| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Trojaner bei OnlineBanking entdeckt!?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
09.09.2010, 16:16
| #1 |
 |  Trojaner bei OnlineBanking entdeckt!? Hallo, ich bräuchte Hilfe bei der Untersuchung meines PC nach einem Trojaner! Als ich mich heute morgen in mein Onlinekonto einloggte kam direkt danach ein eingeschobenes Fenster, das mich "zur zusätzlichen Sicherheit" nach Infos aus meines Tan-liste fragte. Hab dann kurzerhand meine Bank angerufen und nachgefragt. Die haben mich dann darüber informiert, dass ich wahrscheinlich einen der derzeit gängigen Trojaner auf meinen PC habe und sie mein Onlinekonto sperren bis ich meinen PC gesäubert hab. Nach einem ersten Antivir Durchlauf habe ich 2 Funde gehabt: Java/agent.M.1 Habe die dann "repariert" und in einem weiteren Durchlauf wurde dann nichts mehr gefunden. Darauf habe ich dann einen Durchlauf mit malewarebytes gemacht und das hier ist das ergebnis: Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Datenbank Version: 4582 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 09.09.2010 16:22:39 mbam-log-2010-09-09 (16-22-39).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Durchsuchte Objekte: 167676 Laufzeit: 52 Minute(n), 7 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) und danach noch einen check mit OTL:OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 09.09.2010 17:00:41 - Run 1
OTL by OldTimer - Version 3.2.11.0 Folder = C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1.023,00 Mb Total Physical Memory | 511,00 Mb Available Physical Memory | 50,00% Memory free
1,00 Gb Paging File | 1,00 Gb Available in Paging File | 63,00% Paging File free
Paging file location(s): C:\pagefile.sys 384 768 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 37,25 Gb Total Space | 0,42 Gb Free Space | 1,13% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: ARBEIT
Current User Name: Administrator
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\Windows Live\Messenger\wlcsdk.exe" = C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\Windows Live\Messenger\wlcsdk.exe" = C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)
"C:\Programme\Ares\Ares.exe" = C:\Programme\Ares\Ares.exe:*:Enabled:Ares p2p for windows -- (Ares Development Group)
"C:\Programme\Java\jre6\bin\javaw.exe" = C:\Programme\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{161B0ABD-3856-42AC-8A43-9D2B9C7FC6C5}" = Image Minimizer
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 13
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3AF8FCCD-F51A-4014-9002-F195E1CBC876}" = Logitech QuickCam
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{4BA3DDD4-BC91-48B2-8896-7A02C34829D7}" = HP Embedded Security for ProtectTools
"{4CBD31CE-51DF-43C4-B3EC-7CCBAB0CD083}" = O2Micro MemoryCardBus Windows Driver
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{53735ECE-E461-4FD0-B742-23A352436D3A}" = Logitech Updater
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{5C3DA2A1-03B2-44BD-B5AA-A44BD6E0C0C1}" = HP Integrated Wireless LAN W400-W500 Driver
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{90535871-81B9-4D99-8A13-A7EE97F2D7FE}" = Bluetooth by hp
"{914E1AB1-DCA0-4A7D-935F-B58C4B887A2B}" = HP ProtectTools Security Manager 2.00 B3
"{92C5DB3D-9D6F-4324-BB11-57825F4C2635}" = DVD Decoder Pak for Windows XP
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{99E862CC-6F69-4D39-99AA-DBF71BF3B585}" = OpenOffice.org 3.1
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AC76BA86-7AD7-1031-7B44-A91000000001}" = Adobe Reader 9.1 - Deutsch
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BE6890C7-31EF-478C-812E-1E2899ABFCA9}" = Broadcom Gigabit Integrated Controller
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}" = Microsoft Primary Interoperability Assemblies 2005
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F16F258A-6300-4A1C-BC49-7929EFF455E2}" = TIPCIxx20
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Agere Systems Soft Modem" = Agere Systems AC'97 Modem
"All ATI Software" = ATI - Dienstprogramm zur Deinstallation der Software
"Ares" = Ares 2.1.1
"ATI Display Driver" = ATI Display Driver
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"DBXTriever_is1" = DBXTriever 4.1
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{4CBD31CE-51DF-43C4-B3EC-7CCBAB0CD083}" = O2Micro MemoryCardBus Windows Driver
"InstallShield_{BE6890C7-31EF-478C-812E-1E2899ABFCA9}" = Broadcom Gigabit Integrated Controller
"InstallShield_{F16F258A-6300-4A1C-BC49-7929EFF455E2}" = Texas Instruments PCIxx20 drivers.
"lvdrivers_11.80" = Logitech QuickCam-Treiberpaket
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mobile Partner" = Mobile Partner
"Mozilla Firefox (3.6.9)" = Mozilla Firefox (3.6.9)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dr. DivX 2.0 OSS" = Dr. DivX 2.0 OSS
"Facebook Plug-In" = Facebook Plug-In
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 02.09.2010 04:01:48 | Computer Name = ARBEIT | Source = MsiInstaller | ID = 11711
Description = Produkt: Microsoft .NET Framework 2.0 Service Pack 2 -- Error 1711.Beim
Versuch, Installationsinformationen auf die Festplatte zu schreiben, ist ein Fehler
aufgetreten. Überprüfen Sie, ob genügend Speicherplatz verfügbar ist, und klicken
Sie auf "Wiederholen". Oder klicken Sie auf "Abbrechen", um die Installation zu
abzubrechen.
Error - 02.09.2010 04:01:48 | Computer Name = ARBEIT | Source = MsiInstaller | ID = 11711
Description = Produkt: Microsoft .NET Framework 2.0 Service Pack 2 -- Error 1711.Beim
Versuch, Installationsinformationen auf die Festplatte zu schreiben, ist ein Fehler
aufgetreten. Überprüfen Sie, ob genügend Speicherplatz verfügbar ist, und klicken
Sie auf "Wiederholen". Oder klicken Sie auf "Abbrechen", um die Installation zu
abzubrechen.
Error - 02.09.2010 04:01:51 | Computer Name = ARBEIT | Source = MsiInstaller | ID = 11711
Description = Produkt: Microsoft .NET Framework 2.0 Service Pack 2 -- Error 1711.Beim
Versuch, Installationsinformationen auf die Festplatte zu schreiben, ist ein Fehler
aufgetreten. Überprüfen Sie, ob genügend Speicherplatz verfügbar ist, und klicken
Sie auf "Wiederholen". Oder klicken Sie auf "Abbrechen", um die Installation zu
abzubrechen.
[ System Events ]
Error - 24.08.2010 13:21:49 | Computer Name = ARBEIT | Source = Dhcp | ID = 1000
Description = Die Lease dieses Computers zu der IP-Adresse 192.168.0.100 über die
Netzwerkkarte mit der Netzwerkadresse 00904B56514A ist verloren gegangen.
Error - 03.09.2010 10:23:46 | Computer Name = ARBEIT | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.2.101 für die Netzwerkkarte mit der Netzwerkadresse
00904B56514A wurde durch den DHCP-Server 192.168.0.1 abgelehnt (der DHCP-Server
hat eine DHCPNACK-Meldung gesendet).
Error - 05.09.2010 17:16:13 | Computer Name = ARBEIT | Source = Dhcp | ID = 1002
Description = Die IP-Adresslease 192.168.0.100 für die Netzwerkkarte mit der Netzwerkadresse
00904B56514A wurde durch den DHCP-Server 192.168.0.1 abgelehnt (der DHCP-Server
hat eine DHCPNACK-Meldung gesendet).
Error - 06.09.2010 07:25:23 | Computer Name = ARBEIT | Source = sr | ID = 1
Description = Beim Verarbeiten der Datei "System.Windows.Forms.dll" auf Volume "HarddiskVolume1"
ist im Wiederherstellungsfilter der unerwartete Fehler "0xC000007F" aufgetreten.
Die Volumeüberwachung wurde angehalten.
Error - 06.09.2010 14:38:03 | Computer Name = ARBEIT | Source = Dhcp | ID = 1000
Description = Die Lease dieses Computers zu der IP-Adresse 192.168.0.103 über die
Netzwerkkarte mit der Netzwerkadresse 00904B56514A ist verloren gegangen.
Error - 07.09.2010 15:01:48 | Computer Name = ARBEIT | Source = Dhcp | ID = 1000
Description = Die Lease dieses Computers zu der IP-Adresse 192.168.0.101 über die
Netzwerkkarte mit der Netzwerkadresse 00904B56514A ist verloren gegangen.
Error - 08.09.2010 16:01:55 | Computer Name = ARBEIT | Source = Dhcp | ID = 1000
Description = Die Lease dieses Computers zu der IP-Adresse 192.168.0.102 über die
Netzwerkkarte mit der Netzwerkadresse 00904B56514A ist verloren gegangen.
< End of report >
OTL Logfile: Code:
ATTFilter OTL logfile created on: 09.09.2010 17:00:41 - Run 1 OTL by OldTimer - Version 3.2.11.0 Folder = C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Downloads Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1.023,00 Mb Total Physical Memory | 511,00 Mb Available Physical Memory | 50,00% Memory free 1,00 Gb Paging File | 1,00 Gb Available in Paging File | 63,00% Paging File free Paging file location(s): C:\pagefile.sys 384 768 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 37,25 Gb Total Space | 0,42 Gb Free Space | 1,13% Space Free | Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: ARBEIT Current User Name: Administrator Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Programme\OpenOffice.org 3\program\soffice.bin (OpenOffice.org) PRC - C:\Programme\OpenOffice.org 3\program\soffice.exe (OpenOffice.org) PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Programme\Logitech\QuickCam\Quickcam.exe () PRC - C:\Programme\Gemeinsame Dateien\logishrd\LComMgr\Communications_Helper.exe () PRC - C:\Programme\Gemeinsame Dateien\logishrd\LQCVFX\COCIManager.exe (Logitech Inc.) PRC - C:\Programme\Gemeinsame Dateien\logishrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.) PRC - C:\Programme\Gemeinsame Dateien\logishrd\LVCOMSER\LVComSer.exe (Logitech Inc.) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) PRC - C:\Programme\ProtectTools\Embedded Security Software\PSDrt.exe (Infineon Technologies AG) PRC - C:\Programme\HPQ\HP ProtectTools Security Manager\pthosttr.exe (Hewlett-Packard Development Company, L.P.) PRC - C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe (Analog Devices, Inc.) PRC - C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe (WIDCOMM, Inc.) PRC - C:\Programme\Analog Devices\SoundMAX\SMAgent.exe (Analog Devices, Inc.) ========== Modules (SafeList) ========== MOD - C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Downloads\OTL.exe (OldTimer Tools) MOD - C:\WINDOWS\system32\ckcnfmon.dll () MOD - C:\WINDOWS\Temp\logishrd\LVPrcInj01.dll (Logitech Inc.) MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (HidServ) -- C:\WINDOWS\System32\hidserv.dll File not found SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (LVPrcSrv) -- C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.) SRV - (LVCOMSer) -- C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe (Logitech Inc.) SRV - (IDriverT) -- c:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation) SRV - (SoundMAX Agent Service (default)) -- C:\Programme\Analog Devices\SoundMAX\SMAgent.exe (Analog Devices, Inc.) ========== Driver Services (SafeList) ========== DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH) DRV - (hwdatacard) -- C:\WINDOWS\system32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.) DRV - (hwusbdev) -- C:\WINDOWS\system32\drivers\ewusbdev.sys (Huawei Technologies Co., Ltd.) DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH) DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH) DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH) DRV - (LVUSBSta) -- C:\WINDOWS\system32\drivers\LVUSBSta.sys (Logitech Inc.) DRV - (PID_PEPI) Logitech QuickCam IM(PID_PEPI) -- C:\WINDOWS\system32\drivers\LV302V32.SYS (Logitech Inc.) DRV - (LVPr2Mon) -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys () DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation) DRV - (BCM43XX) -- C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation) DRV - (PersonalSecureDrive) -- C:\WINDOWS\System32\drivers\psd.sys (Infineon Technologies AG) DRV - (IFXTPM) -- C:\WINDOWS\system32\drivers\ifxtpm.sys (Infineon Technologies AG) DRV - (WLAN_400_500_SERVICE) -- C:\WINDOWS\system32\drivers\ar5211.sys (Atheros Communications, Inc.) DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.) DRV - (AgereSoftModem) -- C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems) DRV - (BTKRNL) -- C:\WINDOWS\system32\drivers\btkrnl.sys (WIDCOMM, Inc.) DRV - (BTWUSB) -- C:\WINDOWS\system32\drivers\btwusb.sys (WIDCOMM, Inc.) DRV - (CONAN) -- C:\WINDOWS\system32\drivers\o2mmb.sys (O2 Micro ) DRV - (MbxStby) -- C:\WINDOWS\system32\drivers\MbxStby.sys (O2 Micro) DRV - (b57w2k) -- C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation) DRV - (SMCIRDA) -- C:\WINDOWS\system32\drivers\smcirda.sys (SMC) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.winfuture.de IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1 FF - prefs.js..extensions.enabledItems: 6 FF - prefs.js..extensions.enabledItems: 2 FF - prefs.js..extensions.enabledItems: 41 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.2 FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.0.2.5 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.9\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.09.09 00:34:23 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.9\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.09.09 00:34:23 | 000,000,000 | ---D | M] [2010.01.21 21:12:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Extensions [2010.09.09 14:15:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\qs3ayopj.default\extensions [2010.09.09 14:09:29 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\qs3ayopj.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.09.09 14:15:31 | 000,000,000 | ---D | M] (NoScript) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\qs3ayopj.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232} [2010.09.09 14:13:38 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\qs3ayopj.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2009.09.07 22:46:59 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\qs3ayopj.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7} [2010.07.26 13:13:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\qs3ayopj.default\extensions\toolbar@ask.com [2010.06.25 23:25:20 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions [2010.06.12 03:24:05 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.06.12 03:24:05 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010.06.12 03:24:05 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.06.12 03:24:05 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.06.12 03:24:05 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2001.08.18 21:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com) O3 - HKLM\..\Toolbar: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com) O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [LogitechCommunicationsManager] C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe () O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Programme\Logitech\QuickCam\Quickcam.exe () O4 - HKLM..\Run: [PTHOSTTR] C:\Programme\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE (Hewlett-Packard Development Company, L.P.) O4 - HKLM..\Run: [SoundMAX] C:\Programme\Analog Devices\SoundMAX\Smax4.exe (Analog Devices, Inc.) O4 - HKLM..\Run: [SoundMAXPnP] C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe (Analog Devices, Inc.) O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - Startup: C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Autostart\OpenOffice.org 3.1.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe () O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\BTTray.lnk = C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe (WIDCOMM, Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTaskGrouping = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTaskGrouping = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 1 O8 - Extra context menu item: Senden an &Bluetooth - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm () O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\widimg {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\system32\BTXPPanel.dll (WIDCOMM, Inc.) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O20 - Winlogon\Notify\IfxWlxEN: DllName - IfxWlxEN.dll - C:\WINDOWS\System32\IfxWlxEN.dll (Infineon Technologies AG) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2007.09.27 09:43:04 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{6b39bea0-4f11-11df-b63c-000802db3c12}\Shell - "" = AutoRun O33 - MountPoints2\{6b39bea0-4f11-11df-b63c-000802db3c12}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{6b39bea0-4f11-11df-b63c-000802db3c12}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found O33 - MountPoints2\{939701c0-4713-11df-b625-000802db3c12}\Shell - "" = AutoRun O33 - MountPoints2\{939701c0-4713-11df-b625-000802db3c12}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{939701c0-4713-11df-b625-000802db3c12}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found O33 - MountPoints2\{939701c4-4713-11df-b625-000802db3c12}\Shell - "" = AutoRun O33 - MountPoints2\{939701c4-4713-11df-b625-000802db3c12}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{939701c4-4713-11df-b625-000802db3c12}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found O33 - MountPoints2\E\Shell - "" = AutoRun O33 - MountPoints2\E\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O36 - AppCertDlls: bootnify - (C:\WINDOWS\system32\ckcnfmon.dll) - C:\WINDOWS\system32\ckcnfmon.dll () O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010.09.09 15:29:52 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Malwarebytes [2010.09.09 15:29:41 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010.09.09 15:29:38 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes [2010.09.09 15:29:37 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2010.09.09 15:29:37 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2010.09.09 14:02:09 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\Administrator\IETldCache [2010.09.09 13:58:05 | 000,000,000 | ---D | C] -- C:\WINDOWS\ie8updates [2010.09.09 13:57:22 | 000,743,424 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iedvtool.dll [2010.09.09 13:53:53 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8 [4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010.09.09 17:01:04 | 000,000,242 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job [2010.09.09 15:29:44 | 000,000,676 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2010.09.09 14:02:08 | 000,000,378 | ---- | M] () -- C:\WINDOWS\tasks\Registry Reviver-Administrator-Startup.job [2010.09.09 14:02:03 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010.09.09 14:02:00 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010.09.09 14:00:36 | 003,670,016 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\ntuser.dat [2010.09.09 14:00:36 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\Administrator\ntuser.ini [2010.09.09 13:58:50 | 000,001,355 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2010.09.09 13:48:24 | 000,998,194 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2010.09.09 13:48:24 | 000,449,240 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat [2010.09.09 13:48:24 | 000,433,200 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2010.09.09 13:48:24 | 000,080,936 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat [2010.09.09 13:48:24 | 000,068,156 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2010.09.09 11:15:51 | 000,002,243 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Skype.lnk [2010.09.09 01:13:05 | 000,046,592 | -H-- | M] () -- C:\WINDOWS\System32\ckcnfmon.dll [2010.09.03 16:23:36 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010.09.02 16:55:13 | 000,012,288 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\jobs.doc [2010.09.01 23:53:08 | 002,102,596 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\abuela.JPG [2010.08.17 09:55:26 | 004,025,101 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\DSC01877.JPG [2010.08.17 09:54:37 | 004,111,989 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\DSC01885.JPG [2010.08.17 09:53:49 | 002,195,351 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\DSCN5980.JPG [2010.08.17 09:52:30 | 002,146,578 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\DSCN5981.JPG [2010.08.17 09:49:56 | 002,190,035 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\DSCN5978.JPG [2010.08.17 09:46:49 | 002,158,684 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\DSCN5979.JPG [2010.08.16 11:16:23 | 000,017,408 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\Registrierung Ecuador.doc [2010.08.14 00:49:42 | 004,469,296 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\DSC01038.JPG [2010.08.14 00:47:47 | 001,694,647 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\RSCN5079.JPG [2010.08.13 23:19:41 | 000,062,386 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\39750_416464731539_536861539_5188604_2675557_n.jpg [2010.08.13 16:34:00 | 001,154,866 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\20060219101547.mp3 [2010.08.13 11:35:13 | 000,118,952 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2010.08.12 11:58:09 | 002,009,936 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\DSCN5340.JPG [2010.08.12 11:58:08 | 001,908,438 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\DSCN5323.JPG [2010.08.12 11:58:01 | 002,026,887 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\DSCN5347.JPG [2010.08.12 11:46:46 | 001,787,463 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\DSCN5345.JPG [4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2010.09.09 15:29:44 | 000,000,676 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2010.09.09 01:13:04 | 000,046,592 | -H-- | C] () -- C:\WINDOWS\System32\ckcnfmon.dll [2010.09.02 16:54:51 | 000,012,288 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\jobs.doc [2010.09.01 23:51:45 | 002,102,596 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\abuela.JPG [2010.08.24 18:35:26 | 069,749,948 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\ecuador 2008 036.avi [2010.08.24 18:35:13 | 088,050,476 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\DSCN0599.avi [2010.08.17 09:43:49 | 004,025,101 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\DSC01877.JPG [2010.08.17 09:42:42 | 004,111,989 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\DSC01885.JPG [2010.08.17 09:42:42 | 002,195,351 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\DSCN5980.JPG [2010.08.17 09:42:42 | 002,190,035 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\DSCN5978.JPG [2010.08.17 09:42:42 | 002,158,684 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\DSCN5979.JPG [2010.08.17 09:42:42 | 002,146,578 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\DSCN5981.JPG [2010.08.16 11:16:20 | 000,017,408 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\Registrierung Ecuador.doc [2010.08.14 00:45:29 | 004,469,296 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\DSC01038.JPG [2010.08.14 00:44:52 | 001,694,647 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\RSCN5079.JPG [2010.08.13 23:19:36 | 000,062,386 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\39750_416464731539_536861539_5188604_2675557_n.jpg [2010.08.12 11:54:45 | 002,026,887 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\DSCN5347.JPG [2010.08.12 11:54:45 | 002,009,936 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\DSCN5340.JPG [2010.08.12 11:54:45 | 001,908,438 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\DSCN5323.JPG [2010.08.12 11:45:48 | 001,787,463 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\DSCN5345.JPG [2010.08.01 19:06:58 | 000,000,112 | ---- | C] () -- C:\WINDOWS\ActiveSkin.INI [2010.07.23 12:40:26 | 000,000,017 | ---- | C] () -- C:\WINDOWS\Missing.ini [2009.09.07 22:20:29 | 000,049,664 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008.07.26 08:25:02 | 000,025,624 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys [2007.05.09 20:35:54 | 000,066,482 | R--- | C] () -- C:\WINDOWS\System32\lvcoinst.ini [2004.06.02 17:28:30 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\btprn2k.dll [2002.05.15 23:29:04 | 000,000,607 | ---- | C] () -- C:\WINDOWS\System32\BTNeighborhood.dll.manifest [2001.11.23 18:18:00 | 000,000,597 | ---- | C] () -- C:\WINDOWS\System32\btcss.dll.manifest [2001.11.14 13:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll < End of report > Was nun? Was kann ich als nächstes tun, um sicher zu gehen, dass mein PC nicht mehr gefährlich infiziert ist? Würde mich über schnelle antwort freuen  Danke! |
|
09.09.2010, 20:30
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Trojaner bei OnlineBanking entdeckt!? Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)
__________________Code:
ATTFilter :OTL
MOD - C:\WINDOWS\system32\ckcnfmon.dll ()
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com)
O33 - MountPoints2\{6b39bea0-4f11-11df-b63c-000802db3c12}\Shell - "" = AutoRun
O33 - MountPoints2\{6b39bea0-4f11-11df-b63c-000802db3c12}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{6b39bea0-4f11-11df-b63c-000802db3c12}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{939701c0-4713-11df-b625-000802db3c12}\Shell - "" = AutoRun
O33 - MountPoints2\{939701c0-4713-11df-b625-000802db3c12}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{939701c0-4713-11df-b625-000802db3c12}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\{939701c4-4713-11df-b625-000802db3c12}\Shell - "" = AutoRun
O33 - MountPoints2\{939701c4-4713-11df-b625-000802db3c12}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{939701c4-4713-11df-b625-000802db3c12}\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\AutoRun.exe -- File not found
O36 - AppCertDlls: bootnify - (C:\WINDOWS\system32\ckcnfmon.dll) - C:\WINDOWS\system32\ckcnfmon.dll ()
[2010.09.09 01:13:05 | 000,046,592 | -H-- | M] () -- C:\WINDOWS\System32\ckcnfmon.dll
:Commands
[purity]
[resethosts]
[emptytemp]
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.
__________________ |
|
09.09.2010, 20:43
| #3 |
| | Trojaner bei OnlineBanking entdeckt!? All processes killed
__________________========== OTL ========== Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully. C:\Programme\Ask.com\GenericAskToolbar.dll moved successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found. File C:\Programme\Ask.com\GenericAskToolbar.dll not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6b39bea0-4f11-11df-b63c-000802db3c12}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6b39bea0-4f11-11df-b63c-000802db3c12}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6b39bea0-4f11-11df-b63c-000802db3c12}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6b39bea0-4f11-11df-b63c-000802db3c12}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6b39bea0-4f11-11df-b63c-000802db3c12}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6b39bea0-4f11-11df-b63c-000802db3c12}\ not found. File E:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{939701c0-4713-11df-b625-000802db3c12}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{939701c0-4713-11df-b625-000802db3c12}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{939701c0-4713-11df-b625-000802db3c12}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{939701c0-4713-11df-b625-000802db3c12}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{939701c0-4713-11df-b625-000802db3c12}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{939701c0-4713-11df-b625-000802db3c12}\ not found. File E:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{939701c4-4713-11df-b625-000802db3c12}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{939701c4-4713-11df-b625-000802db3c12}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{939701c4-4713-11df-b625-000802db3c12}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{939701c4-4713-11df-b625-000802db3c12}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{939701c4-4713-11df-b625-000802db3c12}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{939701c4-4713-11df-b625-000802db3c12}\ not found. File E:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ deleted successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ not found. File E:\AutoRun.exe not found. Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\\bootnify:C:\WINDOWS\system32\ckcnfmon.dll deleted successfully. C:\WINDOWS\system32\ckcnfmon.dll moved successfully. File C:\WINDOWS\System32\ckcnfmon.dll not found. ========== COMMANDS ========== C:\WINDOWS\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully [EMPTYTEMP] User: Administrator ->Temp folder emptied: 3808199593 bytes ->Temporary Internet Files folder emptied: 137556 bytes ->Java cache emptied: 3602 bytes ->FireFox cache emptied: 137427976 bytes ->Flash cache emptied: 95046 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: LocalService ->Temp folder emptied: 66016 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33237 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 2134333 bytes %systemroot%\System32 .tmp files removed: 2951 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 10737861 bytes RecycleBin emptied: 3287256924 bytes Total Files Cleaned = 6.910,00 mb OTL by OldTimer - Version 3.2.11.0 log created on 09092010_213741 Files\Folders moved on Reboot... File move failed. C:\WINDOWS\temp\logishrd\LVPrcInj01.dll scheduled to be moved on reboot. Registry entries deleted on Reboot... |
|
09.09.2010, 20:44
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Trojaner bei OnlineBanking entdeckt!? Dann bitte jetzt CF ausführen: ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
09.09.2010, 21:25
| #5 |
| | Trojaner bei OnlineBanking entdeckt!? Combofix Logfile: Code:
ATTFilter ComboFix 10-09-08.03 - Administrator 09.09.2010 22:09:23.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.49.1031.18.1023.558 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\Administrator\Desktop\cofi.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\TEMP\logishrd\LVPrcInj01.dll
.
((((((((((((((((((((((( Dateien erstellt von 2010-08-09 bis 2010-09-09 ))))))))))))))))))))))))))))))
.
2010-09-09 19:55 . 2010-09-09 19:55 -------- d-----w- c:\programme\CCleaner
2010-09-09 19:37 . 2010-09-09 19:37 -------- d-----w- C:\_OTL
2010-09-09 13:29 . 2010-09-09 13:29 -------- d-----w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Malwarebytes
2010-09-09 13:29 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-09 13:29 . 2010-09-09 13:29 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2010-09-09 13:29 . 2010-09-09 13:29 -------- d-----w- c:\programme\Malwarebytes' Anti-Malware
2010-09-09 13:29 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-09 12:02 . 2010-09-09 12:02 -------- d-sh--w- c:\dokumente und einstellungen\Administrator\IETldCache
2010-09-09 11:58 . 2010-06-18 11:39 16896 -c----w- c:\windows\system32\dllcache\iecompat.dll
2010-09-09 11:58 . 2010-09-09 11:59 -------- d-----w- c:\windows\ie8updates
2010-09-09 11:57 . 2010-06-24 12:22 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2010-09-09 11:57 . 2010-06-24 12:21 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2010-09-09 11:57 . 2010-06-24 12:21 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2010-09-09 11:53 . 2010-09-09 11:57 -------- dc-h--w- c:\windows\ie8
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-09 19:37 . 2010-07-26 10:51 -------- d-----w- c:\programme\Ask.com
2010-09-09 17:22 . 2001-08-18 19:00 80936 ----a-w- c:\windows\system32\perfc007.dat
2010-09-09 17:22 . 2001-08-18 19:00 449240 ----a-w- c:\windows\system32\perfh007.dat
2010-09-09 11:21 . 2010-01-21 19:49 -------- d-----w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Skype
2010-09-09 09:17 . 2009-09-08 08:00 -------- d-----w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\skypePM
2010-09-02 14:28 . 2009-09-16 15:08 1 ----a-w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-08-01 12:24 . 2010-08-01 12:24 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\TEMP
2010-08-01 12:24 . 2010-08-01 12:24 -------- d-----w- c:\programme\DBXTriever
2010-07-20 09:12 . 2010-07-20 08:53 -------- d-----w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Apple Computer
2010-07-20 08:53 . 2009-09-07 20:23 18424 ----a-w- c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2010-07-20 08:51 . 2010-07-20 08:50 -------- d-----w- c:\programme\QuickTime
2010-07-20 08:50 . 2010-07-20 08:50 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Apple Computer
2010-07-20 08:49 . 2010-07-20 08:49 -------- d-----w- c:\programme\Gemeinsame Dateien\Apple
2010-07-20 08:49 . 2010-07-20 08:49 -------- d-----w- c:\programme\Apple Software Update
2010-07-20 08:49 . 2010-07-20 08:49 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Apple
2010-06-30 12:28 . 2004-08-03 22:57 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-24 12:22 . 2004-08-03 22:57 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-24 09:02 . 2004-08-03 22:46 1852032 ----a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2004-08-03 21:14 354304 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-17 14:03 . 2004-08-03 22:57 80384 ----a-w- c:\windows\system32\iccvid.dll
2010-06-14 14:31 . 2007-09-27 07:39 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:41 . 2004-08-03 22:57 1172480 ----a-w- c:\windows\system32\msxml3.dll
2009-07-14 00:16 . 2009-07-14 00:16 1044480 ----a-w- c:\programme\mozilla firefox\plugins\libdivx.dll
2009-07-14 00:16 . 2009-07-14 00:16 200704 ----a-w- c:\programme\mozilla firefox\plugins\ssldivx.dll
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AGRSMMSG"="AGRSMMSG.exe" [2005-04-19 88209]
"SoundMAXPnP"="c:\programme\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"ATIPTA"="c:\programme\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-06-07 344064]
"PTHOSTTR"="c:\programme\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2005-10-04 86016]
"SunJavaUpdateSched"="c:\programme\Java\jre6\bin\jusched.exe" [2009-06-09 148888]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"LogitechCommunicationsManager"="c:\programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe" [2008-08-14 565008]
"LogitechQuickCamRibbon"="c:\programme\Logitech\QuickCam\Quickcam.exe" [2008-08-14 2407184]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2010-03-17 421888]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\dokumente und einstellungen\Administrator\Startmen\Programme\Autostart\
OpenOffice.org 3.1.lnk - c:\programme\OpenOffice.org 3\program\quickstart.exe [2009-4-16 384000]
c:\dokumente und einstellungen\Administrator\Startmen\Programme\Autostart\
OpenOffice.org 3.1.lnk - c:\programme\OpenOffice.org 3\program\quickstart.exe [2009-4-16 384000]
c:\dokumente und einstellungen\Administrator\Startmen\Programme\Autostart\
OpenOffice.org 3.1.lnk - c:\programme\OpenOffice.org 3\program\quickstart.exe [2009-4-16 384000]
c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\
BTTray.lnk - c:\programme\WIDCOMM\Bluetooth Software\BTTray.exe [2004-6-2 565309]
c:\dokumente und einstellungen\Administrator\Startmen\Programme\Autostart\
OpenOffice.org 3.1.lnk - c:\programme\OpenOffice.org 3\program\quickstart.exe [2009-4-16 384000]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoTaskGrouping"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoTaskGrouping"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoTaskGrouping"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IfxWlxEN]
2006-03-03 13:08 434176 ----a-w- c:\windows\system32\IfxWlxEN.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programme\\Ares\\Ares.exe"=
"c:\\Programme\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Programme\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Programme\\Skype\\Phone\\Skype.exe"=
R1 PersonalSecureDrive;PersonalSecureDrive;c:\windows\system32\drivers\psd.sys [29.11.2005 16:56 36768]
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [01.10.2009 17:33 108289]
R3 CONAN;CONAN;c:\windows\system32\drivers\o2mmb.sys [27.09.2007 11:07 182101]
R3 MbxStby;MbxStby;c:\windows\system32\drivers\MbxStby.sys [27.09.2007 11:07 5689]
S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\drivers\ewusbdev.sys [13.04.2010 17:46 100480]
S3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [21.10.2005 11:19 36352]
S3 WLAN_400_500_SERVICE;HP WLAN W400/W500 Wireless Network Adapter Service;c:\windows\system32\drivers\ar5211.sys [05.05.2008 12:08 468768]
.
Inhalt des "geplante Tasks" Ordners
2010-09-09 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\programme\Ask.com\UpdateTask.exe [2010-02-04 14:50]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.winfuture.de
IE: Senden an &Bluetooth - c:\programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
FF - ProfilePath - c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\qs3ayopj.default\
FF - plugin: c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Facebook\npfbplugin_1_0_1.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX Richtlinien ----
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\programme\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-09-09 22:16
Windows 5.1.2600 Service Pack 3 NTFS
Scanne versteckte Prozesse...
Scanne versteckte Autostarteinträge...
Scanne versteckte Dateien...
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
**************************************************************************
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
- - - - - - - > 'winlogon.exe'(896)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\IfxWlxEN.dll
c:\windows\system32\msi.dll
- - - - - - - > 'explorer.exe'(6792)
c:\windows\TEMP\logishrd\LVPrcInj01.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\programme\Avira\AntiVir Desktop\avguard.exe
c:\programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
c:\windows\system32\IFXSPMGT.exe
c:\windows\system32\IFXTCS.exe
c:\programme\Java\jre6\bin\jqs.exe
c:\programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe
c:\programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\programme\ProtectTools\Embedded Security Software\PSDsrvc.EXE
c:\programme\Analog Devices\SoundMAX\SMAgent.exe
c:\windows\system32\Ati2evxx.exe
c:\programme\ProtectTools\Embedded Security Software\PSDrt.exe
c:\windows\AGRSMMSG.exe
c:\programme\OpenOffice.org 3\program\soffice.exe
c:\programme\OpenOffice.org 3\program\soffice.bin
c:\programme\Gemeinsame Dateien\Logishrd\LQCVFX\COCIManager.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-09-09 22:20:50 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2010-09-09 20:20
Vor Suchlauf: 7.451.631.616 Bytes frei
Nach Suchlauf: 8 Verzeichnis(se), 14.063.632.384 Bytes frei
WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
- - End Of File - - B30A0182F636D35B6ABAC010776EF4D4
|
|
10.09.2010, 09:41
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Trojaner bei OnlineBanking entdeckt!? Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus Anschließend den bootkit_remover herunterladen. Entpacke das Tool in einen eigenen Ordner auf dem Desktop und führe in diesem Ordner die Datei remove.exe aus. Wenn Du Windows Vista oder Windows 7 verwendest, musst Du die remover.exe über ein Rechtsklick => als Administrator ausführen Ein schwarzes Fenster wird sich öffnen und automatisch nach bösartigen Veränderungen im MBR suchen. Poste dann bitte, ob es Veränderungen gibt und wenn ja in welchem device. Am besten alles posten was die remover.exe ausgibt.
__________________ --> Trojaner bei OnlineBanking entdeckt!? |
|
10.09.2010, 14:37
| #7 |
| | Trojaner bei OnlineBanking entdeckt!? hier zunächst der GMER: GMER Logfile: Code:
ATTFilter GMER 1.0.15.15281 - hxxp://www.gmer.net
Rootkit scan 2010-09-10 15:33:53
Windows 5.1.2600 Service Pack 3
Running: 9xxf9qcr.exe; Driver: C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\pgtdrpow.sys
---- System - GMER 1.0.15 ----
SSDT F7CFC716 ZwCreateKey
SSDT F7CFC70C ZwCreateThread
SSDT F7CFC71B ZwDeleteKey
SSDT F7CFC725 ZwDeleteValueKey
SSDT F7CFC72A ZwLoadKey
SSDT F7CFC6F8 ZwOpenProcess
SSDT F7CFC6FD ZwOpenThread
SSDT F7CFC734 ZwReplaceKey
SSDT F7CFC72F ZwRestoreKey
SSDT F7CFC720 ZwSetValueKey
SSDT F7CFC707 ZwTerminateProcess
---- Kernel code sections - GMER 1.0.15 ----
init C:\WINDOWS\system32\drivers\o2mmb.sys entry point in "init" section [0xF6824320]
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\Programme\Logitech\QuickCam\Quickcam.exe[216] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00EB2F30] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Logitech\QuickCam\Quickcam.exe[216] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00EB2CA0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Logitech\QuickCam\Quickcam.exe[216] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00EB2D00] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Logitech\QuickCam\Quickcam.exe[216] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00EB2CD0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\Ati2evxx.exe[1492] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00382F30] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\Ati2evxx.exe[1492] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00382CA0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\Ati2evxx.exe[1492] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00382D00] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\Ati2evxx.exe[1492] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00382CD0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\Explorer.EXE[1636] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00C42F30] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\Explorer.EXE[1636] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00C42CA0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\Explorer.EXE[1636] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00C42D00] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\Explorer.EXE[1636] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00C42CD0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe[1684] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00AA2F30] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe[1684] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00AA2CA0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe[1684] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00AA2D00] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe[1684] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00AA2CD0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\ProtectTools\Embedded Security Software\PSDrt.exe[1860] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00AF2F30] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\ProtectTools\Embedded Security Software\PSDrt.exe[1860] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00AF2CA0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\ProtectTools\Embedded Security Software\PSDrt.exe[1860] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00AF2D00] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\ProtectTools\Embedded Security Software\PSDrt.exe[1860] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00AF2CD0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\AGRSMMSG.exe[2396] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [003C2F30] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\AGRSMMSG.exe[2396] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [003C2CA0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\AGRSMMSG.exe[2396] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [003C2D00] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\AGRSMMSG.exe[2396] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [003C2CD0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\OpenOffice.org 3\program\soffice.exe[2436] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [01102F30] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\OpenOffice.org 3\program\soffice.exe[2436] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [01102CA0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\OpenOffice.org 3\program\soffice.exe[2436] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [01102D00] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\OpenOffice.org 3\program\soffice.exe[2436] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [01102CD0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Java\jre6\bin\jusched.exe[2468] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00C12F30] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Java\jre6\bin\jusched.exe[2468] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00C12CA0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Java\jre6\bin\jusched.exe[2468] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00C12D00] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Java\jre6\bin\jusched.exe[2468] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00C12CD0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Gemeinsame Dateien\Logishrd\LQCVFX\COCIManager.exe[2700] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [003C2F30] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Gemeinsame Dateien\Logishrd\LQCVFX\COCIManager.exe[2700] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [003C2CA0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Gemeinsame Dateien\Logishrd\LQCVFX\COCIManager.exe[2700] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [003C2D00] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Gemeinsame Dateien\Logishrd\LQCVFX\COCIManager.exe[2700] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [003C2CD0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\OpenOffice.org 3\program\soffice.bin[2788] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [02532F30] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\OpenOffice.org 3\program\soffice.bin[2788] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [02532CA0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\OpenOffice.org 3\program\soffice.bin[2788] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [02532D00] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\OpenOffice.org 3\program\soffice.bin[2788] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [02532CD0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe[2992] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [009E2F30] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe[2992] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [009E2CA0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe[2992] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [009E2D00] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe[2992] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [009E2CD0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe[3000] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00C82F30] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe[3000] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00C82CA0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe[3000] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00C82D00] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe[3000] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00C82CD0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE[3132] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [003C2F30] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE[3132] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [003C2CA0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE[3132] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [003C2D00] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE[3132] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [003C2CD0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\wuauclt.exe[3492] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00502F30] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\wuauclt.exe[3492] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00502CA0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\wuauclt.exe[3492] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00502D00] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\wuauclt.exe[3492] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00502CD0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe[3736] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00B42F30] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe[3736] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00B42CA0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe[3736] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00B42D00] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe[3736] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00B42CD0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3788] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00BA2F30] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3788] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00BA2CA0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3788] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00BA2D00] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Programme\Avira\AntiVir Desktop\avgnt.exe[3788] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00BA2CD0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\wscntfy.exe[4824] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [008E2F30] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\wscntfy.exe[4824] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [008E2CA0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\wscntfy.exe[4824] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [008E2D00] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\system32\wscntfy.exe[4824] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [008E2CD0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Dokumente und Einstellungen\Administrator\Desktop\9xxf9qcr.exe[5376] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00802F30] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Dokumente und Einstellungen\Administrator\Desktop\9xxf9qcr.exe[5376] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00802CA0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Dokumente und Einstellungen\Administrator\Desktop\9xxf9qcr.exe[5376] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00802D00] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Dokumente und Einstellungen\Administrator\Desktop\9xxf9qcr.exe[5376] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00802CD0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
---- EOF - GMER 1.0.15 ----
|
|
10.09.2010, 14:50
| #8 |
| | Trojaner bei OnlineBanking entdeckt!? und hier der OSAM: Report of OSAM: Autorun Manager v5.0.11926.0 hxxp://www.online-solutions.ru/en/ Saved at 15:48:15 on 10.09.2010 OS: Windows XP Professional Service Pack 3 (Build 2600) Default Browser: Mozilla Corporation Firefox 3.6.9 Scanner Settings Rootkits detection (hidden registry) Rootkits detection (hidden files) Retrieve files information Check Microsoft signatures Filters Trusted entries Empty entries Hidden registry entries (rootkit activity) Exclusively opened files Not found files Files without detailed information Existing files Non-startable services Non-startable drivers Active entries Disabled entries Risk Name Publisher Full Path Status Common %SystemRoot%\Tasks |||| "Scheduled Update for Ask Toolbar.job" C:\Programme\Ask.com\UpdateTask.exe File found, but it contains no detailed information Control Panel Objects %SystemRoot%\system32 |||||| "btcpl.cpl" "WIDCOMM, Inc." C:\WINDOWS\system32\btcpl.cpl File exists |||||| "infocardcpl.cpl" "Microsoft Corporation" C:\WINDOWS\system32\infocardcpl.cpl File exists |||||| "javacpl.cpl" "Sun Microsystems, Inc." C:\WINDOWS\system32\javacpl.cpl File exists HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls |||||| "Avira AntiVir Personal - Free Antivirus " "Avira GmbH" C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl File exists |||||| "PTHOST.CPL" "HP" C:\Programme\HPQ\HP ProtectTools Security Manager\PTHOST.CPL File exists |||||| "QuickTime" "Apple Inc." C:\Programme\QuickTime\QTSystem\QuickTime.cpl File exists |||||| "SMAX4CP" "Analog Devices, Inc." C:\Programme\Analog Devices\SoundMAX\SMax4.cpl File exists Drivers HKLM\SYSTEM\CurrentControlSet\Services |||||| "avgio" (avgio) "Avira GmbH" C:\Programme\Avira\AntiVir Desktop\avgio.sys File exists |||||| "avgntflt" (avgntflt) "Avira GmbH" C:\WINDOWS\System32\DRIVERS\avgntflt.sys File exists |||||| "avipbb" (avipbb) "Avira GmbH" C:\WINDOWS\System32\DRIVERS\avipbb.sys File exists |||||| "Bluetooth Protocol Stack" (BTKRNL) "WIDCOMM, Inc." C:\WINDOWS\System32\drivers\btkrnl.sys File exists "catchme" (catchme) C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\catchme.sys File not found "Changer" (Changer) C:\WINDOWS\system32\drivers\Changer.sys File not found "i2omgmt" (i2omgmt) C:\WINDOWS\system32\drivers\i2omgmt.sys File not found "lbrtfdc" (lbrtfdc) C:\WINDOWS\system32\drivers\lbrtfdc.sys File not found "PCIDump" (PCIDump) C:\WINDOWS\system32\drivers\PCIDump.sys File not found "PDCOMP" (PDCOMP) C:\WINDOWS\system32\drivers\PDCOMP.sys File not found "PDFRAME" (PDFRAME) C:\WINDOWS\system32\drivers\PDFRAME.sys File not found "PDRELI" (PDRELI) C:\WINDOWS\system32\drivers\PDRELI.sys File not found "PDRFRAME" (PDRFRAME) C:\WINDOWS\system32\drivers\PDRFRAME.sys File not found |||||| "PersonalSecureDrive" (PersonalSecureDrive) "Infineon Technologies AG" C:\WINDOWS\System32\drivers\psd.sys File exists "pgtdrpow" (pgtdrpow) C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\pgtdrpow.sys Hidden registry entry, rootkit activity | File not found |||||| "PxHelp20" (PxHelp20) "Sonic Solutions" C:\WINDOWS\System32\Drivers\PxHelp20.sys File exists |||||| "ssmdrv" (ssmdrv) "Avira GmbH" C:\WINDOWS\System32\DRIVERS\ssmdrv.sys File exists |||||| "Treiber für Broadcom 802.11-Netzwerkadapter" (BCM43XX) "Broadcom Corporation" C:\WINDOWS\System32\DRIVERS\bcmwl5.sys File exists "WDICA" (WDICA) C:\WINDOWS\system32\drivers\WDICA.sys File not found |||||| "WIDCOMM USB Bluetooth Driver" (BTWUSB) "WIDCOMM, Inc." C:\WINDOWS\System32\Drivers\btwusb.sys File exists Explorer HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components |||||| {89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" "Microsoft Corporation" c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install File exists HKLM\Software\Classes\Folder\shellex\ColumnHandlers |||||| {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" "Adobe Systems, Inc." C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll File exists |||||| {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll File exists HKLM\Software\Classes\Protocols\Filter |||||| {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" "Microsoft Corporation" C:\WINDOWS\system32\mscoree.dll File exists |||||| {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" "Microsoft Corporation" C:\WINDOWS\system32\mscoree.dll File exists |||||| {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" "Microsoft Corporation" C:\WINDOWS\system32\mscoree.dll File exists HKLM\Software\Classes\Protocols\Handler |||||| {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" "Skype Technologies" C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL File exists |||| {828030A1-22C1-4009-854F-8E305202313F} "livecall" "Microsoft Corporation" C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL File exists |||| {828030A1-22C1-4009-854F-8E305202313F} "msnim" "Microsoft Corporation" C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL File exists |||||| {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} "WidImg Class" "WIDCOMM, Inc." C:\WINDOWS\system32\btxppanel.dll File exists HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved |||||| {6af09ec9-b429-11d4-a1fb-0090960218cb} "Bluetooth-Umgebung" "WIDCOMM, Inc." C:\WINDOWS\system32\btneighborhood.dll File exists {42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" deskpan.dll File not found {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" File not found | COM-object registry key not found |||||| {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll File exists |||||| {087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll File exists |||||| {63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll File exists |||||| {3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll File exists |||||| {E08BF9C5-191E-4B15-8F67-2622B4DB5580} "PSDShCtrl Class" "Infineon Technologies AG" C:\Programme\ProtectTools\Embedded Security Software\PSDShExt.dll File exists |||||| {45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" "Avira GmbH" C:\Programme\Avira\AntiVir Desktop\shlext.dll File exists |||||| {E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" "Microsoft Corporation" c:\WINDOWS\system32\dfshim.dll File exists {764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" File not found | COM-object registry key not found |||||| {e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" "Microsoft Corporation" c:\WINDOWS\system32\dfshim.dll File exists |||||| {B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" "Alexander Roshal" C:\Programme\WinRAR\rarext.dll File exists Internet Explorer HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units |||| {8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_13" hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab "Sun Microsystems, Inc." C:\Programme\Java\jre6\bin\npjpi160_13.dll File exists |||| {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} "Java Plug-in 1.6.0_13" hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab "Sun Microsystems, Inc." C:\Programme\Java\jre6\bin\npjpi160_13.dll File exists |||| {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_13" hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab "Sun Microsystems, Inc." C:\Programme\Java\jre6\bin\npjpi160_13.dll File exists |||||| {D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab "Adobe Systems, Inc." C:\WINDOWS\system32\Macromed\Flash\Flash10e.ocx File exists {E2883E8F-472F-4FB0-9522-AC9BF37916A7} "{E2883E8F-472F-4FB0-9522-AC9BF37916A7}" hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab File not found | COM-object registry key not found HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects |||||| {18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" "Adobe Systems Incorporated" C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll File exists |||| {DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" "Sun Microsystems, Inc." C:\Programme\Java\jre6\bin\jp2ssv.dll File exists |||| {E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" "Sun Microsystems, Inc." C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll File exists |||||| {9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" "Microsoft Corporation" C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll File exists Logon %AllUsersProfile%\Startmenü\Programme\Autostart |||||| "desktop.ini" C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini File exists |||| "BTTray.lnk" "WIDCOMM, Inc." C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe Shortcut exists | File exists %UserProfile%\Startmenü\Programme\Autostart |||||| "desktop.ini" C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Autostart\desktop.ini File exists |||| "OpenOffice.org 3.1.lnk" C:\Programme\OpenOffice.org 3\program\quickstart.exe Shortcut exists | File found, but it contains no detailed information | File exists HKLM\Software\Microsoft\Windows\CurrentVersion\Run |||| "Adobe Reader Speed Launcher" "Adobe Systems Incorporated" "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" File exists |||| "ATIPTA" "ATI Technologies, Inc." C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe File exists |||||| "avgnt" "Avira GmbH" "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min File exists |||| "LogitechCommunicationsManager" "Logitech Inc." "C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe" File exists |||| "LogitechQuickCamRibbon" "Logitech Inc." "C:\Programme\Logitech\QuickCam\Quickcam.exe" /hide File exists |||| "PTHOSTTR" "Hewlett-Packard Development Company, L.P." C:\Programme\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start File exists |||| "QuickTime Task" "Apple Inc." "C:\Programme\QuickTime\qttask.exe" -atboottime File exists |||| "SoundMAXPnP" "Analog Devices, Inc." C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe File exists |||| "SunJavaUpdateSched" "Sun Microsystems, Inc." "C:\Programme\Java\jre6\bin\jusched.exe" File exists Print Monitors HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors |||||| "Bluetooth-Druckeranschluss" "WIDCOMM, Inc." C:\WINDOWS\system32\bthcrp.dll File exists Services HKLM\SYSTEM\CurrentControlSet\Services |||||| ".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) "Microsoft Corporation" c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe File exists |||||| "ASP.NET State Service" (aspnet_state) "Microsoft Corporation" C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe File exists |||||| "Avira AntiVir Guard" (AntiVirService) "Avira GmbH" C:\Programme\Avira\AntiVir Desktop\avguard.exe File exists |||||| "Avira AntiVir Planer" (AntiVirSchedulerService) "Avira GmbH" C:\Programme\Avira\AntiVir Desktop\sched.exe File exists |||||| "Bluetooth Service" (btwdins) "WIDCOMM, Inc." C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe File exists |||||| "HP WMI Interface" (hpqwmi) "Hewlett-Packard Development Company, L.P." C:\Programme\HPQ\Shared\hpqwmi.exe File exists |||| "InstallDriver Table Manager" (IDriverT) "Macrovision Corporation" c:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe File exists |||||| "Java Quick Starter" (JavaQuickStarterService) "Sun Microsystems, Inc." C:\Programme\Java\jre6\bin\jqs.exe File exists |||||| "LVCOMSer" (LVCOMSer) "Logitech Inc." C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe File exists |||||| "Personal Secure Drive Service" (PersonalSecureDriveService) "Infineon Technologies AG" C:\Programme\ProtectTools\Embedded Security Software\PSDsrvc.EXE File exists |||||| "Process Monitor" (LVPrcSrv) "Logitech Inc." C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe File exists |||||| "Security Platform Management Service" (IFXSpMgtSrv) "Infineon Technologies AG" C:\WINDOWS\system32\IFXSPMGT.exe File exists |||||| "SoundMAX Agent Service" (SoundMAX Agent Service (default)) "Analog Devices, Inc." C:\Programme\Analog Devices\SoundMAX\SMAgent.exe File exists |||||| "Trusted Platform Core Service" (IFXTCS) "Infineon Technologies AG" C:\WINDOWS\system32\IFXTCS.exe File exists |||||| "Windows CardSpace" (idsvc) "Microsoft Corporation" c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe File exists |||||| "Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) "Microsoft Corporation" c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe File exists Winlogon HKCU\Control Panel\IOProcs "MVB" mvfs32.dll File not found HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify |||||| "IfxWlxEN" "Infineon Technologies AG" C:\WINDOWS\system32\IfxWlxEN.dll File exists If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru |
|
10.09.2010, 15:09
| #9 |
| | Trojaner bei OnlineBanking entdeckt!? schon mal vielen vielen danke für deine schnelle hilfe!!! hier nun noch was beim bootkit remover: Bootkit Remover (c) 2009 eSage Lab www.esagelab.com Program version: 1.2.0.0 OS Version: Microsoft Windows XP Professional Service Pack 3 (build 2600) System volume is \\.\C: \\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 Boot sector MD5 is: 5ddc20efcc4d1dab37c348c7db7289cf Size Device Name MBR Status -------------------------------------------- 37 GB \\.\PhysicalDrive0 Unknown boot code Unknown boot code has been found on some of your physical disks. To inspect the boot code manually, dump the master boot sector: remover.exe dump <device_name> [output_file] To disinfect the master boot sector, use the following command: remover.exe fix <device_name> Done; Press any key to quit... |
|
11.09.2010, 11:38
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Trojaner bei OnlineBanking entdeckt!? Downloade Dir bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
11.09.2010, 15:12
| #11 |
| | Trojaner bei OnlineBanking entdeckt!? MBRCheck, version 1.2.3 (c) 2010, AD Command-line: Windows Version: Windows XP Professional Windows Information: Service Pack 3 (build 2600) Logical Drives Mask: 0x0000000c Kernel Drivers (total 135): 0x804D7000 \WINDOWS\system32\ntoskrnl.exe 0x806EF000 \WINDOWS\system32\hal.dll 0xF7AED000 \WINDOWS\system32\KDCOM.DLL 0xF79FD000 \WINDOWS\system32\BOOTVID.dll 0xF759D000 ACPI.sys 0xF7AEF000 \WINDOWS\system32\DRIVERS\WMILIB.SYS 0xF758C000 pci.sys 0xF75ED000 isapnp.sys 0xF7A01000 compbatt.sys 0xF7A05000 \WINDOWS\system32\DRIVERS\BATTC.SYS 0xF7BB5000 pciide.sys 0xF786D000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS 0xF7AF1000 intelide.sys 0xF756E000 pcmcia.sys 0xF75FD000 MountMgr.sys 0xF754F000 ftdisk.sys 0xF7AF3000 dmload.sys 0xF7529000 dmio.sys 0xF7A09000 ACPIEC.sys 0xF7BB6000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS 0xF7875000 PartMgr.sys 0xF760D000 VolSnap.sys 0xF7511000 atapi.sys 0xF761D000 disk.sys 0xF762D000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS 0xF74F1000 fltmgr.sys 0xF74DF000 sr.sys 0xF763D000 PxHelp20.sys 0xF74C8000 KSecDD.sys 0xF74B5000 WudfPf.sys 0xF7428000 Ntfs.sys 0xF73FB000 NDIS.sys 0xF73E1000 Mup.sys 0xF72B5000 btkrnl.sys 0xF764D000 agp440.sys 0xF767D000 \SystemRoot\system32\DRIVERS\intelppm.sys 0xF7136000 \SystemRoot\system32\DRIVERS\ati2mtag.sys 0xF7122000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS 0xF790D000 \SystemRoot\system32\DRIVERS\usbuhci.sys 0xF70FE000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0xF7915000 \SystemRoot\system32\DRIVERS\usbehci.sys 0xF7096000 \SystemRoot\system32\DRIVERS\bcmwl5.sys 0xF7B11000 \SystemRoot\system32\drivers\MbxStby.sys 0xF7069000 \SystemRoot\system32\drivers\o2mmb.sys 0xF703F000 \SystemRoot\system32\DRIVERS\b57xp32.sys 0xF768D000 \SystemRoot\system32\DRIVERS\serial.sys 0xF7AD5000 \SystemRoot\system32\DRIVERS\serenum.sys 0xF791D000 \SystemRoot\system32\DRIVERS\fdc.sys 0xF769D000 \SystemRoot\system32\DRIVERS\smcirda.sys 0xF7AD9000 \SystemRoot\system32\DRIVERS\irenum.sys 0xF7003000 \SystemRoot\system32\DRIVERS\parport.sys 0xF76AD000 \SystemRoot\system32\DRIVERS\i8042prt.sys 0xF7925000 \SystemRoot\system32\DRIVERS\kbdclass.sys 0xF792D000 \SystemRoot\system32\DRIVERS\mouclass.sys 0xF76BD000 \SystemRoot\system32\DRIVERS\imapi.sys 0xF76CD000 \SystemRoot\system32\DRIVERS\cdrom.sys 0xF76DD000 \SystemRoot\system32\DRIVERS\redbook.sys 0xF6FE0000 \SystemRoot\system32\DRIVERS\ks.sys 0xF6FA0000 \SystemRoot\system32\drivers\smwdm.sys 0xF6F7C000 \SystemRoot\system32\drivers\portcls.sys 0xF76FD000 \SystemRoot\system32\drivers\drmk.sys 0xF6F5C000 \SystemRoot\system32\drivers\aeaudio.sys 0xF6E57000 \SystemRoot\system32\DRIVERS\AGRSM.sys 0xF7935000 \SystemRoot\System32\Drivers\Modem.SYS 0xF728D000 \SystemRoot\system32\DRIVERS\CmBatt.sys 0xF7289000 \SystemRoot\system32\DRIVERS\wmiacpi.sys 0xF7BBA000 \SystemRoot\system32\DRIVERS\audstub.sys 0xF795D000 \SystemRoot\system32\DRIVERS\rasirda.sys 0xF7965000 \SystemRoot\system32\DRIVERS\TDI.SYS 0xF778D000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0xF7275000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0xF6E40000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0xF77AD000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0xF77BD000 \SystemRoot\system32\DRIVERS\raspptp.sys 0xF6D8F000 \SystemRoot\system32\DRIVERS\psched.sys 0xF77CD000 \SystemRoot\system32\DRIVERS\msgpc.sys 0xF7975000 \SystemRoot\system32\DRIVERS\ptilink.sys 0xF797D000 \SystemRoot\system32\DRIVERS\raspti.sys 0xF6D5F000 \SystemRoot\system32\DRIVERS\rdpdr.sys 0xF77DD000 \SystemRoot\system32\DRIVERS\termdd.sys 0xF7B33000 \SystemRoot\system32\DRIVERS\swenum.sys 0xF6CD9000 \SystemRoot\system32\DRIVERS\update.sys 0xF7A8D000 \SystemRoot\system32\DRIVERS\mssmbios.sys 0xF77FD000 \SystemRoot\System32\Drivers\NDProxy.SYS 0xF782D000 \SystemRoot\system32\DRIVERS\usbhub.sys 0xF7B53000 \SystemRoot\system32\DRIVERS\USBD.SYS 0xF79ED000 \SystemRoot\System32\drivers\psd.sys 0xF7BA3000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0xF7D35000 \SystemRoot\System32\Drivers\Null.SYS 0xF7BA5000 \SystemRoot\System32\Drivers\Beep.SYS 0xF7895000 \SystemRoot\System32\drivers\vga.sys 0xF7BA7000 \SystemRoot\System32\Drivers\mnmdd.SYS 0xF7BA9000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0xF789D000 \SystemRoot\System32\Drivers\Msfs.SYS 0xF78A5000 \SystemRoot\System32\Drivers\Npfs.SYS 0xF7AA1000 \SystemRoot\system32\DRIVERS\rasacd.sys 0xBA7CD000 \SystemRoot\system32\DRIVERS\ipsec.sys 0xBA774000 \SystemRoot\system32\DRIVERS\tcpip.sys 0xBA74C000 \SystemRoot\system32\DRIVERS\netbt.sys 0xBA72A000 \SystemRoot\System32\drivers\afd.sys 0xF772D000 \SystemRoot\system32\DRIVERS\netbios.sys 0xF78AD000 \SystemRoot\system32\DRIVERS\ssmdrv.sys 0xBA65F000 \SystemRoot\system32\DRIVERS\rdbss.sys 0xBA5EF000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0xF773D000 \SystemRoot\System32\Drivers\Fips.SYS 0xBA5C9000 \SystemRoot\system32\DRIVERS\ipnat.sys 0xBA585000 \SystemRoot\system32\DRIVERS\avipbb.sys 0xF7BAD000 \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys 0xF777D000 \SystemRoot\System32\Drivers\Cdfs.SYS 0xBA56D000 \SystemRoot\System32\Drivers\dump_atapi.sys 0xF7BAF000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS 0xBF800000 \SystemRoot\System32\win32k.sys 0xF7AE5000 \SystemRoot\System32\drivers\Dxapi.sys 0xF78C5000 \SystemRoot\System32\watchdog.sys 0xBF000000 \SystemRoot\System32\drivers\dxg.sys 0xF7BFE000 \SystemRoot\System32\drivers\dxgthk.sys 0xBF012000 \SystemRoot\System32\ati2dvag.dll 0xBF04E000 \SystemRoot\System32\ati2cqag.dll 0xBF081000 \SystemRoot\System32\atikvmag.dll 0xF6E20000 \SystemRoot\system32\DRIVERS\wanarp.sys 0xBF0B4000 \SystemRoot\System32\ati3duag.dll 0xBF2F2000 \SystemRoot\System32\ativvaxx.dll 0xBFFA0000 \SystemRoot\System32\ATMFD.DLL 0xB8419000 \SystemRoot\system32\DRIVERS\avgntflt.sys 0xB82C3000 \SystemRoot\system32\DRIVERS\irda.sys 0xBA5B9000 \SystemRoot\system32\DRIVERS\ndisuio.sys 0xB812E000 \SystemRoot\system32\DRIVERS\mrxdav.sys 0xF7B87000 \SystemRoot\System32\Drivers\ParVdm.SYS 0xB7F1F000 \SystemRoot\system32\DRIVERS\srv.sys 0xF79F5000 \SystemRoot\system32\DRIVERS\LVPr2Mon.sys 0xB7A82000 \SystemRoot\system32\drivers\wdmaud.sys 0xB7D97000 \SystemRoot\system32\drivers\sysaudio.sys 0xB752A000 \SystemRoot\System32\Drivers\HTTP.sys 0xB7254000 \SystemRoot\system32\drivers\kmixer.sys 0x7C910000 \WINDOWS\system32\ntdll.dll Processes (total 49): 0 System Idle Process 4 System 496 C:\WINDOWS\system32\smss.exe 564 csrss.exe 888 C:\WINDOWS\system32\winlogon.exe 932 C:\WINDOWS\system32\services.exe 944 C:\WINDOWS\system32\lsass.exe 1104 C:\WINDOWS\system32\ati2evxx.exe 1120 C:\WINDOWS\system32\svchost.exe 1216 svchost.exe 1256 C:\WINDOWS\system32\svchost.exe 1300 C:\WINDOWS\system32\svchost.exe 1452 svchost.exe 1532 svchost.exe 1828 C:\WINDOWS\system32\spoolsv.exe 1876 C:\Programme\Avira\AntiVir Desktop\sched.exe 1932 svchost.exe 436 C:\Programme\Avira\AntiVir Desktop\avguard.exe 480 C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe 572 C:\WINDOWS\system32\IFXSPMGT.exe 596 C:\WINDOWS\system32\IFXTCS.exe 636 C:\Programme\Java\jre6\bin\jqs.exe 672 C:\Programme\Gemeinsame Dateien\logishrd\LVCOMSER\LVComSer.exe 700 C:\Programme\Gemeinsame Dateien\logishrd\LVMVFM\LVPrcSrv.exe 776 C:\Programme\ProtectTools\Embedded Security Software\PSDsrvc.EXE 832 C:\Programme\Analog Devices\SoundMAX\SMAgent.exe 112 C:\WINDOWS\system32\svchost.exe 1496 alg.exe 4056 C:\WINDOWS\system32\ati2evxx.exe 416 C:\WINDOWS\explorer.exe 1692 C:\Programme\ProtectTools\Embedded Security Software\PSDrt.exe 252 C:\Programme\Gemeinsame Dateien\logishrd\LVCOMSER\LVComSer.exe 2288 C:\WINDOWS\AGRSMMSG.exe 2212 C:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe 2376 C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe 2352 C:\Programme\HPQ\HP ProtectTools Security Manager\pthosttr.exe 2368 C:\Programme\Java\jre6\bin\jusched.exe 2504 C:\Programme\Gemeinsame Dateien\logishrd\LComMgr\Communications_Helper.exe 2540 C:\Programme\Logitech\QuickCam\Quickcam.exe 2520 C:\Programme\Avira\AntiVir Desktop\avgnt.exe 2748 C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe 2996 C:\Programme\OpenOffice.org 3\program\soffice.exe 3156 C:\Programme\OpenOffice.org 3\program\soffice.bin 3172 C:\WINDOWS\system32\wuauclt.exe 3616 C:\Programme\Gemeinsame Dateien\logishrd\LQCVFX\COCIManager.exe 624 C:\Programme\Mozilla Firefox\firefox.exe 3008 C:\Programme\Skype\Phone\Skype.exe 4068 C:\Programme\Skype\Plugin Manager\skypePM.exe 3900 C:\Dokumente und Einstellungen\Administrator\Desktop\MBRCheck.exe \\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS) PhysicalDrive0 Model Number: FUJITSUMHT2040AH, Rev: 006C Size Device Name MBR Status -------------------------------------------- 37 GB \\.\PhysicalDrive0 Windows XP MBR code detected SHA1: ADFE55CD0C6ED2E00B22375835E4C2736CE9AD11 Done! |
|
11.09.2010, 15:45
| #12 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Trojaner bei OnlineBanking entdeckt!? Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs. Denk dran beide Tools zu updaten vor dem Scan!!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
11.09.2010, 18:10
| #13 |
| | Trojaner bei OnlineBanking entdeckt!? hier schon mal von superantispyware: SUPERAntiSpyware Scann-Protokoll hxxp://www.superantispyware.com Generiert 09/11/2010 bei 07:08 PM Version der Applikation : 4.42.1000 Version der Kern-Datenbank : 5489 Version der Spur-Datenbank : 3301 Scan Art : kompletter Scann Totale Scann-Zeit : 01:02:44 Gescannte Speicherelemente : 579 Erfasste Speicher-Bedrohungen : 0 Gescannte Register-Elemente : 6342 Erfasste Register-Bedrohungen : 0 Gescannte Datei-Elemente : 42823 Erfasste Datei-Elemente : 0 |
|
11.09.2010, 19:41
| #14 |
| | Trojaner bei OnlineBanking entdeckt!? Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Datenbank Version: 4594 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 11.09.2010 20:12:24 mbam-log-2010-09-11 (20-12-24).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Durchsuchte Objekte: 163712 Laufzeit: 50 Minute(n), 45 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) |
|
12.09.2010, 20:35
| #15 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Trojaner bei OnlineBanking entdeckt!? Sieht ok aus. Noch Probleme oder weitere Funde in der Zwischenzeit?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Trojaner bei OnlineBanking entdeckt!? |
| .com, 0x00000001, adblock, agere systems, antivir, avgntflt.sys, avira, bho, components, desktop, ebanking, error, festplatte, firefox.exe, flash player, format, helper.exe, homepage, ip-adresse, location, logfile, mozilla, msiinstaller, object, oldtimer, otl logfile, otl.exe, plug-in, registry, rundll, saver, sched.exe, searchplugins, security, senden, shell32.dll, sicherheit, software, speicherplatz, tan-liste, tcp, trojaner, udp, windows internet, windows internet explorer, wireless lan, wlan |
Linear-Darstellung
