Device\Ide\IdePort1 AnyDVD.sys (AnyDVD Filter Driver/SlySoft, Inc.)
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 825701F8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 AnyDVD.sys (AnyDVD Filter Driver/SlySoft, Inc.)
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c 825701F8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c AnyDVD.sys (AnyDVD Filter Driver/SlySoft, Inc.)
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-17 825701F8
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-17 AnyDVD.sys (AnyDVD Filter Driver/SlySoft, Inc.)
Device \Driver\Cdrom \Device\CdRom2 822001F8
Device \Driver\usbstor \Device\00000081 81C681F8
Device \Driver\usbstor \Device\00000081 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\prohlp02 \Device\ProHlp02 E10239A0
Device \Driver\usbstor \Device\00000082 81C681F8
Device \Driver\usbstor \Device\00000082 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\NetBT \Device\NetBt_Wins_Export 81D581F8
Device \Driver\usbstor \Device\00000083 81C681F8
Device \Driver\usbstor \Device\00000083 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\usbstor \Device\00000084 81C681F8
Device \Driver\usbstor \Device\00000084 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\sptd \Device\3241379268 spqg.sys
Device \Driver\usbstor \Device\00000085 81C681F8
Device \Driver\usbstor \Device\00000085 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\NetBT \Device\NetbiosSmb 81D581F8
Device \Driver\usbuhci \Device\USBFDO-0 821E51F8
Device \Driver\usbuhci \Device\USBFDO-1 821E51F8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 81C851F8
Device \Driver\usbuhci \Device\USBFDO-2 821E51F8
Device \Driver\usbuhci \Device\USBFDO-3 821E51F8
Device \FileSystem\MRxSmb \Device\LanmanRedirector 81C851F8
Device \Driver\Ftdisk \Device\FtControl 825DD1F8
Device \Driver\usbehci \Device\USBFDO-4 821B81F8
Device \Driver\aafn7or4 \Device\Scsi\aafn7or41Port2Path0Target0Lun0 823A3500
Device \Driver\aafn7or4 \Device\Scsi\aafn7or41Port2Path0Target0Lun0 AnyDVD.sys (AnyDVD Filter Driver/SlySoft, Inc.)
Device \Driver\aafn7or4 \Device\Scsi\aafn7or41 823A3500
Device \Driver\aafn7or4 \Device\Scsi\aafn7or41 AnyDVD.sys (AnyDVD Filter Driver/SlySoft, Inc.)
Device \FileSystem\Fastfat \Fat 81C871F8

AttachedDevice \FileSystem\Fastfat \Fat avgntmgr.sys (Avira AntiVir File Filter Driver Manager/Avira GmbH)

Device \FileSystem\Cdfs \Cdfs 81C261F8

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 2
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 D:\Programme\Daemon Update\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x95 0x84 0x26 0x7A ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xBE 0x6B 0xBB 0x08 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x97 0xF8 0x91 0x7E ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 D:\Programme\Neuer Ordner\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 D:\Programme\Daemon Update\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x95 0x84 0x26 0x7A ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xBE 0x6B 0xBB 0x08 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x97 0xF8 0x91 0x7E ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 D:\Programme\Neuer Ordner\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OOSAFEERASE04.00.00.01MSWINDOWS 44C6913E471845F3458589CD82C2F685EEE6CD21842DB365F81FC490A43549FAB124D405D866C47B53BBC8C5CF2EE89B69524B8E2158A0163B21688401649580D5AB286D90A1CFE91B02B1 3C33215C5963DE83EFFB78928B338D38C0294E6207FA21E1172ABC2D046C80695FC005BB9F58BA0C21240937E02435DAECC122B88A4F9B5999833E6B427EB21AD3AED2360526E700EF471A 7B6A37BFFCA513A5EABAE1096A009E405CD06DEA71ADD71BBDD1133CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC7 4CA6A0AC4980AC7933C038D530D6EB3452A6A0AC4980AC7933A9C6AECB7A5D140799AFA4FA00A9C0CAE05D5F95129189682803D4E7D3262947EF3036BA548C32928394A69534C775D1E9CB D2EE91ECDF42D37A1E2D8B24EE8127BBD8FACC00348413D910602BA1E55EB861653BD52C805C5EF57679940AFCEA3706DDAC168292523EC13AECCE1B03B8946B4701675007047EF00A6737 15B8F6E8D88B255BAD19B37B83A261CC4C25FEC52ED05B148EF25A71DA28A905B768EA0671C8C78D517B3549C6EBF8168386A01B617D7B6F50A8D5F197C5824F1AB9635F01A30D5FF0CDB6 A72C5C825F3EC4E365ADEBA24FB4ED414580F94BAD94BD4EC72C4E03CA450A6A9AC35C5DA2B4E25F7A345EA8CC0C70B832E08070FBB6E66E180B9ACB8BB

---- EOF - GMER 1.0.15 ----

Alt 05.11.2009, 19:25   #20
Lucky_Ace
 
IE öffnet automatisch werbung + langsamer pc - Standard

IE öffnet automatisch werbung + langsamer pc


entschuldigung ich hatte es müssen in drei teile teilen... hätte es auch können bei file upload hochladen aber ich wusste nicht ob das ok gewesen wäre...

GMER 1.0.15.15163 - http://www.gmer.net
Rootkit scan 2009-11-05 19:14:54
Windows 5.1.2600 Service Pack 2
Running: 8komv53u.exe; Driver: C:\WINDOWS\TEMP\fxqcifow.sys


---- System - GMER 1.0.15 ----

SSDT \??\C:\WINDOWS\system32\drivers\SLEE401.sys ZwClose [0xF3A1EE60]
SSDT \??\C:\WINDOWS\system32\drivers\SLEE401.sys ZwCreateFile [0xF3A1EEF5]
SSDT spqg.sys ZwCreateKey [0xF84640E0]
SSDT F8C5AD1C ZwCreateThread
SSDT spqg.sys ZwEnumerateKey [0xF8482CA4]
SSDT spqg.sys ZwEnumerateValueKey [0xF8483032]
SSDT \??\C:\WINDOWS\system32\drivers\SLEE401.sys ZwOpenFile [0xF3A1F105]
SSDT spqg.sys ZwOpenKey [0xF84640C0]
SSDT F8C5AD08 ZwOpenProcess
SSDT F8C5AD0D ZwOpenThread
SSDT spqg.sys ZwQueryKey [0xF848310A]
SSDT spqg.sys ZwQueryValueKey [0xF8482F8A]
SSDT \??\C:\WINDOWS\system32\drivers\SLEE401.sys ZwSetInformationFile [0xF3A1EE90]
SSDT spqg.sys ZwSetValueKey [0xF848319C]
SSDT F8C5AD17 ZwTerminateProcess
SSDT F8C5AD12 ZwWriteVirtualMemory

INT 0x62 ? 82570BF8
INT 0x82 ? 82570BF8
INT 0xB4 ? 821E7F00
INT 0xB4 ? 821E7F00
INT 0xB4 ? 821E7F00
INT 0xB4 ? 821E7F00
INT 0xB4 ? 821E7F00
INT 0xB4 ? 821E7F00

---- Kernel code sections - GMER 1.0.15 ----

? spqg.sys Das System kann die angegebene Datei nicht finden. !
.text aafn7or4.SYS F700D386 35 Bytes [00, 00, 00, 00, 00, 00, 20, ...]
.text aafn7or4.SYS F700D3AA 24 Bytes [00, 00, 00, 00, 00, 00, 00, ...]
.text aafn7or4.SYS F700D3C4 3 Bytes [00, 70, 02] {ADD [EAX+0x2], DH}
.text aafn7or4.SYS F700D3C9 1 Byte [30]
.text aafn7or4.SYS F700D3C9 11 Bytes [30, 00, 00, 00, 5C, 02, 00, ...] {XOR [EAX], AL; ADD [EAX], AL; POP ESP; ADD AL, [EAX]; ADD [EAX], AL; ADD [EAX], AL}
.text ...

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F8465042] spqg.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F846513E] spqg.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F84650C0] spqg.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F8465800] spqg.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F84656D6] spqg.sys
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!KfAcquireSpinLock] 0C8D1C46
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!READ_PORT_UCHAR] B08B8932
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!KeGetCurrentIrql] 89000001
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!KfRaiseIrql] 0001BC83
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!KfLowerIrql] 24468B00
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!HalGetInterruptVector] 89820C8D
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!HalTranslateBusAddress] D18BF84D
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!KeStallExecutionProcessor] 860F1639
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!KfReleaseSpinLock] 000000BD
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!READ_PORT_BUFFER_USHORT] 0208B389
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!READ_PORT_USHORT] 83660000
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT] 7400067E
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[HAL.dll!WRITE_PORT_UCHAR] 89D60320
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[WMILIB.SYS!WmiSystemControl] 8D168B00
IAT \SystemRoot\System32\Drivers\aafn7or4.SYS[WMILIB.SYS!WmiCompleteRequest] F0003284
IAT \SystemRoot\System32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F8474E9C] spqg.sys

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 8256F1F8

AttachedDevice \FileSystem\Ntfs \Ntfs avgntmgr.sys (Avira AntiVir File Filter Driver Manager/Avira GmbH)

Device \FileSystem\Fastfat \FatCdrom 81C871F8
Device \Driver\NetBT \Device\NetBT_Tcpip_{1240E108-AD10-4E53-BFA0-8EF8616A2D67} 81D581F8
Device \Driver\usbuhci \Device\USBPDO-0 821E51F8
Device \Driver\usbuhci \Device\USBPDO-1 821E51F8
Device \Driver\usbuhci \Device\USBPDO-2 821E51F8
Device \Driver\usbuhci \Device\USBPDO-3 821E51F8
Device \Driver\usbehci \Device\USBPDO-4 821B81F8
Device \Driver\PCI_PNP0518 \Device\00000055 spqg.sys
Device \Driver\prodrv06 \Device\ProDrv06 E1D04008
Device \Driver\Ftdisk \Device\HarddiskVolume1 825DD1F8
Device \Driver\Cdrom \Device\CdRom0 822001F8
Device \Driver\Ftdisk \Device\HarddiskVolume2 825DD1F8
Device \Driver\Cdrom \Device\CdRom1 822001F8
Device \Driver\Ftdisk \Device\HarddiskVolume3 825DD1F8
Device \Driver\atapi \Device\Ide\IdePort0 825701F8
Device \Driver\atapi \Device\Ide\IdePort0 AnyDVD.sys (AnyDVD Filter Driver/SlySoft, Inc.)
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 825701F8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 AnyDVD.sys (AnyDVD Filter Driver/SlySoft, Inc.)
Device \Driver\atapi \Device\Ide\IdePort1 825701F8
Device \Driver\atapi \Device\Ide\IdePort1 AnyDVD.sys (AnyDVD Filter Driver/SlySoft, Inc.)
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c 825701F8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c AnyDVD.sys (AnyDVD Filter Driver/SlySoft, Inc.)
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-17 825701F8
Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-17 AnyDVD.sys (AnyDVD Filter Driver/SlySoft, Inc.)
Device \Driver\Cdrom \Device\CdRom2 822001F8
Device \Driver\usbstor \Device\00000081 81C681F8
Device \Driver\usbstor \Device\00000081 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\usbstor \Device\00000082 81C681F8
Device \Driver\usbstor \Device\00000082 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\prohlp02 \Device\ProHlp02 E10239A0
Device \Driver\usbstor \Device\00000083 81C681F8
Device \Driver\usbstor \Device\00000083 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\NetBT \Device\NetBt_Wins_Export 81D581F8
Device \Driver\sptd \Device\3241379268 spqg.sys
Device \Driver\usbstor \Device\00000084 81C681F8
Device \Driver\usbstor \Device\00000084 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\NetBT \Device\NetbiosSmb 81D581F8
Device \Driver\usbstor \Device\00000085 81C681F8
Device \Driver\usbstor \Device\00000085 sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device \Driver\usbuhci \Device\USBFDO-0 821E51F8
Device \Driver\usbuhci \Device\USBFDO-1 821E51F8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 81C851F8
Device \Driver\usbuhci \Device\USBFDO-2 821E51F8
Device \FileSystem\MRxSmb \Device\LanmanRedirector 81C851F8
Device \Driver\usbuhci \Device\USBFDO-3 821E51F8
Device \Driver\usbehci \Device\USBFDO-4 821B81F8
Device \Driver\Ftdisk \Device\FtControl 825DD1F8
Device \Driver\aafn7or4 \Device\Scsi\aafn7or41Port2Path0Target0Lun0 823A3500
Device \Driver\aafn7or4 \Device\Scsi\aafn7or41Port2Path0Target0Lun0 AnyDVD.sys (AnyDVD Filter Driver/SlySoft, Inc.)
Device \Driver\aafn7or4 \Device\Scsi\aafn7or41 823A3500
Device \Driver\aafn7or4 \Device\Scsi\aafn7or41 AnyDVD.sys (AnyDVD Filter Driver/SlySoft, Inc.)
Device \FileSystem\Fastfat \Fat 81C871F8

AttachedDevice \FileSystem\Fastfat \Fat avgntmgr.sys (Avira AntiVir File Filter Driver Manager/Avira GmbH)

Device \FileSystem\Cdfs \Cdfs 81C261F8

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 2
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 D:\Programme\Daemon Update\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x95 0x84 0x26 0x7A ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xBE 0x6B 0xBB 0x08 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x97 0xF8 0x91 0x7E ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 D:\Programme\Neuer Ordner\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 D:\Programme\Daemon Update\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x95 0x84 0x26 0x7A ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xBE 0x6B 0xBB 0x08 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x97 0xF8 0x91 0x7E ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 D:\Programme\Neuer Ordner\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OOSAFEERASE04.00.00.01MSWINDOWS 44C6913E471845F3458589CD82C2F685EEE6CD21842DB365F81FC490A43549FAB124D405D866C47B53BBC8C5CF2EE89B69524B8E2158A0163B21688401649580D5AB286D90A1CFE91B02B1 3C33215C5963DE83EFFB78928B338D38C0294E6207FA21E1172ABC2D046C80695FC005BB9F58BA0C21240937E02435DAECC122B88A4F9B5999833E6B427EB21AD3AED2360526E700EF471A 7B6A37BFFCA513A5EABAE1096A009E405CD06DEA71ADD71BBDD1133CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC7 4CA6A0AC4980AC7933C038D530D6EB3452A6A0AC4980AC7933A9C6AECB7A5D140799AFA4FA00A9C0CAE05D5F95129189682803D4E7D3262947EF3036BA548C32928394A69534C775D1E9CB D2EE91ECDF42D37A1E2D8B24EE8127BBD8FACC00348413D910602BA1E55EB861653BD52C805C5EF57679940AFCEA3706DDAC168292523EC13AECCE1B03B8946B4701675007047EF00A6737 15B8F6E8D88B255BAD19B37B83A261CC4C25FEC52ED05B148EF25A71DA28A905B768EA0671C8C78D517B3549C6EBF8168386A01B617D7B6F50A8D5F197C5824F1AB9635F01A30D5FF0CDB6 A72C5C825F3EC4E365ADEBA24FB4ED414580F94BAD94BD4EC72C4E03CA450A6A9AC35C5DA2B4E25F7A345EA8CC0C70B832E08070FBB6E66E180B9ACB8BB

---- EOF - GMER 1.0.15 ----

Gruß Lucky_Ace


Alt 06.11.2009, 10:13   #21
Chris4You
 
IE öffnet automatisch werbung + langsamer pc - Standard

IE öffnet automatisch werbung + langsamer pc


Hi,

Bitte folgende Files prüfen (wahrscheinlich demontools):

Dateien Online überprüfen lassen:
  • Suche die Seite Virtustotal auf, klicke auf den Button „Durchsuchen“ und suche folgende Datei/Dateien:
Code:
ATTFilter
C:\Windows\System32\Drivers\aafn7or4.SYS
C:\Windows\System32\Drivers\spqg.sys
  • Lade nun nacheinander jede/alle Datei/Dateien hoch, und warte bis der Scan vorbei ist. (kann bis zu 2 Minuten dauern.)
  • Poste im Anschluss das Ergebnis der Auswertung, alles abkopieren und in einen Beitrag einfügen.
  • Wichtig: Auch die Größenangabe sowie den HASH mit kopieren!

So, dann wie folgt vorgehen (combofix deinstallieren):
Start->Ausführen-> combofix /u

Combofix neu runterladen (er wird jeden Tag auf die neusten kleinen Viecher angepasst), bereits im Downloaddialog auf test.exe umbenennen, dann wie gehabt starten, scannen lasse und log posten...
(Alle Fenster schliessen und combofix.exe starten und bestätige die folgende Abfrage mit 1 und drücke Enter.)
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

chris
__________________
--> IE öffnet automatisch werbung + langsamer pc

Alt 06.11.2009, 18:25   #22
Lucky_Ace
 
IE öffnet automatisch werbung + langsamer pc - Standard

IE öffnet automatisch werbung + langsamer pc


Nabend Chris,

hab zwar punkt 1 ausgeführt aber kann diese dateien nicht finden... wie soll ich weiter vorgehen?

Gruß Lucky_Ace

Alt 06.11.2009, 21:46   #23
Chris4You
 
IE öffnet automatisch werbung + langsamer pc - Standard

IE öffnet automatisch werbung + langsamer pc


Hi,
mache wie beschrieben mit combofix weiter, nicht vergesssen Ihn bereits im Downloaddialog umbenennen!
chris
__________________
Don't bring me down
Vor dem posten beachten!
Spenden
(Wer spenden will, kann sich gerne melden )

Alt 08.11.2009, 12:37   #24
Lucky_Ace
 
IE öffnet automatisch werbung + langsamer pc - Standard

IE öffnet automatisch werbung + langsamer pc


Hallo Chris,

hier der log von Combo fix...

ComboFix 09-11-06.03 - *** 07.11.2009 13:15.2.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.49.1031.18.511.231 [GMT 1:00]
ausgeführt von:: c:\dokumente und einstellungen\***\Desktop\test.exe
AV: AntiVir PersonalEdition Classic Virenschutz *On-access scanning enabled* (Updated) {00000000-0000-0000-0000-000000000000}
AV: AntiVir PersonalEdition Classic Virenschutz *On-access scanning enabled* (Updated) {804FD0EC-FFA4-00EB-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virenschutz *On-access scanning enabled* (Updated) {804FD0EC-FFA4-00F8-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virenschutz *On-access scanning enabled* (Updated) {804FD0EC-FFA4-00FB-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virenschutz *On-access scanning enabled* (Updated) {804FD2B8-FFA4-00FB-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virenschutz *On-access scanning enabled* (Updated) {804FD2B8-FFA4-010C-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((( Dateien erstellt von 2009-10-07 bis 2009-11-07 ))))))))))))))))))))))))))))))
.

2009-11-03 17:07 . 2009-11-03 17:07 -------- d-----w- C:\Virus
2009-11-03 15:49 . 2009-11-03 15:49 -------- d-----w- c:\dokumente und einstellungen\Gast\Anwendungsdaten\Malwarebytes
2009-11-01 20:33 . 2009-11-01 20:34 -------- d-----w- C:\rsit
2009-11-01 20:29 . 2009-11-01 20:29 -------- d-----w- c:\dokumente und einstellungen\***\Anwendungsdaten\Malwarebytes
2009-11-01 20:28 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-01 20:28 . 2009-11-01 20:28 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2009-11-01 20:28 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-26 09:26 . 2009-10-26 09:26 -------- d-----w- c:\dokumente und einstellungen\***\Anwendungsdaten\ASCOMP Software
2009-10-21 22:07 . 2009-10-29 11:02 147144 ----a-w- c:\dokumente und einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
2009-10-21 20:56 . 2009-10-22 09:57 -------- d-----w- c:\dokumente und einstellungen\***\Lokale Einstellungen\Anwendungsdaten\WBFSManager
2009-10-21 17:24 . 2009-10-21 17:24 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\DAEMON Tools Lite
2009-10-21 17:23 . 2009-10-21 17:23 -------- d-----w- c:\programme\DAEMON Tools Toolbar
2009-10-21 17:21 . 2009-10-21 17:26 -------- d-----w- c:\dokumente und einstellungen\***\Anwendungsdaten\DAEMON Tools Lite
2009-10-21 17:02 . 2008-06-24 11:45 1414440 ----a-w- c:\windows\system32\ShellManager310E2D762.dll
2009-10-21 16:17 . 2009-10-21 17:26 -------- d-----w- c:\dokumente und einstellungen\***\Anwendungsdaten\DAEMON Tools
2009-10-08 14:47 . 2009-10-08 14:47 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\DAEMON Tools Pro
2009-10-08 14:39 . 2009-10-08 14:39 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-10-08 14:39 . 2009-10-08 14:39 -------- d-----w- c:\dokumente und einstellungen\Steffen\Anwendungsdaten\DAEMON Tools Pro

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-07 11:09 . 2004-09-03 13:54 13440 ----a-w- c:\windows\system32\drivers\USBCRFT.SYS
2009-11-06 19:14 . 2006-02-15 19:35 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic
2009-11-04 18:12 . 2005-01-20 16:09 23210 ----a-w- c:\dokumente und einstellungen\***\Anwendungsdaten\wklnhst.dat
2009-11-04 14:33 . 2004-09-03 11:58 83840 ----a-w- c:\windows\system32\perfc007.dat
2009-11-04 14:33 . 2004-09-03 11:58 455168 ----a-w- c:\windows\system32\perfh007.dat
2009-10-21 17:04 . 2009-10-06 18:59 -------- d-----w- c:\programme\Gemeinsame Dateien\Nero
2009-10-21 17:04 . 2009-10-06 18:59 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Nero
2009-09-13 11:50 . 2005-02-24 14:18 -------- d-----w- c:\programme\Rockstar Games
2009-09-13 11:50 . 2004-09-03 13:54 -------- d--h--w- c:\programme\InstallShield Installation Information
2009-09-11 14:31 . 2004-09-03 11:58 133632 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-09 19:23 . 2009-09-09 19:24 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-09-09 19:23 . 2004-11-06 16:44 -------- d-----w- c:\programme\Java
2009-09-09 19:22 . 2009-09-09 19:22 152576 ----a-w- c:\dokumente und einstellungen\***\Anwendungsdaten\Sun\Java\jre1.6.0_16\lzma.dll
2009-09-09 17:40 . 2009-09-08 18:03 -------- d-----w- c:\dokumente und einstellungen\***\Anwendungsdaten\Winamp
2009-09-04 20:45 . 2004-09-03 11:58 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 07:24 . 2004-08-23 19:35 832512 ------w- c:\windows\system32\wininet.dll
2009-08-29 07:24 . 2004-08-04 07:57 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-08-29 07:24 . 2004-09-03 11:57 17408 ----a-w- c:\windows\system32\corpol.dll
2009-08-26 16:01 . 2004-11-08 13:03 67472 ----a-w- c:\dokumente und einstellungen\***\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2009-08-26 08:14 . 2004-09-03 11:58 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-19 11:12 . 2009-08-13 15:16 25 ----a-w- c:\windows\popcinfot.dat
2008-06-15 15:14 . 2008-06-15 15:14 0 -c--a-w- c:\programme\temp01
2005-10-21 17:19 . 2005-06-15 18:45 21 -c--a-w- c:\programme\AVPersonalAVWIN.INI
2006-07-24 18:05 . 2006-07-24 18:05 8192 -csha-w- c:\windows\o2cLicStore.bin
.

(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdobeUpdater"="c:\programme\Gemeinsame Dateien\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 2321600]
"H/PC Connection Agent"="c:\programme\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
"DAEMON Tools Lite"="d:\programme\Daemon Update\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2004-07-12 4112384]
"PCMService"="c:\programme\Home Cinema\PowerCinema\PCMService.exe" [2004-09-03 81920]
"AnyDVD"="c:\programme\SlySoft\AnyDVD\AnyDVD.exe" [2004-09-09 439808]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 172032]
"Steganos AntiDialer"="c:\progra~1\STEGAN~2\ANTIDIAL.EXE" [2002-06-27 263680]
"avgnt"="c:\programme\AntiVir PersonalEdition Classic\avgnt.exe" [2008-08-13 266497]
"Microsoft Works Update Detection"="c:\programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-17 50688]
"ISUSScheduler"="c:\programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"Sony Ericsson PC Suite"="c:\programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 159744]
"Adobe Photo Downloader"="c:\programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-23 57344]
"FreePDF Assistant"="c:\programme\FreePDF_XP\fpassist.exe" [2007-06-26 312320]
"AVMWlanClient"="c:\programme\avmwlanstick\wlangui.exe" [2007-12-19 1748992]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SunJavaUpdateSched"="c:\programme\Java\jre6\bin\jusched.exe" [2009-09-09 149280]
" Malwarebytes Anti-Malware (reboot)"="d:\programme\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2004-07-12 843776]
"Dit"="Dit.exe" - c:\windows\Dit.exe [2004-04-02 86016]
"CHotkey"="mHotkey.exe" - c:\windows\mHotkey.exe [2002-07-23 477184]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-04 15360]
"SSS5"="c:\programme\Steganos Security Suite 5\steganos5.exe" [2002-09-12 884736]
"SSS5SAFE"="c:\programme\Steganos Security Suite 5\safe.exe" [2002-09-12 180224]
"SSS5SPM"="c:\programme\Steganos Security Suite 5\spm.exe" [2002-09-13 147456]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\FRITZ!DSL\\FritzDsl.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\QIP\\qip.exe"=
"c:\programme\Microsoft ActiveSync\rapimgr.exe"= c:\programme\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\programme\Microsoft ActiveSync\wcescomm.exe"= c:\programme\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\programme\Microsoft ActiveSync\WCESMgr.exe"= c:\programme\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\HP1006MC.EXE"=
"c:\\Programme\\ICQ6.5\\ICQ.exe"=
"c:\\Programme\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Programme\\Java\\jre6\\bin\\java.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"63321:TCP"= 63321:TCP:Azu TCP
"63321:UDP"= 63321:UDP:Azu UDP

R0 avgntmgr;avgntmgr;c:\windows\system32\drivers\avgntmgr.sys [16.02.2006 10:01 22360]
R1 avgntdd;avgntdd;c:\windows\system32\drivers\avgntdd.sys [16.02.2006 10:01 45400]
R1 NETDSL;AVM PPP over Ethernet;c:\windows\system32\drivers\netdsl.sys [27.02.2005 14:25 11264]
R1 SSHDRV57;SSHDRV57;c:\windows\system32\drivers\SSHDRV57.sys [06.11.2004 18:19 32768]
R2 aadev;AVM ADSL Adapter Device;c:\windows\system32\drivers\Aadev.sys [27.02.2005 14:25 27648]
R2 ICQ Service;ICQ Service;c:\programme\ICQ6Toolbar\ICQ Service.exe [23.07.2009 22:10 222968]
R2 LogWatch;Ereignisprotokoll-Überwachung;c:\programme\CA\SharedComponents\CA_LIC\LogWatNT.exe [20.09.2002 15:29 53248]
R2 SLEE_401_DRIVER;Steganos Live Encryption Engine (Version 401) [Driver];c:\windows\system32\drivers\slee401.sys [22.02.2002 19:22 83472]
R3 CardReaderFilter;Card Reader Filter;c:\windows\system32\drivers\USBCRFT.SYS [03.09.2004 14:54 13440]
R3 NETFWDSL;AVM FRITZ!web DSL PPP;c:\windows\system32\drivers\NETFWDSL.SYS [27.02.2005 14:25 374272]
R3 PhTVTune;MEDION TV-TUNER 7134 MK2/3;c:\windows\system32\drivers\PhTVTune.sys [03.09.2004 14:06 24704]
S2 SLEE_401_SERVICE;Steganos Live Encryption Engine (Version 401) [Service];c:\windows\system32\slee401.exe [22.02.2002 19:24 53248]
S3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys [03.08.2008 17:28 4352]
S3 AVMUNET;AVM FRITZ!Box;c:\windows\system32\drivers\avmunet.sys [16.02.2005 14:06 16384]
S3 CA_LIC_CLNT;CA-Lizenz-Client;c:\programme\CA\SharedComponents\CA_LIC\lic98rmt.exe [20.09.2002 15:27 77824]
S3 CA_LIC_SRVR;CA-Lizenzserver;c:\programme\CA\SharedComponents\CA_LIC\lic98rmtd.exe [20.09.2002 15:41 77824]
S3 efipsk;efipsk;\??\c:\dokume~1\Michael\LOKALE~1\Temp\efipsk.sys --> c:\dokume~1\Michael\LOKALE~1\Temp\efipsk.sys [?]
S3 FWLANUSB;AVM FRITZ!WLAN;c:\windows\system32\drivers\fwlanusb.sys [03.08.2008 17:27 265088]
S3 PRISM_A00;CREATIX 802.11g Driver;c:\windows\system32\drivers\PRISMA00.sys [03.09.2004 14:08 380736]

--- Andere Dienste/Treiber im Speicher ---

*Deregistered* - mbr
*Deregistered* - PROCEXP113
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://start.icq.com/
uInternet Connection Wizard,ShellNext = hxxp://www.1und1.de/Herzlich_Willkommen/b1/
TCP: {1240E108-AD10-4E53-BFA0-8EF8616A2D67} = 192.168.122.252,192.168.122.253
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\dokumente und einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\nnc7eupy.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - google.de
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-07 13:29
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll AnyDVD.sys prosync1.sys sfsync02.sys >>UNKNOWN [0x825701F8]<<
kernel: MBR read successfully
user & kernel MBR OK

**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OOSAFEERASE04.00.00.01MSWINDOWS"="44C6913E471845F3458589CD82C2F685EEE6CD21842DB365F81FC490A43549FAB124D405D866C47B53BBC8C5CF2EE89B69524B8E2158A0163B2 1688401649580D5AB286D90A1CFE91B02B13C33215C5963DE83EFFB78928B338D38C0294E6207FA21E1172ABC2D046C80695FC005BB9F58BA0C21240937E02435DAECC122B88A4F9B59998 33E6B427EB21AD3AED2360526E700EF471A7B6A37BFFCA513A5EABAE1096A009E405CD06DEA71ADD71BBDD1133CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BE CC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933C038D530D6EB3452A6A0AC4980AC7933A9C6AECB7A5D140799AFA4FA00A9C0CAE05D5F95129189682803D4E7D3262947E F3036BA548C32928394A69534C775D1E9CBD2EE91ECDF42D37A1E2D8B24EE8127BBD8FACC00348413D910602BA1E55EB861653BD52C805C5EF57679940AFCEA3706DDAC168292523EC13AE CCE1B03B8946B4701675007047EF00A673715B8F6E8D88B255BAD19B37B83A261CC4C25FEC52ED05B148EF25A71DA28A905B768EA0671C8C78D517B3549C6EBF8168386A01B617D7B6F50A 8D5F197C5824F1AB9635F01A30D5FF0CDB6A72C5C825F3EC4E365ADEBA24FB4ED414580F94BAD94BD4EC72C4E03CA450A6A9AC35C5DA2B4E25F7A345EA8CC0C70B832E08070FBB6E66E180 B9ACB8BB80DD9AA947A039B4C4602B488BCF8C75B3DAF03F83B705944105BAB2C841CA0EB1860E698687C4DA3BA8B70AE101360DD48EA85FB2B6228B1F3FDE08FA7BCCE3052AD5C3D7DE7F B0A6D8F90A489897EFEE9830C92F9EB102AB2971D2BC30B9E10C2C523653177300472797AD87B844BE25DE7EED973CAFB0DD1394667BF795C44D780506624F1374B3E05172CDBBE35DB415 A885F864F1BEB39C94921A30C97BD6308848A9531A34BABC1D37845876F76987036A9C8DDE00DB50415AA1CDBA4201ADD5D906D24C8A4FA9523077842EDED4C13DBAF71EC046BF6F71E477 A969B4216D58029B4CBC1AC4B397B18D6E5EC362781DE5C5A8B01B69186DAB0337ED830531796FA19BFE86BA6B9D4DD68FEE872594C2B9186D794CF7EE848935F67FCA9359DCC9FECA9621 DF4F62E7FD6AAA57D74D9AEA29807444E99A6E5123C3B6B217F385326A64891B284270817F21E27E370E3DCD75860D57C24A1B6402A77CCBEDC0CDE115F6D9F50895169362D9F3A68A9772 C6C3142D458C08BC2282EAD0CDED99027D3D4FE7ACE99535B5D9D8B6A7F5FF71611341B101479E915C4F1825B9068916ADAE9F7D33B2EDDEA84FECE0C53B3991BE814701B18BA993E09C1A EAC16DD2F690323671FD327F4291731EEB4412F66BB8DA959CDFC53C7D05A0E80B9E8F25BE61EABEC9690C5F2ADF3B5823D5BBD3D8089F002C19179F6650F6DD8FDB2"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'explorer.exe'(1512)
c:\programme\CyberLink\Shared Files\CLRCEngine.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Zeit der Fertigstellung: 2009-11-07 13:40
ComboFix-quarantined-files.txt 2009-11-07 12:40
ComboFix2.txt 2009-11-04 14:59

Vor Suchlauf: 27 Verzeichnis(se), 36.237.488.128 Bytes frei
Nach Suchlauf: 29 Verzeichnis(se), 36.193.484.800 Bytes frei

- - End Of File - - 39202E6B8A4C24D9A9A3EB425F85154C


Gruß Lucky_Ace

Alt 08.11.2009, 15:56   #25
Chris4You
 
IE öffnet automatisch werbung + langsamer pc - Standard

IE öffnet automatisch werbung + langsamer pc


Hi,

ich habe do so einen Verdacht...
http://ad13.geekstogo.com/RootRepeal.zip
Auspacken und laufen lassen, Log hier posten...
http://www.technibble.com/articlecontent/2009/07/rootrepeal.gif
Scan und dann Save Report

Hast Du ein Motherboard mit VIA-Chips?

chris
__________________
Don't bring me down
Vor dem posten beachten!
Spenden
(Wer spenden will, kann sich gerne melden )

Alt 08.11.2009, 19:38   #26
Lucky_Ace
 
IE öffnet automatisch werbung + langsamer pc - Standard

IE öffnet automatisch werbung + langsamer pc


Nabend Chris,

hier der log von RootRepeal... ich habe nur die drivers gescannt ich hoffe das war richtig so... ich habe an dem pc nichts verändert... woher weiß ich dann ob ich ein motherboard mit via chips habe?

was wäre dein verdacht?

ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time: 2009/11/08 19:34
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP2
==================================================

Drivers
-------------------
Name: 1394BUS.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\1394BUS.SYS
Address: 0xF8675000 Size: 53248 File Visible: - Signed: -
Status: -

Name: aadev.sys
Image Path: C:\WINDOWS\System32\DRIVERS\aadev.sys
Address: 0xF8955000 Size: 27648 File Visible: - Signed: -
Status: -

Name: ACPI.sys
Image Path: ACPI.sys
Address: 0xF841C000 Size: 188800 File Visible: - Signed: -
Status: -

Name: ACPI_HAL
Image Path: \Driver\ACPI_HAL
Address: 0x804D7000 Size: 2060032 File Visible: - Signed: -
Status: -

Name: afbq837z.SYS
Image Path: C:\WINDOWS\System32\Drivers\afbq837z.SYS
Address: 0xF6F6C000 Size: 229376 File Visible: - Signed: -
Status: -

Name: afd.sys
Image Path: C:\WINDOWS\System32\drivers\afd.sys
Address: 0xF57B1000 Size: 138368 File Visible: - Signed: -
Status: -

Name: AmdK8.sys
Image Path: C:\WINDOWS\System32\DRIVERS\AmdK8.sys
Address: 0xF8795000 Size: 61440 File Visible: - Signed: -
Status: -

Name: AnyDVD.sys
Image Path: C:\WINDOWS\System32\Drivers\AnyDVD.sys
Address: 0xF8A45000 Size: 17792 File Visible: - Signed: -
Status: -

Name: arp1394.sys
Image Path: C:\WINDOWS\System32\DRIVERS\arp1394.sys
Address: 0xF87F5000 Size: 60800 File Visible: - Signed: -
Status: -

Name: atapi.sys
Image Path: atapi.sys
Address: 0xF83D4000 Size: 98304 File Visible: - Signed: -
Status: -

Name: atapi.sys
Image Path: atapi.sys
Address: 0x00000000 Size: 0 File Visible: - Signed: -
Status: -

Name: atksgt.sys
Image Path: C:\WINDOWS\system32\DRIVERS\atksgt.sys
Address: 0xF3BF4000 Size: 271360 File Visible: - Signed: -
Status: -

Name: ATMFD.DLL
Image Path: C:\WINDOWS\System32\ATMFD.DLL
Address: 0xBFFA0000 Size: 286720 File Visible: - Signed: -
Status: -

Name: audstub.sys
Image Path: C:\WINDOWS\System32\DRIVERS\audstub.sys
Address: 0xF8C3A000 Size: 3072 File Visible: - Signed: -
Status: -

Name: avgntdd.sys
Image Path: C:\WINDOWS\SYSTEM32\DRIVERS\avgntdd.sys
Address: 0xF5886000 Size: 77824 File Visible: - Signed: -
Status: -

Name: avgntmgr.sys
Image Path: avgntmgr.sys
Address: 0xF86D5000 Size: 36864 File Visible: - Signed: -
Status: -

Name: avipbb.sys
Image Path: C:\WINDOWS\system32\DRIVERS\avipbb.sys
Address: 0xF560A000 Size: 69632 File Visible: - Signed: -
Status: -

Name: Beep.SYS
Image Path: C:\WINDOWS\System32\Drivers\Beep.SYS
Address: 0xF8B9B000 Size: 4224 File Visible: - Signed: -
Status: -

Name: BOOTVID.dll
Image Path: C:\WINDOWS\system32\BOOTVID.dll
Address: 0xF8A75000 Size: 12288 File Visible: - Signed: -
Status: -

Name: Cap7134.sys
Image Path: C:\WINDOWS\System32\DRIVERS\Cap7134.sys
Address: 0xF719A000 Size: 350752 File Visible: - Signed: -
Status: -

Name: Cdfs.SYS
Image Path: C:\WINDOWS\System32\Drivers\Cdfs.SYS
Address: 0xF379D000 Size: 63744 File Visible: - Signed: -
Status: -

Name: cdrom.sys
Image Path: C:\WINDOWS\System32\DRIVERS\cdrom.sys
Address: 0xF87B5000 Size: 49536 File Visible: - Signed: -
Status: -

Name: cfosspeed.sys
Image Path: C:\WINDOWS\system32\DRIVERS\cfosspeed.sys
Address: 0xF6E34000 Size: 749568 File Visible: - Signed: -
Status: -

Name: CLASSPNP.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\CLASSPNP.SYS
Address: 0xF86C5000 Size: 53248 File Visible: - Signed: -
Status: -

Name: cmuda.sys
Image Path: C:\WINDOWS\system32\drivers\cmuda.sys
Address: 0xF6FC8000 Size: 812416 File Visible: - Signed: -
Status: -

Name: CtxS51.sys
Image Path: C:\WINDOWS\System32\DRIVERS\CtxS51.sys
Address: 0xF70B2000 Size: 804448 File Visible: - Signed: -
Status: -

Name: disk.sys
Image Path: disk.sys
Address: 0xF86B5000 Size: 36352 File Visible: - Signed: -
Status: -

Name: drmk.sys
Image Path: C:\WINDOWS\system32\drivers\drmk.sys
Address: 0xF87E5000 Size: 61440 File Visible: - Signed: -
Status: -

Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xF558E000 Size: 98304 File Visible: No Signed: -
Status: -

Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF8BAF000 Size: 8192 File Visible: No Signed: -
Status: -

Name: Dxapi.sys
Image Path: C:\WINDOWS\System32\drivers\Dxapi.sys
Address: 0xF58BD000 Size: 12288 File Visible: - Signed: -
Status: -

Name: dxg.sys
Image Path: C:\WINDOWS\System32\drivers\dxg.sys
Address: 0xBF9C3000 Size: 73728 File Visible: - Signed: -
Status: -

Name: dxgthk.sys
Image Path: C:\WINDOWS\System32\drivers\dxgthk.sys
Address: 0xF8D9A000 Size: 4096 File Visible: - Signed: -
Status: -

Name: ElbyCDIO.sys
Image Path: C:\WINDOWS\System32\Drivers\ElbyCDIO.sys
Address: 0xF452B000 Size: 9856 File Visible: - Signed: -
Status: -

Name: Fastfat.SYS
Image Path: C:\WINDOWS\System32\Drivers\Fastfat.SYS
Address: 0xF55E7000 Size: 143360 File Visible: - Signed: -
Status: -

Name: fdc.sys
Image Path: C:\WINDOWS\System32\DRIVERS\fdc.sys
Address: 0xF89AD000 Size: 27392 File Visible: - Signed: -
Status: -

Name: Fips.SYS
Image Path: C:\WINDOWS\System32\Drivers\Fips.SYS
Address: 0xF8775000 Size: 35072 File Visible: - Signed: -
Status: -

Name: flpydisk.sys
Image Path: C:\WINDOWS\System32\DRIVERS\flpydisk.sys
Address: 0xF8A2D000 Size: 20480 File Visible: - Signed: -
Status: -

Name: fltmgr.sys
Image Path: fltmgr.sys
Address: 0xF83B4000 Size: 128896 File Visible: - Signed: -
Status: -

Name: Fs_Rec.SYS
Image Path: C:\WINDOWS\System32\Drivers\Fs_Rec.SYS
Address: 0xF8B99000 Size: 7936 File Visible: - Signed: -
Status: -

Name: ftdisk.sys
Image Path: ftdisk.sys
Address: 0xF83EC000 Size: 126336 File Visible: - Signed: -
Status: -

Name: fwlanusb.sys
Image Path: C:\WINDOWS\system32\DRIVERS\fwlanusb.sys
Address: 0xF55A6000 Size: 265088 File Visible: - Signed: -
Status: -

Name: gameenum.sys
Image Path: C:\WINDOWS\System32\DRIVERS\gameenum.sys
Address: 0xF8260000 Size: 10624 File Visible: - Signed: -
Status: -

Name: hal.dll
Image Path: C:\WINDOWS\system32\hal.dll
Address: 0x806CE000 Size: 131968 File Visible: - Signed: -
Status: -

Name: HIDPARSE.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\HIDPARSE.SYS
Address: 0xF890D000 Size: 28672 File Visible: - Signed: -
Status: -

Name: HTTP.sys
Image Path: C:\WINDOWS\System32\Drivers\HTTP.sys
Address: 0xF329F000 Size: 262784 File Visible: - Signed: -
Status: -

Name: i8042prt.sys
Image Path: C:\WINDOWS\System32\DRIVERS\i8042prt.sys
Address: 0xF88B5000 Size: 53248 File Visible: - Signed: -
Status: -

Name: imapi.sys
Image Path: C:\WINDOWS\System32\DRIVERS\imapi.sys
Address: 0xF87D5000 Size: 41856 File Visible: - Signed: -
Status: -

Name: ipnat.sys
Image Path: C:\WINDOWS\System32\DRIVERS\ipnat.sys
Address: 0xF5643000 Size: 134912 File Visible: - Signed: -
Status: -

Name: ipsec.sys
Image Path: C:\WINDOWS\System32\DRIVERS\ipsec.sys
Address: 0xF5853000 Size: 74752 File Visible: - Signed: -
Status: -

Name: isapnp.sys
Image Path: isapnp.sys
Address: 0xF8685000 Size: 36224 File Visible: - Signed: -
Status: -

Name: kbdclass.sys
Image Path: C:\WINDOWS\System32\DRIVERS\kbdclass.sys
Address: 0xF89BD000 Size: 25216 File Visible: - Signed: -
Status: -

Name: KDCOM.DLL
Image Path: C:\WINDOWS\system32\KDCOM.DLL
Address: 0xF8B65000 Size: 8192 File Visible: - Signed: -
Status: -

Name: kmixer.sys
Image Path: C:\WINDOWS\system32\drivers\kmixer.sys
Address: 0xF2D9C000 Size: 172416 File Visible: - Signed: -
Status: -

Name: ks.sys
Image Path: C:\WINDOWS\System32\DRIVERS\ks.sys
Address: 0xF7177000 Size: 143360 File Visible: - Signed: -
Status: -

Name: KSecDD.sys
Image Path: KSecDD.sys
Address: 0xF838B000 Size: 92544 File Visible: - Signed: -
Status: -

Name: lirsgt.sys
Image Path: C:\WINDOWS\system32\DRIVERS\lirsgt.sys
Address: 0xF897D000 Size: 18048 File Visible: - Signed: -
Status: -

Name: mnmdd.SYS
Image Path: C:\WINDOWS\System32\Drivers\mnmdd.SYS
Address: 0xF8B9F000 Size: 4224 File Visible: - Signed: -
Status: -

Name: Modem.SYS
Image Path: C:\WINDOWS\System32\Drivers\Modem.SYS
Address: 0xF8A3D000 Size: 30336 File Visible: - Signed: -
Status: -

Name: mouclass.sys
Image Path: C:\WINDOWS\System32\DRIVERS\mouclass.sys
Address: 0xF89B5000 Size: 23552 File Visible: - Signed: -
Status: -

Name: MountMgr.sys
Image Path: MountMgr.sys
Address: 0xF8695000 Size: 42240 File Visible: - Signed: -
Status: -

Name: mrxdav.sys
Image Path: C:\WINDOWS\System32\DRIVERS\mrxdav.sys
Address: 0xF3C37000 Size: 179584 File Visible: - Signed: -
Status: -

Name: mrxsmb.sys
Image Path: C:\WINDOWS\System32\DRIVERS\mrxsmb.sys
Address: 0xF5664000 Size: 453632 File Visible: - Signed: -
Status: -

Name: Msfs.SYS
Image Path: C:\WINDOWS\System32\Drivers\Msfs.SYS
Address: 0xF892D000 Size: 19072 File Visible: - Signed: -
Status: -

Name: msgpc.sys
Image Path: C:\WINDOWS\System32\DRIVERS\msgpc.sys
Address: 0xF8745000 Size: 35072 File Visible: - Signed: -
Status: -

Name: msmpu401.sys
Image Path: C:\WINDOWS\system32\drivers\msmpu401.sys
Address: 0xF8D9B000 Size: 2944 File Visible: - Signed: -
Status: -

Name: mssmbios.sys
Image Path: C:\WINDOWS\System32\DRIVERS\mssmbios.sys
Address: 0xF8B05000 Size: 15488 File Visible: - Signed: -
Status: -

Name: Mup.sys
Image Path: Mup.sys
Address: 0xF82A4000 Size: 107904 File Visible: - Signed: -
Status: -

Name: MxlW2k.SYS
Image Path: C:\WINDOWS\System32\Drivers\MxlW2k.SYS
Address: 0xF8A4D000 Size: 25504 File Visible: - Signed: -
Status: -

Name: NDIS.sys
Image Path: NDIS.sys
Address: 0xF82D1000 Size: 182912 File Visible: - Signed: -
Status: -

Name: ndistapi.sys
Image Path: C:\WINDOWS\System32\DRIVERS\ndistapi.sys
Address: 0xF8AFD000 Size: 9600 File Visible: - Signed: -
Status: -

Name: ndiswan.sys
Image Path: C:\WINDOWS\System32\DRIVERS\ndiswan.sys
Address: 0xF6E1D000 Size: 91776 File Visible: - Signed: -
Status: -

Name: NDProxy.SYS
Image Path: C:\WINDOWS\System32\Drivers\NDProxy.SYS
Address: 0xF7C5C000 Size: 38016 File Visible: - Signed: -
Status: -

Name: netbios.sys
Image Path: C:\WINDOWS\System32\DRIVERS\netbios.sys
Address: 0xF8755000 Size: 34560 File Visible: - Signed: -
Status: -

Name: netbt.sys
Image Path: C:\WINDOWS\System32\DRIVERS\netbt.sys
Address: 0xF57D3000 Size: 162816 File Visible: - Signed: -
Status: -

Name: netdsl.sys
Image Path: C:\WINDOWS\system32\DRIVERS\netdsl.sys
Address: 0xF827C000 Size: 11264 File Visible: - Signed: -
Status: -

Name: NETFWDSL.SYS
Image Path: C:\WINDOWS\system32\DRIVERS\NETFWDSL.SYS
Address: 0xF6EEB000 Size: 374272 File Visible: - Signed: -
Status: -

Name: nic1394.sys
Image Path: C:\WINDOWS\System32\DRIVERS\nic1394.sys
Address: 0xF8725000 Size: 61824 File Visible: - Signed: -
Status: -

Name: Npfs.SYS
Image Path: C:\WINDOWS\System32\Drivers\Npfs.SYS
Address: 0xF8935000 Size: 30848 File Visible: - Signed: -
Status: -

Name: Ntfs.sys
Image Path: Ntfs.sys
Address: 0xF82FE000 Size: 574464 File Visible: - Signed: -
Status: -

Name: ntkrnlpa.exe
Image Path: C:\WINDOWS\system32\ntkrnlpa.exe
Address: 0x804D7000 Size: 2060032 File Visible: - Signed: -
Status: -

Name: Null.SYS
Image Path: C:\WINDOWS\System32\Drivers\Null.SYS
Address: 0xF8D27000 Size: 2944 File Visible: - Signed: -
Status: -

Name: nv4_disp.dll
Image Path: C:\WINDOWS\System32\nv4_disp.dll
Address: 0xBF9D5000 Size: 3743744 File Visible: - Signed: -
Status: -

Name: nv4_mini.sys
Image Path: C:\WINDOWS\System32\DRIVERS\nv4_mini.sys
Address: 0xF7204000 Size: 2459968 File Visible: - Signed: -
Status: -

Name: ohci1394.sys
Image Path: ohci1394.sys
Address: 0xF8665000 Size: 61056 File Visible: - Signed: -
Status: -

Name: parport.sys
Image Path: C:\WINDOWS\System32\DRIVERS\parport.sys
Address: 0xF6F47000 Size: 80384 File Visible: - Signed: -
Status: -

Name: PartMgr.sys
Image Path: PartMgr.sys
Address: 0xF88ED000 Size: 18688 File Visible: - Signed: -
Status: -

Name: pci.sys
Image Path: pci.sys
Address: 0xF840B000 Size: 68224 File Visible: - Signed: -
Status: -

Name: PCI_PNP6742
Image Path: \Driver\PCI_PNP6742
Address: 0x00000000 Size: 0 File Visible: No Signed: -
Status: -

Name: PCIIDEX.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\PCIIDEX.SYS
Address: 0xF88E5000 Size: 28672 File Visible: - Signed: -
Status: -

Name: pfc.sys
Image Path: C:\WINDOWS\system32\drivers\pfc.sys
Address: 0xF8B59000 Size: 10368 File Visible: - Signed: -
Status: -

Name: PhTVTune.sys
Image Path: C:\WINDOWS\System32\DRIVERS\PhTVTune.sys
Address: 0xF8A0D000 Size: 24704 File Visible: - Signed: -
Status: -

Name: PnpManager
Image Path: \Driver\PnpManager
Address: 0x804D7000 Size: 2060032 File Visible: - Signed: -
Status: -

Name: portcls.sys
Image Path: C:\WINDOWS\system32\drivers\portcls.sys
Address: 0xF6FA4000 Size: 147456 File Visible: - Signed: -
Status: -

Name: PQNTDrv.SYS
Image Path: C:\WINDOWS\System32\Drivers\PQNTDrv.SYS
Address: 0xF8D4E000 Size: 2688 File Visible: - Signed: -
Status: -

Name: prodrv06.sys
Image Path: C:\WINDOWS\System32\drivers\prodrv06.sys
Address: 0xF56D3000 Size: 77184 File Visible: - Signed: -
Status: -

Name: prohlp02.sys
Image Path: prohlp02.sys
Address: 0xF86F5000 Size: 65504 File Visible: - Signed: -
Status: -

Name: prosync1.sys
Image Path: prosync1.sys
Address: 0xF8B6D000 Size: 6944 File Visible: - Signed: -
Status: -

Name: ptilink.sys
Image Path: C:\WINDOWS\System32\DRIVERS\ptilink.sys
Address: 0xF89CD000 Size: 17792 File Visible: - Signed: -
Status: -

Name: PxHelp20.sys
Image Path: PxHelp20.sys
Address: 0xF86E5000 Size: 37376 File Visible: - Signed: -
Status: -

Name: rasacd.sys
Image Path: C:\WINDOWS\System32\DRIVERS\rasacd.sys
Address: 0xF8B55000 Size: 8832 File Visible: - Signed: -
Status: -

Name: rasl2tp.sys
Image Path: C:\WINDOWS\System32\DRIVERS\rasl2tp.sys
Address: 0xF88C5000 Size: 51328 File Visible: - Signed: -
Status: -

Name: raspppoe.sys
Image Path: C:\WINDOWS\System32\DRIVERS\raspppoe.sys
Address: 0xF88D5000 Size: 41472 File Visible: - Signed: -
Status: -

Name: raspptp.sys
Image Path: C:\WINDOWS\System32\DRIVERS\raspptp.sys
Address: 0xF7C7C000 Size: 48384 File Visible: - Signed: -
Status: -

Name: raspti.sys
Image Path: C:\WINDOWS\System32\DRIVERS\raspti.sys
Address: 0xF89D5000 Size: 16512 File Visible: - Signed: -
Status: -

Name: RAW
Image Path: \FileSystem\RAW
Address: 0x804D7000 Size: 2060032 File Visible: - Signed: -
Status: -

Name: rdbss.sys
Image Path: C:\WINDOWS\System32\DRIVERS\rdbss.sys
Address: 0xF56E6000 Size: 174592 File Visible: - Signed: -
Status: -

Name: RDPCDD.sys
Image Path: C:\WINDOWS\System32\DRIVERS\RDPCDD.sys
Address: 0xF8BA1000 Size: 4224 File Visible: - Signed: -
Status: -

Name: redbook.sys
Image Path: C:\WINDOWS\System32\DRIVERS\redbook.sys
Address: 0xF87C5000 Size: 57600 File Visible: - Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xF3147000 Size: 49152 File Visible: No Signed: -
Status: -

Name: SCSIPORT.SYS
Image Path: C:\WINDOWS\System32\Drivers\SCSIPORT.SYS
Address: 0xF844B000 Size: 98304 File Visible: - Signed: -
Status: -

Name: secdrv.sys
Image Path: C:\WINDOWS\System32\DRIVERS\secdrv.sys
Address: 0xF45C3000 Size: 40960 File Visible: - Signed: -
Status: -

Name: serenum.sys
Image Path: C:\WINDOWS\System32\DRIVERS\serenum.sys
Address: 0xF8264000 Size: 15488 File Visible: - Signed: -
Status: -

Name: serial.sys
Image Path: C:\WINDOWS\System32\DRIVERS\serial.sys
Address: 0xF6F5B000 Size: 65920 File Visible: - Signed: -
Status: -

Name: sfdrv01.sys
Image Path: sfdrv01.sys
Address: 0xF82BF000 Size: 73728 File Visible: - Signed: -
Status: -

Name: sfhlp01.sys
Image Path: sfhlp01.sys
Address: 0xF8B6B000 Size: 4832 File Visible: - Signed: -
Status: -

Name: sfhlp02.sys
Image Path: sfhlp02.sys
Address: 0xF8905000 Size: 32768 File Visible: - Signed: -
Status: -

Name: sfsync02.sys
Image Path: sfsync02.sys
Address: 0xF88F5000 Size: 20544 File Visible: - Signed: -
Status: -

Name: SLEE401.sys
Image Path: C:\WINDOWS\system32\drivers\SLEE401.sys
Address: 0xF3935000 Size: 82144 File Visible: - Signed: -
Status: -

Name: spkr.sys
Image Path: spkr.sys
Address: 0xF8463000 Size: 1052672 File Visible: No Signed: -
Status: -

Name: sptd
Image Path: \Driver\sptd
Address: 0x00000000 Size: 0 File Visible: No Signed: -
Status: -

Name: sr.sys
Image Path: sr.sys
Address: 0xF83A2000 Size: 73472 File Visible: - Signed: -
Status: -

Name: srv.sys
Image Path: C:\WINDOWS\System32\DRIVERS\srv.sys
Address: 0xF399A000 Size: 333184 File Visible: - Signed: -
Status: -

Name: SSHDRV57.sys
Image Path: C:\WINDOWS\System32\drivers\SSHDRV57.sys
Address: 0xF8735000 Size: 49152 File Visible: - Signed: -
Status: -

Name: STREAM.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\STREAM.SYS
Address: 0xF87A5000 Size: 49152 File Visible: - Signed: -
Status: -

Name: swenum.sys
Image Path: C:\WINDOWS\System32\DRIVERS\swenum.sys
Address: 0xF8C0B000 Size: 4352 File Visible: - Signed: -
Status: -

Name: sysaudio.sys
Image Path: C:\WINDOWS\system32\drivers\sysaudio.sys
Address: 0xF35B5000 Size: 60800 File Visible: - Signed: -
Status: -

Name: tcpip.sys
Image Path: C:\WINDOWS\System32\DRIVERS\tcpip.sys
Address: 0xF57FB000 Size: 360320 File Visible: - Signed: -
Status: -

Name: TDI.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\TDI.SYS
Address: 0xF89C5000 Size: 20480 File Visible: - Signed: -
Status: -

Name: termdd.sys
Image Path: C:\WINDOWS\System32\DRIVERS\termdd.sys
Address: 0xF7C6C000 Size: 40704 File Visible: - Signed: -
Status: -

Name: update.sys
Image Path: C:\WINDOWS\System32\DRIVERS\update.sys
Address: 0xF6DE9000 Size: 209408 File Visible: - Signed: -
Status: -

Name: USBCRFT.SYS
Image Path: C:\WINDOWS\system32\Drivers\USBCRFT.SYS
Address: 0xF5CC5000 Size: 13440 File Visible: - Signed: -
Status: -

Name: USBD.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\USBD.SYS
Address: 0xF8B79000 Size: 8192 File Visible: - Signed: -
Status: -

Name: usbehci.sys
Image Path: C:\WINDOWS\System32\DRIVERS\usbehci.sys
Address: 0xF8A5D000 Size: 26624 File Visible: - Signed: -
Status: -

Name: usbhub.sys
Image Path: C:\WINDOWS\System32\DRIVERS\usbhub.sys
Address: 0xF7C0C000 Size: 57600 File Visible: - Signed: -
Status: -

Name: USBPORT.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\USBPORT.SYS
Address: 0xF708F000 Size: 143360 File Visible: - Signed: -
Status: -

Name: USBSTOR.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS
Address: 0xF8975000 Size: 26496 File Visible: - Signed: -
Status: -

Name: usbuhci.sys
Image Path: C:\WINDOWS\System32\DRIVERS\usbuhci.sys
Address: 0xF8A55000 Size: 20480 File Visible: - Signed: -
Status: -

Name: vga.sys
Image Path: C:\WINDOWS\System32\drivers\vga.sys
Address: 0xF8A6D000 Size: 20992 File Visible: - Signed: -
Status: -

Name: viaagp1.sys
Image Path: viaagp1.sys
Address: 0xF88FD000 Size: 27904 File Visible: - Signed: -
Status: -

Name: viaide.sys
Image Path: viaide.sys
Address: 0xF8B69000 Size: 5376 File Visible: - Signed: -
Status: -

Name: VIDEOPRT.SYS
Image Path: C:\WINDOWS\System32\DRIVERS\VIDEOPRT.SYS
Address: 0xF71F0000 Size: 81920 File Visible: - Signed: -
Status: -

Name: VolSnap.sys
Image Path: VolSnap.sys
Address: 0xF86A5000 Size: 53760 File Visible: - Signed: -
Status: -

Name: wanarp.sys
Image Path: C:\WINDOWS\System32\DRIVERS\wanarp.sys
Address: 0xF8785000 Size: 34560 File Visible: - Signed: -
Status: -

Name: watchdog.sys
Image Path: C:\WINDOWS\System32\watchdog.sys
Address: 0xF899D000 Size: 20480 File Visible: - Signed: -
Status: -

Name: wdmaud.sys
Image Path: C:\WINDOWS\system32\drivers\wdmaud.sys
Address: 0xF3510000 Size: 82944 File Visible: - Signed: -
Status: -

Name: Win32k
Image Path: \Driver\Win32k
Address: 0xBF800000 Size: 1847296 File Visible: - Signed: -
Status: -

Name: win32k.sys
Image Path: C:\WINDOWS\System32\win32k.sys
Address: 0xBF800000 Size: 1847296 File Visible: - Signed: -
Status: -

Name: WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\WMILIB.SYS
Address: 0xF8B67000 Size: 8192 File Visible: - Signed: -
Status: -

Name: WMIxWDM
Image Path: \Driver\WMIxWDM
Address: 0x804D7000 Size: 2060032 File Visible: - Signed: -
Status: -

Gruß Lucky_Ace

Alt 09.11.2009, 08:39   #27
Chris4You
 
IE öffnet automatisch werbung + langsamer pc - Standard

IE öffnet automatisch werbung + langsamer pc


Hi,

noch ein paar Treiber zum überprüfen...


Dateien Online überprüfen lassen:
  • Suche die Seite Virtustotal auf, klicke auf den Button „Durchsuchen“ und suche folgende Datei/Dateien:
Code:
ATTFilter
c:\windows\system32\DRIVERS\atapi.sys
C:\WINDOWS\system32\DRIVERS\netdsl.sys
C:\WINDOWS\system32\DRIVERS\Ntfs.sys
  • Lade nun nacheinander jede/alle Datei/Dateien hoch, und warte bis der Scan vorbei ist. (kann bis zu 2 Minuten dauern.)
  • Poste im Anschluss das Ergebnis der Auswertung, alles abkopieren und in einen Beitrag einfügen.
  • Wichtig: Auch die Größenangabe sowie den HASH mit kopieren!

chris
__________________
Don't bring me down
Vor dem posten beachten!
Spenden
(Wer spenden will, kann sich gerne melden )

Alt 09.11.2009, 15:06   #28
Lucky_Ace
 
IE öffnet automatisch werbung + langsamer pc - Standard

IE öffnet automatisch werbung + langsamer pc


Hallo Chris,

ist zur groß für hier rein zu kopieren also schicke ich wieder den link...

c:\windows\system32\DRIVERS\atapi.sys
1 Fund
Virustotal. MD5: cdfe4411a69c224bd1d11b2da92dac51 Heuristic.BehavesLike.Win32.Rootkit.H

C:\WINDOWS\system32\DRIVERS\netdsl.sys
0Funde

Virustotal. MD5: 1f1acda3cbb76ef5ce28f3d8a2d08272

C:\WINDOWS\system32\DRIVERS\Ntfs.sys
0Funde

Virustotal. MD5: 19a811ef5f1ed5c926a028ce107ff1af

ein großes lob und danke schön schon einmal bis hier her
Gruß Lucky_Ace
Alt 09.11.2009, 17:50   #29
Chris4You
 
IE öffnet automatisch werbung + langsamer pc - Standard

IE öffnet automatisch werbung + langsamer pc


Hi,

c:\windows\system32\DRIVERS\atapi.sys
in einem anderen Thread war das eine TDSS-Variante (ganz neu)...
Kann aber auch false/positiv sein...

Bitte das File hochladen, ich bin leider morgen den ganzen Tag geschäftlich unterwegs...
http://www.trojaner-board.de/54791-anleitung-uploadchannel-trojaner-board.html

Chris
__________________
Don't bring me down
Vor dem posten beachten!
Spenden
(Wer spenden will, kann sich gerne melden )

Alt 09.11.2009, 18:45   #30
Lucky_Ace
 
IE öffnet automatisch werbung + langsamer pc - Standard

IE öffnet automatisch werbung + langsamer pc


Nabend Chris,
habs hochgeladen kam aber kein link oder sowas aber denke mal das das so richtig ist... oke dann weiß ich bescheid viel erfolg...

Gruß Lucky_Ace

Antwort
Seite 2 von 3 1 2 3

Themen zu IE öffnet automatisch werbung + langsamer pc
adobe, antivir, askbar, avira, bho, computer, downloader, entfernen, firefox, hijack, hijackthis, hkus\s-1-5-18, home, internet, internet explorer, langsam, mein log, mozilla, nmindexstoresvr.exe, photoshop, plug-in, rundll, security, security suite, software, stick, system, temp, werbung, windows, windows xp, windows\temp, öffnet automatisch


« hatte starken virenbefall - geschwindigkeitsverlust - eingabeaufforderung | TR / Dropper :gen »


Ähnliche Themen: IE öffnet automatisch werbung + langsamer pc


  1. Werbung in Firefox, Fenster mit PC Optimierung Werbung öffnet sich automatisch
    Log-Analyse und Auswertung - 10.04.2015 (11)
  2. Browser öffnet automatisch Werbung
    Log-Analyse und Auswertung - 01.06.2012 (1)
  3. IE öffnet sich automatisch mit Werbung
    Plagegeister aller Art und deren Bekämpfung - 24.02.2010 (8)
  4. Computer öffnet automatisch Programme und wird immer langsamer
    Log-Analyse und Auswertung - 08.02.2010 (1)
  5. internet explorer öffnet automatisch werbung
    Log-Analyse und Auswertung - 26.01.2010 (3)
  6. Werbung öffnet automatisch
    Antiviren-, Firewall- und andere Schutzprogramme - 17.12.2009 (9)
  7. IE öffnet automatisch mit Werbung
    Log-Analyse und Auswertung - 05.10.2009 (10)
  8. Internet Explorer öffnet automatisch und öffnet Werbung
    Log-Analyse und Auswertung - 28.08.2009 (18)
  9. i-net explorer öffnet automatisch werbung
    Log-Analyse und Auswertung - 26.05.2009 (23)
  10. Internet Explorer öffnet Automatisch Werbung
    Plagegeister aller Art und deren Bekämpfung - 19.02.2009 (5)
  11. IE öffnet automatisch Werbung
    Log-Analyse und Auswertung - 14.02.2009 (6)
  12. Internet Explorer Öffnet automatisch mit werbung.
    Log-Analyse und Auswertung - 10.11.2008 (1)
  13. Firefox öffnet automatisch Werbung
    Log-Analyse und Auswertung - 20.10.2008 (11)
  14. Internet Explorer - öffnet automatisch Werbung!
    Log-Analyse und Auswertung - 10.10.2008 (2)
  15. IE7 öffnet sich immer Automatisch mit Werbung
    Log-Analyse und Auswertung - 13.07.2008 (1)
  16. Firefox öffnet automatisch ein fenster mit werbung!
    Log-Analyse und Auswertung - 30.12.2007 (1)
  17. Firefox öffnet sich automatisch mit werbung
    Log-Analyse und Auswertung - 11.12.2007 (3)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema IE öffnet automatisch werbung + langsamer pc - Nabend Chris, der folgenden Pfad c:/Dokumente und Einstellungen/Michael/Lokale Einstellungen/Temp <-Ggf. Pfad richtig anpassen! gibt es nicht... es gab mal einen Benutzer namens Michael aber den gibt es nciht mehr und - IE öffnet automatisch werbung + langsamer pc...
Archiv
Du betrachtest: IE öffnet automatisch werbung + langsamer pc auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54