| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Windows friert ein, Firefox öffnet willkürlich Fenster ( in Flensburg)Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
| |
06.08.2010, 13:55
| #1 |
 |  Windows friert ein, Firefox öffnet willkürlich Fenster ( in Flensburg) Keinesfalls die Treiber reaktivieren, bevor es angewiesen wird. Verstanden. neustart, nun noch mal kaspersky tdss killer nutzen und das log posten. Mach ich jetzt. |
|
06.08.2010, 14:02
| #2 |
| | Windows friert ein, Firefox öffnet willkürlich Fenster ( in Flensburg) 2010/08/06 15:00:41.0671 TDSS rootkit removing tool 2.4.1.0 Aug 4 2010 15:06:41
__________________2010/08/06 15:00:41.0671 ================================================================================ 2010/08/06 15:00:41.0671 SystemInfo: 2010/08/06 15:00:41.0671 2010/08/06 15:00:41.0671 OS Version: 5.1.2600 ServicePack: 3.0 2010/08/06 15:00:41.0671 Product type: Workstation 2010/08/06 15:00:41.0671 ComputerName: SACHFACH 2010/08/06 15:00:41.0671 UserName: Gerhard Ott 2010/08/06 15:00:41.0671 Windows directory: C:\WINDOWS 2010/08/06 15:00:41.0671 System windows directory: C:\WINDOWS 2010/08/06 15:00:41.0671 Processor architecture: Intel x86 2010/08/06 15:00:41.0671 Number of processors: 2 2010/08/06 15:00:41.0671 Page size: 0x1000 2010/08/06 15:00:41.0671 Boot type: Normal boot 2010/08/06 15:00:41.0671 ================================================================================ 2010/08/06 15:00:42.0421 Initialize success 2010/08/06 15:00:45.0031 ================================================================================ 2010/08/06 15:00:45.0031 Scan started 2010/08/06 15:00:45.0031 Mode: Manual; 2010/08/06 15:00:45.0031 ================================================================================ 2010/08/06 15:00:45.0546 ACPI (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys 2010/08/06 15:00:45.0593 ACPIEC (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys 2010/08/06 15:00:45.0656 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys 2010/08/06 15:00:45.0703 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys 2010/08/06 15:00:45.0906 AnyDVD (82ce157ff3701ab50769b2654d0b0215) C:\WINDOWS\system32\Drivers\AnyDVD.sys 2010/08/06 15:00:45.0937 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys 2010/08/06 15:00:46.0078 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys 2010/08/06 15:00:46.0140 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys 2010/08/06 15:00:46.0218 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys 2010/08/06 15:00:46.0296 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys 2010/08/06 15:00:46.0328 AVMCOWAN (0bcb6b3df2e248c8e8f2ffc6f58d1341) C:\WINDOWS\system32\DRIVERS\AVMCOWAN.sys 2010/08/06 15:00:46.0390 AVMWAN (c997af59c54d69232fb7bbea4dad86e2) C:\WINDOWS\system32\DRIVERS\avmwan.sys 2010/08/06 15:00:46.0437 bdfm (ced6717bd8b67284afcf692b9316b464) C:\WINDOWS\system32\drivers\bdfm.sys 2010/08/06 15:00:46.0484 bdfsfltr (70975049e22b2efec260816cf505e6e7) C:\WINDOWS\system32\drivers\bdfsfltr.sys 2010/08/06 15:00:46.0578 bdftdif (a7bdb1958d9b8245a0ba83f46abb630c) C:\Programme\Gemeinsame Dateien\BitDefender\BitDefender Firewall\bdftdif.sys 2010/08/06 15:00:46.0609 BDSelfPr (5eaf583c0b1cc2499761ea3b065f5db2) C:\Programme\BitDefender\BitDefender 2009\bdselfpr.sys 2010/08/06 15:00:46.0671 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys 2010/08/06 15:00:46.0734 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys 2010/08/06 15:00:46.0796 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys 2010/08/06 15:00:46.0843 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys 2010/08/06 15:00:46.0890 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys 2010/08/06 15:00:47.0125 cxbu0wdm (ee1d91022fc0df4f0434ec11c65e6649) C:\WINDOWS\system32\DRIVERS\cxbu0wdm.sys 2010/08/06 15:00:47.0234 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys 2010/08/06 15:00:47.0312 dmboot (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys 2010/08/06 15:00:47.0375 dmio (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys 2010/08/06 15:00:47.0421 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys 2010/08/06 15:00:47.0468 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys 2010/08/06 15:00:47.0578 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys 2010/08/06 15:00:47.0625 dsltestSp5 (c6b2e10cfe79169c72f0269087b9a603) C:\WINDOWS\system32\Drivers\dsltestSp5.sys 2010/08/06 15:00:47.0671 E1000 (4de4bae4accb5a49fa85801d4f226355) C:\WINDOWS\system32\DRIVERS\e1000325.sys 2010/08/06 15:00:47.0718 e1express (34aaa3b298a852b3663e6e0d94d12945) C:\WINDOWS\system32\DRIVERS\e1e5132.sys 2010/08/06 15:00:47.0765 ElbyCDFL (ce37e3d51912e59c80c6d84337c0b4cd) C:\WINDOWS\system32\Drivers\ElbyCDFL.sys 2010/08/06 15:00:47.0812 ElbyCDIO (309ac30471a0f1c3a89dee1c81230576) C:\WINDOWS\system32\Drivers\ElbyCDIO.sys 2010/08/06 15:00:47.0859 ENUM1394 (80d1b490b60e74e002dc116ec5d41748) C:\WINDOWS\system32\DRIVERS\enum1394.sys 2010/08/06 15:00:47.0937 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys 2010/08/06 15:00:47.0984 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys 2010/08/06 15:00:48.0015 Fips (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys 2010/08/06 15:00:48.0078 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys 2010/08/06 15:00:48.0125 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys 2010/08/06 15:00:48.0187 fpcibase (25baa9e7e21ca204b3202637c4f0d44e) C:\WINDOWS\system32\DRIVERS\fpcibase.sys 2010/08/06 15:00:48.0234 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys 2010/08/06 15:00:48.0281 Ftdisk (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys 2010/08/06 15:00:48.0359 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys 2010/08/06 15:00:48.0406 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 2010/08/06 15:00:48.0453 HECI (cc2c8c23417cc7ddf5eddb17e60a14db) C:\WINDOWS\system32\DRIVERS\HECI.sys 2010/08/06 15:00:48.0515 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys 2010/08/06 15:00:48.0609 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys 2010/08/06 15:00:48.0750 i8042prt (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys 2010/08/06 15:00:48.0796 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys 2010/08/06 15:00:48.0968 intelppm (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys 2010/08/06 15:00:49.0015 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys 2010/08/06 15:00:49.0046 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 2010/08/06 15:00:49.0093 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys 2010/08/06 15:00:49.0140 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys 2010/08/06 15:00:49.0187 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys 2010/08/06 15:00:49.0234 irda (aca5e7b54409f9cb5eed97ed0c81120e) C:\WINDOWS\system32\DRIVERS\irda.sys 2010/08/06 15:00:49.0281 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys 2010/08/06 15:00:49.0343 irsir (0501f0b9ab08425f8c0eacbdcc04aa32) C:\WINDOWS\system32\DRIVERS\irsir.sys 2010/08/06 15:00:49.0390 is3srv (8fe4ecc7877fcfe4e59414708898073d) C:\WINDOWS\system32\drivers\is3srv.sys 2010/08/06 15:00:49.0468 isapnp (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys 2010/08/06 15:00:49.0531 Kbdclass (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys 2010/08/06 15:00:49.0609 kbdhid (b6d6c117d771c98130497265f26d1882) C:\WINDOWS\system32\DRIVERS\kbdhid.sys 2010/08/06 15:00:49.0671 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys 2010/08/06 15:00:49.0703 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys 2010/08/06 15:00:49.0843 MacOpen (f1d23f78dcd65c8132c908b1e72e9143) C:\WINDOWS\system32\drivers\MacOpen.sys 2010/08/06 15:00:49.0921 MagicTune (f627e9da4d3d8dc05a15b68944302f14) C:\WINDOWS\system32\drivers\MTiCtwl.sys 2010/08/06 15:00:49.0984 MaxtorFrontPanel1 (dad2801f46631b625fb4fb37265fbe6e) C:\WINDOWS\system32\DRIVERS\mxofwfp.sys 2010/08/06 15:00:50.0046 MLPTDR_B (124aaf5d2a58e00c05019b0fb77c0966) C:\WINDOWS\system32\MLPTDR_B.sys 2010/08/06 15:00:50.0140 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys 2010/08/06 15:00:50.0187 Modem (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys 2010/08/06 15:00:50.0234 motmodem (54fee02961c70fd9d4d7e2f87afa23fa) C:\WINDOWS\system32\DRIVERS\motmodem.sys 2010/08/06 15:00:50.0281 Mouclass (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys 2010/08/06 15:00:50.0328 mouhid (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys 2010/08/06 15:00:50.0359 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys 2010/08/06 15:00:50.0468 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys 2010/08/06 15:00:50.0515 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 2010/08/06 15:00:50.0593 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys 2010/08/06 15:00:50.0625 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys 2010/08/06 15:00:50.0687 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys 2010/08/06 15:00:50.0734 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys 2010/08/06 15:00:50.0796 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys 2010/08/06 15:00:50.0875 MTXPAR (0f83a76c82d5b9f672b33923759b2b12) C:\WINDOWS\system32\DRIVERS\MTXPARM.sys 2010/08/06 15:00:51.0000 MTXPARH (6dda78a0be692b61b668fab860f276cf) C:\WINDOWS\system32\DRIVERS\MTXPARHM.sys 2010/08/06 15:00:51.0062 Mtxparmx (a9948d5ed30db457ff92239802d97e34) C:\WINDOWS\system32\DRIVERS\Mtxparmx.sys 2010/08/06 15:00:51.0109 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys 2010/08/06 15:00:51.0156 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys 2010/08/06 15:00:51.0203 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys 2010/08/06 15:00:51.0250 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys 2010/08/06 15:00:51.0296 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys 2010/08/06 15:00:51.0328 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys 2010/08/06 15:00:51.0343 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys 2010/08/06 15:00:51.0390 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys 2010/08/06 15:00:51.0453 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys 2010/08/06 15:00:51.0500 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys 2010/08/06 15:00:51.0562 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys 2010/08/06 15:00:51.0625 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys 2010/08/06 15:00:51.0671 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 2010/08/06 15:00:51.0718 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 2010/08/06 15:00:51.0765 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys 2010/08/06 15:00:51.0828 Parport (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\drivers\Parport.sys 2010/08/06 15:00:51.0859 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys 2010/08/06 15:00:51.0921 ParVdm (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys 2010/08/06 15:00:51.0968 PCANDIS5 (d0084a9ade989fe703e4f22171f4e4dc) C:\PROGRA~1\GEMEIN~1\T-Com\DSLCheck\PCANDIS5.SYS 2010/08/06 15:00:52.0000 PCI (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys 2010/08/06 15:00:52.0093 PCIIde (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys 2010/08/06 15:00:52.0156 Pcmcia (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys 2010/08/06 15:00:52.0406 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys 2010/08/06 15:00:52.0453 Processor (2cb55427c58679f49ad600fccba76360) C:\WINDOWS\system32\DRIVERS\processr.sys 2010/08/06 15:00:52.0500 Profos (1bfe86c679a43994e36e623fb6898cdb) C:\Programme\Gemeinsame Dateien\BitDefender\BitDefender Threat Scanner\profos.sys 2010/08/06 15:00:52.0562 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys 2010/08/06 15:00:52.0609 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys 2010/08/06 15:00:52.0656 PxHelp20 (49452bfcec22f36a7a9b9c2181bc3042) C:\WINDOWS\system32\Drivers\PxHelp20.sys 2010/08/06 15:00:52.0890 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys 2010/08/06 15:00:52.0937 Rasirda (0207d26ddf796a193ccd9f83047bb5fc) C:\WINDOWS\system32\DRIVERS\rasirda.sys 2010/08/06 15:00:52.0984 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 2010/08/06 15:00:53.0046 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys 2010/08/06 15:00:53.0109 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys 2010/08/06 15:00:53.0156 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys 2010/08/06 15:00:53.0203 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 2010/08/06 15:00:53.0265 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys 2010/08/06 15:00:53.0328 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys 2010/08/06 15:00:53.0421 redbook (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys 2010/08/06 15:00:53.0500 sbp2port (b244960e5a1db8e9d5d17086de37c1e4) C:\WINDOWS\system32\DRIVERS\sbp2port.sys 2010/08/06 15:00:53.0578 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys 2010/08/06 15:00:53.0625 Sentinel (7e5c2c58fc4e3862e7bf88bfb809a9b0) C:\WINDOWS\System32\Drivers\SENTINEL.SYS 2010/08/06 15:00:53.0703 serenum (5944622925d74268228222298e14dcaa) C:\WINDOWS\system32\DRIVERS\serenum.sys 2010/08/06 15:00:53.0796 Serial (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\DRIVERS\serial.sys 2010/08/06 15:00:53.0859 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\DRIVERS\sfloppy.sys 2010/08/06 15:00:53.0906 sfng32 (76bd55922b3179fa7b5bd528839e6fb4) C:\WINDOWS\system32\drivers\sfng32.sys 2010/08/06 15:00:54.0015 snapman380 (5ce1cf27620b144e212d407cdb14d339) C:\WINDOWS\system32\DRIVERS\snman380.sys 2010/08/06 15:00:54.0109 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys 2010/08/06 15:00:54.0171 sptd (71e276f6d189413266ea22171806597b) C:\WINDOWS\System32\Drivers\sptd.sys 2010/08/06 15:00:54.0203 sr (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys 2010/08/06 15:00:54.0250 Srv (89220b427890aa1dffd1a02648ae51c3) C:\WINDOWS\system32\DRIVERS\srv.sys 2010/08/06 15:00:54.0343 STHDA (527fd7d6919734c2a61c8aa3d5740e61) C:\WINDOWS\system32\drivers\sthda.sys 2010/08/06 15:00:54.0437 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys 2010/08/06 15:00:54.0468 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys 2010/08/06 15:00:54.0640 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys 2010/08/06 15:00:54.0703 szkg5 (8fe4ecc7877fcfe4e59414708898073d) C:\WINDOWS\system32\DRIVERS\szkg.sys 2010/08/06 15:00:54.0750 szkgfs (410a02a920fa9daeec56364e839597c1) C:\WINDOWS\system32\drivers\szkgfs.sys 2010/08/06 15:00:54.0828 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys 2010/08/06 15:00:54.0890 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys 2010/08/06 15:00:54.0937 tdrpman147 (be7b1a73272648622b39be3c610e3ca0) C:\WINDOWS\system32\DRIVERS\tdrpm147.sys 2010/08/06 15:00:54.0984 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys 2010/08/06 15:00:55.0031 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys 2010/08/06 15:00:55.0093 tifsfilter (6dcb8ddb481cd3c40fa68593723b4d89) C:\WINDOWS\system32\DRIVERS\tifsfilt.sys 2010/08/06 15:00:55.0140 timounter (394fc70b88b7958fa85798bbc76d140a) C:\WINDOWS\system32\DRIVERS\timntr.sys 2010/08/06 15:00:55.0296 Trufos (b16d66a71de03285e14e9f165b59eda4) C:\Programme\Gemeinsame Dateien\BitDefender\BitDefender Threat Scanner\trufos.sys 2010/08/06 15:00:55.0343 TSMPacket (7c1367bff5587cf49c0ed2e664f6eac0) C:\WINDOWS\system32\DRIVERS\tsmpkt.sys 2010/08/06 15:00:55.0421 TuneUpUtilitiesDrv (f2107c9d85ec0df116939ccce06ae697) C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys 2010/08/06 15:00:55.0484 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys 2010/08/06 15:00:55.0625 UltraMonUtility (5a5bd0f66e84eb039cb227520d49908c) C:\Programme\Gemeinsame Dateien\Realtime Soft\UltraMonMirrorDrv\x32\UltraMonUtility.sys 2010/08/06 15:00:55.0671 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys 2010/08/06 15:00:55.0718 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys 2010/08/06 15:00:55.0750 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys 2010/08/06 15:00:55.0796 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys 2010/08/06 15:00:55.0843 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys 2010/08/06 15:00:55.0906 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys 2010/08/06 15:00:55.0953 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys 2010/08/06 15:00:56.0000 usbser (1c888b000c2f9492f4b15b5b6b84873e) C:\WINDOWS\system32\DRIVERS\usbser.sys 2010/08/06 15:00:56.0015 usbstor (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 2010/08/06 15:00:56.0093 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys 2010/08/06 15:00:56.0140 VClone (9bf2ea54e5ed5acdf96f1dec84c117c4) C:\WINDOWS\system32\DRIVERS\VClone.sys 2010/08/06 15:00:56.0218 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys 2010/08/06 15:00:56.0328 VolSnap (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys 2010/08/06 15:00:56.0390 wacommousefilter (427a8bc96f16c40df81c2d2f4edd32dd) C:\WINDOWS\system32\DRIVERS\wacommousefilter.sys 2010/08/06 15:00:56.0437 wacomvhid (73e6f16a1f187d71fb26af308551e54a) C:\WINDOWS\system32\DRIVERS\wacomvhid.sys 2010/08/06 15:00:56.0484 WacomVKHid (889459833432b161cb99cfdf84a1a9bb) C:\WINDOWS\system32\DRIVERS\WacomVKHid.sys 2010/08/06 15:00:56.0562 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys 2010/08/06 15:00:56.0609 Wdf01000 (bbcfeab7e871cddac2d397ee7fa91fdc) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys 2010/08/06 15:00:56.0734 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys 2010/08/06 15:00:56.0781 WinDriver6 (2c7d830e86b378771af5dafeae428a09) C:\WINDOWS\system32\drivers\windrvr6.sys 2010/08/06 15:00:56.0875 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys 2010/08/06 15:00:56.0890 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys 2010/08/06 15:00:57.0000 ================================================================================ 2010/08/06 15:00:57.0000 Scan finished 2010/08/06 15:00:57.0000 ================================================================================ |
|
06.08.2010, 13:38
| #3 |
| | Windows friert ein, Firefox öffnet willkürlich Fenster ( in Flensburg) Auf diesem Rechner hatte ich mal Virtual CD Ver. 5 installiert (im Rahmen der Fehlersuche vor der Zeit hier auf dem Trojanerboard seitdem deinstalliert). Auf einem anderen Rechner hat Kaspersky tatsächlich eine Datei namens vbev5mp.sys als verdächtig eingestuft. In diesem Fall weiß ich, dass die zu Virtual CD gehört.
__________________Ich mache jetzt die empfohlene Defogger-Aufgabe. Übrigens: Bis jetzt hat Firefox keine ungewollten Aktionen gestartet. |
|
06.08.2010, 13:52
| #4 |
| | Windows friert ein, Firefox öffnet willkürlich Fenster ( in Flensburg) defogger_disable by jpshortstuff (23.02.10.1) Log created at 14:40 on 06/08/2010 (xxx name) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... Unable to read sptd.sys SPTD -> Disabled (Service running -> reboot required) -=E.O.F=- |
|
06.08.2010, 15:12
| #5 |
| /// Malware-holic   | Windows friert ein, Firefox öffnet willkürlich Fenster ( in Flensburg) irgendwie fehlt da das ergebniss, sehe nicht ob er was gefunden hatt, ists immernoch langsam? wenn ja müssen wir die dateien eben anders austauschen |
|
06.08.2010, 16:58
| #6 |
| | Windows friert ein, Firefox öffnet willkürlich Fenster ( in Flensburg) Hallo MarkusG, also die Geschwindigkeit des Computers kommt wir vor wie ein frisch installiertes Windows (selbst wenn ich meine üblichen Autostartprogramme für meine Arbeit einschalte) und eingefroren ist er nach dem Combofix-Lauf nicht mehr (hatte ich oben auch kurz erwähnt). Lange braucht STOPzilla bis es nach Erscheinen des Desktop meldet; aber ich kann bereits arbeiten, d.h. andere Programme aufrufen. STOPzilla meckert natürlich immer noch irgendwas an, was vmtl. mit den GMER, OTF u.a. Installationen zu tun hat. Bisher hat auch Firefox kein weiteres Fenster ungewollt geöffnet. Können/müssen wir noch irgendwas tun? Beste Grüße, Gerhard |
|
06.08.2010, 18:17
| #7 |
| /// Malware-holic | Windows friert ein, Firefox öffnet willkürlich Fenster ( in Flensburg) wenn du mir noch sagst was "irgendwas" ist, kann ich dir vllt sagen ob alles io ist. also was genau meckert stopzilla an |
|
06.08.2010, 19:05
| #8 |
| | Windows friert ein, Firefox öffnet willkürlich Fenster ( in Flensburg) Hallo, das würde ich gerne! Aber:  ALARM:Ich starte den Desktop PC gerade und was ist: Eingefroren! Somit auch kein Zugang zu STOPzilla. Während unseres gesamten Kontakts hier ist das nach dem Combofix-Lauf nicht einmal aufgetreten. Ich muss jetzt wieder über den On-Schalter einen Hardware Reset machen, weil auch SHIFT-ALT-ENT keinen Taskmanager aufruft. Jetzt steht mir aber langsam der Angstschweiß auf der Stirn. |
|
06.08.2010, 19:14
| #9 |
| /// Malware-holic | Windows friert ein, Firefox öffnet willkürlich Fenster ( in Flensburg) wir könnten auch ne saubere neu instalation machen wenn du willst, ich zeig dir dann, wie du den pc ohne viel aufwand absicherst, da ist malware freiheit schon fast garantiert :-) |
|
06.08.2010, 19:21
| #10 |
| | Windows friert ein, Firefox öffnet willkürlich Fenster ( in Flensburg) Davor habe ich mich schon seit mehr als einer Woche gefürchtet. Es ist nicht die Neuinstallation an sich, sondern die vielen individuellen Programme, Geräte, Anschlüsse und Einstellungen danach. Gibt es wirklich keine andere Möglichkeit? Verzweifelte Grüße, Gerhard |
|
06.08.2010, 19:27
| #11 |
| | Windows friert ein, Firefox öffnet willkürlich Fenster ( in Flensburg) So nun habe ich wieder neu gestartet und DesktopPC tut wieder so als wär nix gewesen. STOPzilla meldet z.B. als erste von 55 "Infections": GASF Type: Trojan Element: File Location: C:\combofix\mbr.cfxxe und weiteres. Ich mach mal screenshots davon, denn eine Reportmöglichkeit gibt's offensichtlich nicht. Soll ich Combofix, Hijack usw mal deinstallieren, um zu sehen ob STOPzilla dann Ruhe gibt oder soll ich STOPzilla deinstallieren und lieber Malwarebytes' Antimalware-Vollversion benutzen? |
|
06.08.2010, 19:32
| #12 |
| | Windows friert ein, Firefox öffnet willkürlich Fenster ( in Flensburg) Hier das Eventlog von STOzilla: Block/Extraction NT Service enforcer 2010-08-06 20:20:58 Disabled service: messenger - Information Internet ExplorerSiteguard 2010-08-06 20:20:57 Inspecting registered Internet Explorer toolbars Block/Extraction Registry enforcer 2010-08-06 20:20:57 Deleting WinLogon registry Information Registry enforcer 2010-08-06 20:20:57 Inspecting registered Explorer bars Information Registry enforcer 2010-08-06 20:20:50 Inspecting WinLogon notification handlers and modules loaded by WinLogon Information Registry enforcer 2010-08-06 20:20:50 Inspecting WinSock registry (LSP Chain) Information Registry enforcer 2010-08-06 20:20:49 Inspecting registered Browser Helper Objects (BHOs) Information Home page protection 2010-08-06 20:20:44 Checking homepage... OK Block/Extraction NT Service enforcer 2010-08-06 20:20:41 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 20:20:38 Disabled service: messenger - Information Process enforcer 2010-08-06 20:20:36 Starting process watcher Block/Extraction NT Service enforcer 2010-08-06 18:31:42 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 18:31:25 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 18:31:25 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 17:43:10 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 17:43:10 Disabled service: messenger - Information Home page protection 2010-08-06 17:41:27 Checking homepage... OK Block/Extraction NT Service enforcer 2010-08-06 17:41:21 Disabled service: messenger - Block/Extraction Registry enforcer 2010-08-06 17:41:20 Deleting WinLogon registry Information Internet ExplorerSiteguard 2010-08-06 17:41:19 Inspecting registered Internet Explorer toolbars Information Registry enforcer 2010-08-06 17:41:19 Inspecting registered Explorer bars Information Registry enforcer 2010-08-06 17:41:12 Inspecting WinLogon notification handlers and modules loaded by WinLogon Information Registry enforcer 2010-08-06 17:41:11 Inspecting WinSock registry (LSP Chain) Information Registry enforcer 2010-08-06 17:41:11 Inspecting registered Browser Helper Objects (BHOs) Block/Extraction NT Service enforcer 2010-08-06 17:41:05 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 17:41:01 Disabled service: messenger - Information Process enforcer 2010-08-06 17:41:00 Starting process watcher Block/Extraction NT Service enforcer 2010-08-06 15:36:32 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 15:36:15 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 15:36:15 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 15:03:16 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 15:03:16 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 15:03:16 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 15:03:16 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 15:00:42 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 15:00:41 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 15:00:39 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 15:00:39 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 14:58:47 Disabled service: messenger - Block/Extraction Registry enforcer 2010-08-06 14:58:44 Deleting WinLogon registry Information Internet ExplorerSiteguard 2010-08-06 14:58:44 Inspecting registered Internet Explorer toolbars Information Registry enforcer 2010-08-06 14:58:44 Inspecting registered Explorer bars Information Registry enforcer 2010-08-06 14:58:39 Inspecting WinLogon notification handlers and modules loaded by WinLogon Information Registry enforcer 2010-08-06 14:58:39 Inspecting WinSock registry (LSP Chain) Information Registry enforcer 2010-08-06 14:58:38 Inspecting registered Browser Helper Objects (BHOs) Information Home page protection 2010-08-06 14:58:38 Checking homepage... OK Block/Extraction NT Service enforcer 2010-08-06 14:58:27 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 14:58:21 Disabled service: messenger - Information Process enforcer 2010-08-06 14:58:21 Starting process watcher Block/Extraction NT Service enforcer 2010-08-06 14:56:09 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 14:52:41 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 14:52:41 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 14:45:54 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 14:45:54 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 14:44:16 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 14:44:16 Disabled service: messenger - Information Home page protection 2010-08-06 14:43:56 Checking homepage... OK Block/Extraction NT Service enforcer 2010-08-06 14:43:53 Disabled service: messenger - Information Internet ExplorerSiteguard 2010-08-06 14:43:49 Inspecting registered Internet Explorer toolbars Information Registry enforcer 2010-08-06 14:43:49 Inspecting registered Explorer bars Block/Extraction Registry enforcer 2010-08-06 14:43:49 Deleting WinLogon registry Information Registry enforcer 2010-08-06 14:43:42 Inspecting WinLogon notification handlers and modules loaded by WinLogon Information Registry enforcer 2010-08-06 14:43:42 Inspecting WinSock registry (LSP Chain) Information Registry enforcer 2010-08-06 14:43:42 Inspecting registered Browser Helper Objects (BHOs) Block/Extraction NT Service enforcer 2010-08-06 14:43:32 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 14:43:28 Disabled service: messenger - Information Process enforcer 2010-08-06 14:43:28 Starting process watcher Block/Extraction NT Service enforcer 2010-08-06 14:41:12 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 14:41:11 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 14:40:18 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 14:40:18 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 14:39:03 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 14:39:02 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 14:24:39 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 14:24:39 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 14:23:57 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 14:23:57 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 14:12:40 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 14:12:39 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 14:12:24 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 14:12:24 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 14:07:11 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 14:07:11 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 14:03:12 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 14:03:12 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:50:55 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:50:55 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:47:57 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:47:57 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:47:56 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:47:56 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:47:02 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:47:02 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:46:20 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:46:20 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:46:19 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:46:19 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:43:26 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:43:26 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:40:16 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:40:16 Disabled service: messenger - Information Home page protection 2010-08-06 13:38:18 Checking homepage... OK Block/Extraction NT Service enforcer 2010-08-06 13:38:14 Disabled service: messenger - Block/Extraction Registry enforcer 2010-08-06 13:38:11 Deleting WinLogon registry Information Internet ExplorerSiteguard 2010-08-06 13:38:10 Inspecting registered Internet Explorer toolbars Information Registry enforcer 2010-08-06 13:38:10 Inspecting registered Explorer bars Information Registry enforcer 2010-08-06 13:38:00 Inspecting WinLogon notification handlers and modules loaded by WinLogon Information Registry enforcer 2010-08-06 13:37:59 Inspecting WinSock registry (LSP Chain) Information Registry enforcer 2010-08-06 13:37:59 Inspecting registered Browser Helper Objects (BHOs) Block/Extraction NT Service enforcer 2010-08-06 13:37:50 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:37:45 Disabled service: messenger - Information Process enforcer 2010-08-06 13:37:44 Starting process watcher Block/Extraction NT Service enforcer 2010-08-06 13:35:36 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:35:36 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:34:11 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:34:11 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:33:42 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:33:42 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:32:48 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:32:48 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:32:46 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:32:46 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:32:09 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:32:09 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:31:44 Disabled service: messenger - Block/Extraction Registry enforcer 2010-08-06 13:31:40 Deleting WinLogon registry Information Internet ExplorerSiteguard 2010-08-06 13:31:40 Inspecting registered Internet Explorer toolbars Information Registry enforcer 2010-08-06 13:31:40 Inspecting registered Explorer bars Information Registry enforcer 2010-08-06 13:31:33 Inspecting WinLogon notification handlers and modules loaded by WinLogon Information Registry enforcer 2010-08-06 13:31:33 Inspecting WinSock registry (LSP Chain) Information Registry enforcer 2010-08-06 13:31:32 Inspecting registered Browser Helper Objects (BHOs) Information Home page protection 2010-08-06 13:31:28 Checking homepage... OK Block/Extraction NT Service enforcer 2010-08-06 13:31:23 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:31:20 Disabled service: messenger - Information Process enforcer 2010-08-06 13:31:19 Starting process watcher Block/Extraction NT Service enforcer 2010-08-06 13:28:48 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:28:47 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:28:29 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:28:29 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:28:26 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:28:26 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:28:14 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:28:13 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:08:07 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:08:07 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:07:55 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:07:55 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:06:05 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:06:05 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:01:25 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:01:25 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:00:27 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 13:00:27 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 12:54:44 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 12:54:43 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 12:51:15 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 12:51:15 Disabled service: messenger - Information Home page protection 2010-08-06 12:48:20 Checking homepage... OK Block/Extraction NT Service enforcer 2010-08-06 12:48:17 Disabled service: messenger - Block/Extraction Registry enforcer 2010-08-06 12:48:12 Deleting WinLogon registry Information Internet ExplorerSiteguard 2010-08-06 12:48:11 Inspecting registered Internet Explorer toolbars Information Registry enforcer 2010-08-06 12:48:11 Inspecting registered Explorer bars Block/Extraction NT Service enforcer 2010-08-06 12:48:03 Disabled service: messenger - Information Registry enforcer 2010-08-06 12:47:57 Inspecting WinSock registry (LSP Chain) Information Registry enforcer 2010-08-06 12:47:57 Inspecting WinLogon notification handlers and modules loaded by WinLogon Information Registry enforcer 2010-08-06 12:47:57 Inspecting registered Browser Helper Objects (BHOs) Block/Extraction NT Service enforcer 2010-08-06 12:47:41 Disabled service: messenger - Information Process enforcer 2010-08-06 12:47:40 Starting process watcher Block/Extraction NT Service enforcer 2010-08-06 10:57:55 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 10:57:54 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 09:23:48 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 09:23:48 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 08:50:18 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 08:50:18 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 08:49:06 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 08:49:06 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 08:42:24 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 08:42:24 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 08:40:00 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 08:40:00 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 08:34:59 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 08:34:59 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 08:34:04 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 08:34:04 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 08:32:04 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 08:32:04 Disabled service: messenger - Information Home page protection 2010-08-06 08:30:28 Checking homepage... OK Block/Extraction NT Service enforcer 2010-08-06 08:30:20 Disabled service: messenger - Block/Extraction Registry enforcer 2010-08-06 08:30:18 Deleting WinLogon registry Information Internet ExplorerSiteguard 2010-08-06 08:30:18 Inspecting registered Internet Explorer toolbars Information Registry enforcer 2010-08-06 08:30:18 Inspecting registered Explorer bars Information Registry enforcer 2010-08-06 08:30:14 Inspecting WinLogon notification handlers and modules loaded by WinLogon Information Registry enforcer 2010-08-06 08:30:11 Inspecting WinSock registry (LSP Chain) Information Registry enforcer 2010-08-06 08:30:11 Inspecting registered Browser Helper Objects (BHOs) Block/Extraction NT Service enforcer 2010-08-06 08:30:03 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 08:29:58 Disabled service: messenger - Information Process enforcer 2010-08-06 08:29:57 Starting process watcher Block/Extraction NT Service enforcer 2010-08-06 08:27:28 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 08:27:28 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 08:27:25 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 08:27:25 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 08:27:11 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 08:27:11 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 08:18:48 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 08:18:48 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 08:16:53 Disabled service: messenger - Block/Extraction Registry enforcer 2010-08-06 08:16:51 Deleting WinLogon registry Information Internet ExplorerSiteguard 2010-08-06 08:16:50 Inspecting registered Internet Explorer toolbars Information Registry enforcer 2010-08-06 08:16:50 Inspecting registered Explorer bars Information Registry enforcer 2010-08-06 08:16:46 Inspecting WinLogon notification handlers and modules loaded by WinLogon Information Registry enforcer 2010-08-06 08:16:46 Inspecting WinSock registry (LSP Chain) Information Registry enforcer 2010-08-06 08:16:46 Inspecting registered Browser Helper Objects (BHOs) Information Home page protection 2010-08-06 08:16:46 Checking homepage... OK Block/Extraction NT Service enforcer 2010-08-06 08:16:36 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 08:16:32 Disabled service: messenger - Information Process enforcer 2010-08-06 08:16:31 Starting process watcher Block/Extraction NT Service enforcer 2010-08-06 06:22:56 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 06:22:31 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 06:16:54 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 06:14:15 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 22:54:16 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 22:54:16 Disabled service: messenger - Information Home page protection 2010-08-05 22:50:33 Checking homepage... OK Block/Extraction NT Service enforcer 2010-08-05 22:50:31 Disabled service: messenger - Block/Extraction Registry enforcer 2010-08-05 22:50:29 Deleting WinLogon registry Information Internet ExplorerSiteguard 2010-08-05 22:50:28 Inspecting registered Internet Explorer toolbars Information Registry enforcer 2010-08-05 22:50:28 Inspecting registered Explorer bars Information Registry enforcer 2010-08-05 22:50:22 Inspecting WinLogon notification handlers and modules loaded by WinLogon Information Registry enforcer 2010-08-05 22:50:21 Inspecting WinSock registry (LSP Chain) Information Registry enforcer 2010-08-05 22:50:21 Inspecting registered Browser Helper Objects (BHOs) Block/Extraction NT Service enforcer 2010-08-05 22:50:16 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 22:50:13 Disabled service: messenger - Information Process enforcer 2010-08-05 22:50:12 Starting process watcher Block/Extraction NT Service enforcer 2010-08-05 22:33:39 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 22:33:39 Disabled service: messenger - Block/Extraction File enforcer 2010-08-05 22:32:45 Deleted file: c:\dokume~1\gerhar~1\lokale~1\temp\pxlyypow.sys Block/Extraction NT Service enforcer 2010-08-05 22:32:44 Disabled service: messenger - Block/Extraction File enforcer 2010-08-05 22:32:43 Suppressed file: c:\dokume~1\gerhar~1\lokale~1\temp\pxlyypow.sys Block/Extraction NT Service enforcer 2010-08-05 22:32:43 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 22:31:14 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 22:31:14 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 22:31:10 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 22:31:10 Disabled service: messenger - Block/Extraction Registry enforcer 2010-08-05 22:29:27 Deleting WinLogon registry Information Internet ExplorerSiteguard 2010-08-05 22:29:27 Inspecting registered Internet Explorer toolbars Information Registry enforcer 2010-08-05 22:29:27 Inspecting registered Explorer bars Information Registry enforcer 2010-08-05 22:29:21 Inspecting WinLogon notification handlers and modules loaded by WinLogon Information Registry enforcer 2010-08-05 22:29:21 Inspecting WinSock registry (LSP Chain) Information Registry enforcer 2010-08-05 22:29:21 Inspecting registered Browser Helper Objects (BHOs) Block/Extraction NT Service enforcer 2010-08-05 22:29:18 Disabled service: messenger - Information Home page protection 2010-08-05 22:29:16 Checking homepage... OK Block/Extraction NT Service enforcer 2010-08-05 22:29:10 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 22:29:10 Disabled service: messenger - Information Process enforcer 2010-08-05 22:29:08 Starting process watcher Block/Extraction NT Service enforcer 2010-08-05 14:30:23 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 14:29:17 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 14:29:16 Removed service: pxlyypow - Block/Extraction Registry enforcer 2010-08-05 14:29:14 Extracted registry key HKLM\SYSTEM\CurrentControlSet\Services\pxlyypow Block/Extraction File enforcer 2010-08-05 14:29:13 Deleted file: c:\dokume~1\gerhar~1\lokale~1\temp\pxlyypow.sys Block/Extraction Registry enforcer 2010-08-05 14:29:11 Extracted registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PXLYYPOW Block/Extraction NT Service enforcer 2010-08-05 14:29:11 Disabled service: messenger - Block/Extraction File enforcer 2010-08-05 14:29:11 Quarantined file: c:\dokume~1\gerhar~1\lokale~1\temp\pxlyypow.sys Block/Extraction NT Service enforcer 2010-08-05 14:27:27 Disabled service: messenger - Block/Extraction Registry enforcer 2010-08-05 14:27:26 Deleting WinLogon registry Information Internet ExplorerSiteguard 2010-08-05 14:27:26 Inspecting registered Internet Explorer toolbars Information Registry enforcer 2010-08-05 14:27:26 Inspecting registered Explorer bars Information Registry enforcer 2010-08-05 14:27:18 Inspecting WinLogon notification handlers and modules loaded by WinLogon Information Registry enforcer 2010-08-05 14:27:18 Inspecting WinSock registry (LSP Chain) Information Registry enforcer 2010-08-05 14:27:18 Inspecting registered Browser Helper Objects (BHOs) Information Home page protection 2010-08-05 14:27:18 Checking homepage... OK Block/Extraction NT Service enforcer 2010-08-05 14:26:56 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 14:26:51 Disabled service: messenger - Information Process enforcer 2010-08-05 14:26:49 Starting process watcher Block/Extraction NT Service enforcer 2010-08-05 14:23:41 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 14:23:41 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 14:23:28 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 14:23:28 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 14:22:49 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 14:22:49 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 14:16:54 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 14:16:54 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 14:15:00 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 14:15:00 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 14:11:04 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 14:11:04 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 14:10:28 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 14:10:28 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 14:10:10 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 14:10:10 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 14:07:42 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 14:07:42 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 14:05:08 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 14:05:08 Disabled service: messenger - Information Internet ExplorerSiteguard 2010-08-05 14:03:21 Inspecting registered Internet Explorer toolbars Block/Extraction Registry enforcer 2010-08-05 14:03:21 Deleting WinLogon registry Information Registry enforcer 2010-08-05 14:03:21 Inspecting registered Explorer bars Block/Extraction NT Service enforcer 2010-08-05 14:03:18 Disabled service: messenger - Information Registry enforcer 2010-08-05 14:03:17 Inspecting WinLogon notification handlers and modules loaded by WinLogon Information Registry enforcer 2010-08-05 14:03:17 Inspecting WinSock registry (LSP Chain) Information Registry enforcer 2010-08-05 14:03:16 Inspecting registered Browser Helper Objects (BHOs) Information Home page protection 2010-08-05 14:03:11 Checking homepage... OK Block/Extraction NT Service enforcer 2010-08-05 14:03:07 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 14:03:03 Disabled service: messenger - Information Process enforcer 2010-08-05 14:03:03 Starting process watcher Block/Extraction NT Service enforcer 2010-08-05 10:32:17 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 10:32:17 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 10:31:56 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 10:31:56 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 10:29:04 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 10:29:04 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-05 10:27:12 Disabled service: messenger - Block/Extraction Home page protection 2010-08-05 10:27:07 Resetting Homepage back to www.sach-fach.de Block/Extraction Registry enforcer 2010-08-05 10:27:02 Deleting WinLogon registry Information Internet ExplorerSiteguard 2010-08-05 10:27:02 Inspecting registered Internet Explorer toolbars Information Registry enforcer 2010-08-05 10:27:02 Inspecting registered Explorer bars Block/Extraction NT Service enforcer 2010-08-05 10:27:01 Disabled service: messenger - Information Registry enforcer 2010-08-05 10:26:55 Inspecting WinLogon notification handlers and modules loaded by WinLogon Information Registry enforcer 2010-08-05 10:26:55 Inspecting WinSock registry (LSP Chain) Information Registry enforcer 2010-08-05 10:26:54 Inspecting registered Browser Helper Objects (BHOs) Block/Extraction NT Service enforcer 2010-08-05 10:26:44 Disabled service: messenger - Information Process enforcer 2010-08-05 10:26:43 Starting process watcher Block/Extraction NT Service enforcer 2010-08-04 23:35:37 Disabled service: messenger - Information Registry enforcer 2010-08-04 23:23:01 Inspecting WinSock registry (LSP Chain) Information Registry enforcer 2010-08-04 23:23:00 Inspecting WinSock registry (LSP Chain) Information Internet ExplorerSiteguard 2010-08-04 23:23:00 Inspecting registered Internet Explorer toolbars Information Registry enforcer 2010-08-04 23:23:00 Inspecting registered Explorer bars Information Registry enforcer 2010-08-04 23:23:00 Inspecting WinSock registry (LSP Chain) Information Registry enforcer 2010-08-04 23:23:00 Inspecting registered Browser Helper Objects (BHOs) Block/Extraction NT Service enforcer 2010-08-04 23:22:56 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 23:22:56 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 23:22:55 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 23:22:55 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 23:22:54 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 23:22:52 Disabled service: messenger - Information General 2010-08-04 23:22:52 Anti-Virus definition update 12.62.3.0 successfully applied. Information General 2010-08-04 23:22:50 Request to update definitions completed successfully. Information General 2010-08-04 23:22:46 Anti-Spyware Incremental definition update 5.0.71.9 successfully applied. Information General 2010-08-04 23:22:45 Anti-Spyware Incremental definition update 5.0.71.8 successfully applied. Block/Extraction NT Service enforcer 2010-08-04 23:04:09 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 23:04:09 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 22:57:45 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 22:57:33 Disabled service: messenger - Block/Extraction Registry enforcer 2010-08-04 22:57:32 Deleting WinLogon registry Information Internet ExplorerSiteguard 2010-08-04 22:57:32 Inspecting registered Internet Explorer toolbars Information Registry enforcer 2010-08-04 22:57:32 Inspecting registered Explorer bars Information Registry enforcer 2010-08-04 22:57:27 Inspecting WinLogon notification handlers and modules loaded by WinLogon Information Registry enforcer 2010-08-04 22:57:26 Inspecting WinSock registry (LSP Chain) Information Registry enforcer 2010-08-04 22:57:26 Inspecting registered Browser Helper Objects (BHOs) Block/Extraction NT Service enforcer 2010-08-04 22:57:15 Disabled service: messenger - Information Process enforcer 2010-08-04 22:57:14 Starting process watcher Block/Extraction NT Service enforcer 2010-08-04 22:23:55 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 22:23:55 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 22:23:42 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 22:23:42 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 22:16:28 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 22:16:28 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 21:58:10 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 21:58:10 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 21:57:16 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 21:57:16 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 21:36:09 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 21:36:09 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 20:30:03 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 20:30:03 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 20:28:38 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 20:28:38 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 20:28:17 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 20:28:17 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 20:28:01 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 20:28:01 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 20:24:58 Disabled service: messenger - Block/Extraction Registry enforcer 2010-08-04 20:24:50 Deleting WinLogon registry Information Internet ExplorerSiteguard 2010-08-04 20:24:49 Inspecting registered Internet Explorer toolbars Information Registry enforcer 2010-08-04 20:24:49 Inspecting registered Explorer bars Block/Extraction NT Service enforcer 2010-08-04 20:24:48 Disabled service: messenger - Information Registry enforcer 2010-08-04 20:24:45 Inspecting WinLogon notification handlers and modules loaded by WinLogon Information Registry enforcer 2010-08-04 20:24:45 Inspecting WinSock registry (LSP Chain) Information Registry enforcer 2010-08-04 20:24:44 Inspecting registered Browser Helper Objects (BHOs) Block/Extraction NT Service enforcer 2010-08-04 20:24:33 Disabled service: messenger - Information Process enforcer 2010-08-04 20:24:32 Starting process watcher Block/Extraction NT Service enforcer 2010-08-04 20:22:08 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 20:22:06 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 20:18:01 Removed driver: c:\dokumente und einstellungen\gerhard ott\lokale einstellungen\temp\catchme.sys Block/Extraction NT Service enforcer 2010-08-04 20:18:01 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 20:18:01 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 20:17:59 Removed driver: c:\dokumente und einstellungen\gerhard ott\lokale einstellungen\temp\catchme.sys Block/Extraction NT Service enforcer 2010-08-04 20:17:58 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 20:17:58 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 19:33:12 Removed driver: c:\dokumente und einstellungen\gerhard ott\lokale einstellungen\temp\catchme.sys Block/Extraction NT Service enforcer 2010-08-04 19:33:12 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 19:33:12 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 18:46:52 Removed driver: c:\dokumente und einstellungen\gerhard ott\lokale einstellungen\temp\catchme.sys Block/Extraction NT Service enforcer 2010-08-04 18:46:51 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 18:46:51 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 18:37:37 Removed driver: c:\dokumente und einstellungen\gerhard ott\lokale einstellungen\temp\catchme.sys Block/Extraction NT Service enforcer 2010-08-04 18:37:37 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 18:37:37 Disabled service: messenger - Block/Extraction Registry enforcer 2010-08-04 18:37:36 Deleted registry value system in hklm\software\microsoft\windows nt\currentversion\winlogon Block/Extraction Registry enforcer 2010-08-04 18:37:36 Deleted registry value DisableRegistryTools in hklm\software\microsoft\windows\currentversion\policies\system Warning/Detection COM enforcer 2010-08-04 18:37:36 Detected malicious registry entry DisableRegistryTools in hklm\software\microsoft\windows\currentversion\policies\system Block/Extraction NT Service enforcer 2010-08-04 18:37:36 Removed driver: c:\dokumente und einstellungen\gerhard ott\lokale einstellungen\temp\catchme.sys Block/Extraction NT Service enforcer 2010-08-04 18:37:36 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 18:37:36 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 18:37:19 Removed driver: c:\dokumente und einstellungen\gerhard ott\lokale einstellungen\temp\catchme.sys Block/Extraction NT Service enforcer 2010-08-04 18:37:19 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 18:37:19 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 18:32:59 Removed driver: c:\dokumente und einstellungen\gerhard ott\lokale einstellungen\temp\catchme.sys Block/Extraction NT Service enforcer 2010-08-04 18:32:59 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 18:32:59 Disabled service: messenger - Block/Extraction Registry enforcer 2010-08-04 18:32:58 Deleted registry value system in hklm\software\microsoft\windows nt\currentversion\winlogon Block/Extraction Registry enforcer 2010-08-04 18:32:58 Deleted registry value DisableRegistryTools in hklm\software\microsoft\windows\currentversion\policies\system Warning/Detection COM enforcer 2010-08-04 18:32:58 Detected malicious registry entry DisableRegistryTools in hklm\software\microsoft\windows\currentversion\policies\system Block/Extraction NT Service enforcer 2010-08-04 18:32:57 Removed driver: c:\dokumente und einstellungen\gerhard ott\lokale einstellungen\temp\catchme.sys Block/Extraction NT Service enforcer 2010-08-04 18:32:57 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 18:32:56 Disabled service: messenger - Block/Extraction File enforcer 2010-08-04 18:32:54 Deleted file: c:\windows\mbr.exe Block/Extraction Process enforcer 2010-08-04 18:32:53 Terminated process: (2548) c:\windows\mbr.exe Block/Extraction File enforcer 2010-08-04 18:32:53 Quarantined file: c:\windows\mbr.exe Block/Extraction NT Service enforcer 2010-08-04 18:32:49 Removed driver: c:\dokumente und einstellungen\gerhard ott\lokale einstellungen\temp\catchme.sys Block/Extraction NT Service enforcer 2010-08-04 18:32:49 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 18:32:48 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 18:32:42 Removed driver: c:\dokumente und einstellungen\gerhard ott\lokale einstellungen\temp\catchme.sys Block/Extraction Registry enforcer 2010-08-04 18:32:42 Deleted registry value DisableRegistryTools in hklm\software\microsoft\windows\currentversion\policies\system Warning/Detection COM enforcer 2010-08-04 18:32:42 Detected malicious registry entry DisableRegistryTools in hklm\software\microsoft\windows\currentversion\policies\system Block/Extraction Registry enforcer 2010-08-04 18:32:42 Deleted registry value system in hklm\software\microsoft\windows nt\currentversion\winlogon Block/Extraction NT Service enforcer 2010-08-04 18:32:42 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 18:32:41 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 18:32:37 Removed driver: c:\dokumente und einstellungen\gerhard ott\lokale einstellungen\temp\catchme.sys Block/Extraction NT Service enforcer 2010-08-04 18:32:37 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 18:32:37 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 18:25:43 Removed driver: c:\dokumente und einstellungen\gerhard ott\lokale einstellungen\temp\catchme.sys Block/Extraction NT Service enforcer 2010-08-04 18:25:43 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 18:25:43 Disabled service: messenger - Block/Extraction File enforcer 2010-08-04 18:25:42 Deleted file: c:\combofix\mbr.cfxxe Block/Extraction Process enforcer 2010-08-04 18:25:41 Terminated process: (1844) c:\combofix\mbr.cfxxe Block/Extraction File enforcer 2010-08-04 18:25:41 Quarantined file: c:\combofix\mbr.cfxxe Block/Extraction NT Service enforcer 2010-08-04 18:25:38 Removed driver: c:\dokumente und einstellungen\gerhard ott\lokale einstellungen\temp\catchme.sys Block/Extraction NT Service enforcer 2010-08-04 18:25:38 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 18:25:38 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 18:25:34 Removed driver: c:\dokumente und einstellungen\gerhard ott\lokale einstellungen\temp\catchme.sys Block/Extraction NT Service enforcer 2010-08-04 18:25:34 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 18:25:34 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 18:25:33 Removed service: catchme - Block/Extraction Registry enforcer 2010-08-04 18:25:29 Extracted registry key HKLM\SYSTEM\CurrentControlSet\Services\catchme Block/Extraction Registry enforcer 2010-08-04 18:25:27 Extracted registry key HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CATCHME Block/Extraction NT Service enforcer 2010-08-04 18:25:26 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 18:25:26 Disabled service: messenger - Block/Extraction File enforcer 2010-08-04 18:19:04 Deleted file: c:\windows\pev.exe Block/Extraction File enforcer 2010-08-04 18:19:02 Quarantined file: c:\windows\pev.exe Block/Extraction File enforcer 2010-08-04 18:18:49 Deleted file: c:\windows\pev.exe Block/Extraction File enforcer 2010-08-04 18:18:46 Quarantined file: c:\windows\pev.exe Block/Extraction Registry enforcer 2010-08-04 18:18:35 Deleted registry value disableregistrytools in hkus\S-1-5-21-3495212690-2977224712-3179768257-1006\software\microsoft\windows\currentversion\policies\system Warning/Detection COM enforcer 2010-08-04 18:18:35 Detected malicious registry entry disableregistrytools in hkus\S-1-5-21-3495212690-2977224712-3179768257-1006\software\microsoft\windows\currentversion\policies\system Block/Extraction Registry enforcer 2010-08-04 18:18:31 Deleted registry value disableregistrytools in hkus\S-1-5-21-3495212690-2977224712-3179768257-1006\software\microsoft\windows\currentversion\policies\system Warning/Detection COM enforcer 2010-08-04 18:18:31 Detected malicious registry entry disableregistrytools in hkus\S-1-5-21-3495212690-2977224712-3179768257-1006\software\microsoft\windows\currentversion\policies\system Block/Extraction NT Service enforcer 2010-08-04 18:18:26 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 18:18:25 Disabled service: messenger - Block/Extraction Registry enforcer 2010-08-04 18:18:08 Deleted registry value disableregistrytools in hkus\S-1-5-21-3495212690-2977224712-3179768257-1006\software\microsoft\windows\currentversion\policies\system Warning/Detection COM enforcer 2010-08-04 18:18:08 Detected malicious registry entry disableregistrytools in hkus\S-1-5-21-3495212690-2977224712-3179768257-1006\software\microsoft\windows\currentversion\policies\system Block/Extraction Registry enforcer 2010-08-04 18:17:50 Deleted registry value disableregistrytools in hkus\S-1-5-21-3495212690-2977224712-3179768257-1006\software\microsoft\windows\currentversion\policies\system Warning/Detection COM enforcer 2010-08-04 18:17:50 Detected malicious registry entry disableregistrytools in hkus\S-1-5-21-3495212690-2977224712-3179768257-1006\software\microsoft\windows\currentversion\policies\system Block/Extraction Registry enforcer 2010-08-04 18:17:42 Deleted registry value disableregistrytools in hkus\S-1-5-21-3495212690-2977224712-3179768257-1006\software\microsoft\windows\currentversion\policies\system Warning/Detection COM enforcer 2010-08-04 18:17:42 Detected malicious registry entry disableregistrytools in hkus\S-1-5-21-3495212690-2977224712-3179768257-1006\software\microsoft\windows\currentversion\policies\system Block/Extraction Registry enforcer 2010-08-04 18:17:40 Deleted registry value DisableRegistryTools in hkus\S-1-5-21-3495212690-2977224712-3179768257-1006\software\microsoft\windows\currentversion\policies\system Warning/Detection COM enforcer 2010-08-04 18:17:40 Detected malicious registry entry DisableRegistryTools in hkus\S-1-5-21-3495212690-2977224712-3179768257-1006\software\microsoft\windows\currentversion\policies\system Block/Extraction Registry enforcer 2010-08-04 18:17:40 Deleted registry value disableregistrytools in hkus\S-1-5-21-3495212690-2977224712-3179768257-1006\software\microsoft\windows\currentversion\policies\system Warning/Detection COM enforcer 2010-08-04 18:17:40 Detected malicious registry entry disableregistrytools in hkus\S-1-5-21-3495212690-2977224712-3179768257-1006\software\microsoft\windows\currentversion\policies\system Block/Extraction Registry enforcer 2010-08-04 18:10:57 Deleted registry value disableregistrytools in hkus\S-1-5-21-3495212690-2977224712-3179768257-1006\software\microsoft\windows\currentversion\policies\system Warning/Detection COM enforcer 2010-08-04 18:10:57 Detected malicious registry entry disableregistrytools in hkus\S-1-5-21-3495212690-2977224712-3179768257-1006\software\microsoft\windows\currentversion\policies\system Block/Extraction Registry enforcer 2010-08-04 18:08:33 Deleted registry value disableregistrytools in hkus\S-1-5-21-3495212690-2977224712-3179768257-1006\software\microsoft\windows\currentversion\policies\system Warning/Detection COM enforcer 2010-08-04 18:08:33 Detected malicious registry entry disableregistrytools in hkus\S-1-5-21-3495212690-2977224712-3179768257-1006\software\microsoft\windows\currentversion\policies\system Block/Extraction Registry enforcer 2010-08-04 18:08:26 Deleted registry value disableregistrytools in hkus\S-1-5-21-3495212690-2977224712-3179768257-1006\software\microsoft\windows\currentversion\policies\system Warning/Detection COM enforcer 2010-08-04 18:08:26 Detected malicious registry entry disableregistrytools in hkus\S-1-5-21-3495212690-2977224712-3179768257-1006\software\microsoft\windows\currentversion\policies\system Block/Extraction Registry enforcer 2010-08-04 18:08:24 Deleted registry value DisableRegistryTools in hkus\S-1-5-21-3495212690-2977224712-3179768257-1006\software\microsoft\windows\currentversion\policies\system Warning/Detection COM enforcer 2010-08-04 18:08:24 Detected malicious registry entry DisableRegistryTools in hkus\S-1-5-21-3495212690-2977224712-3179768257-1006\software\microsoft\windows\currentversion\policies\system Block/Extraction NT Service enforcer 2010-08-04 18:04:07 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 18:04:07 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 18:01:16 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 18:01:16 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 17:51:11 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 17:51:11 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 17:43:01 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 17:43:01 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 17:39:04 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 17:39:04 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 17:36:54 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 17:36:54 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 17:36:31 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 17:36:31 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 17:05:25 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 17:05:25 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 17:04:41 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 17:04:41 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 16:59:07 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 16:59:07 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 14:32:36 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 14:32:36 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 14:32:33 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 14:32:33 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-04 14:32:30 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 20:30:15 Disabled service: messenger - Block/Extraction NT Service enforcer 2010-08-06 20:30:15 Disabled service: messenger - |
|
06.08.2010, 19:36
| #13 |
| | Windows friert ein, Firefox öffnet willkürlich Fenster ( in Flensburg) Habe die Screenshots hochgeladen. |
|
06.08.2010, 19:32
| #14 |
| /// Malware-holic | Windows friert ein, Firefox öffnet willkürlich Fenster ( in Flensburg) deinstaliere mal stop zilla und instaliere es neu. reinige mit otcleanit: http://oldtimer.geekstogo.com/OTM.exe Klicke cleanup! dein pc wird evtl. neu starten programm löscht sich selbst, + die verwendeten tools rechtsklick arbeitsplatz, eigenschaften, systemwiederherstellung, auf allen laufwerken deaktivieren, übernehmen, ok 5 min warten, wieder einschalten, zeigt stopzilla noch was an? |
|
06.08.2010, 20:21
| #15 | |
| | Windows friert ein, Firefox öffnet willkürlich Fenster ( in Flensburg)Zitat:
GMER und Norman TDSS Cleaner sind immer noch auf dem Desktop |
|
| Themen zu Windows friert ein, Firefox öffnet willkürlich Fenster ( in Flensburg) |
| 0 bytes, adobe, banke, banken, bho, bonjour, browser, computer, cs3, defender, desktop, downloader, excel, explorer, firefox, firefox öffnet willkürlich fenster, free download, hijack, hkus\s-1-5-18, home, internet, internet explorer, mozilla, mozilla thunderbird, object, problem, stopzilla, system, virus, win xp prof, windows, windows friert ein, windows xp, xp prof sp3, öffnet |
Hybrid-Darstellung
