| |
| |||||||
Log-Analyse und Auswertung: Internet sehr langsam, keine Downloads möglich -> Winsock LSP / prxerdrv.dll im LogfileWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
30.09.2010, 17:55
| #1 |
| /// Malware-holic   |  Internet sehr langsam, keine Downloads möglich -> Winsock LSP / prxerdrv.dll im Logfile ja einen trojaner der daten stiehlt also wenn an dem pc was wichtiges gemacht wird wäre neu aufsetzen vllt das beste. |
|
30.09.2010, 18:22
| #2 | |
| | Internet sehr langsam, keine Downloads möglich -> Winsock LSP / prxerdrv.dll im LogfileZitat:
[Code] Combofix Logfile: Code:
ATTFilter ComboFix 10-09-29.04 - ***** 30.09.2010 19:06:12.1.2 - x86
ausgeführt von:: v:\users\*****\Desktop\# DOWNLOADS\ComboFix.exe
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\install.exe
v:\windows\system32\ui
.
((((((((((((((((((((((( Dateien erstellt von 2010-08-28 bis 2010-09-30 ))))))))))))))))))))))))))))))
.
2010-09-30 17:11 . 2010-09-30 17:11 -------- d-----w- v:\users\*****\AppData\Local\temp
2010-09-30 16:29 . 2010-09-30 16:32 -------- d-----w- V:\_OTL
2010-09-30 16:16 . 2010-09-30 16:16 2560 ----a-w- v:\windows\_MSRSTRT.EXE
2010-09-30 15:37 . 2010-09-30 15:37 -------- d-----w- v:\users\*****\AppData\Roaming\Malwarebytes
2010-09-30 15:37 . 2010-04-29 10:19 38224 ----a-w- v:\windows\system32\drivers\mbamswissarmy.sys
2010-09-30 15:37 . 2010-09-30 15:37 -------- d-----w- v:\programdata\Malwarebytes
2010-09-30 15:37 . 2010-09-30 15:37 -------- d-----w- v:\program files\Malwarebytes' Anti-Malware
2010-09-30 15:37 . 2010-04-29 10:19 20952 ----a-w- v:\windows\system32\drivers\mbam.sys
2010-09-23 19:06 . 2010-09-23 19:06 -------- d-----w- v:\users\*****\AppData\Roaming\Printer Info Cache
2010-09-23 19:06 . 2010-09-23 19:06 -------- d-----w- v:\users\*****\AppData\Roaming\Image Zone Express
2010-09-23 16:26 . 2010-09-23 16:26 -------- d-----w- v:\programdata\WEBREG
2010-09-23 16:26 . 2010-09-23 16:33 -------- d-----w- v:\users\*****\AppData\Roaming\HP
2010-09-23 16:25 . 2010-09-23 16:25 -------- d-----w- v:\programdata\HPSSUPPLY
2010-09-23 16:22 . 2010-09-23 16:22 -------- d-----w- v:\program files\Hewlett-Packard
2010-09-23 16:22 . 2010-09-23 16:22 -------- d-----w- v:\program files\Common Files\Hewlett-Packard
2010-09-23 16:22 . 2010-09-23 16:25 -------- d-----w- v:\program files\Common Files\HP
2010-09-23 16:18 . 2010-09-23 16:26 164302 ----a-w- v:\windows\hpoins19.dat
2010-09-23 16:18 . 2010-09-23 16:27 -------- d-----w- v:\programdata\HP
2010-09-23 16:17 . 2007-03-13 19:50 26952 ----a-w- v:\windows\hpomdl19.dat
2010-09-20 22:04 . 2010-09-20 22:04 -------- d-----w- v:\program files\Conduit
2010-09-15 14:37 . 2010-09-15 14:37 -------- d-----w- v:\program files\XP TCPIP Repair
2010-09-10 14:39 . 2010-09-10 14:39 1079048 ----a-w- v:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-30 16:24 . 2009-08-29 15:48 -------- d-----w- v:\programdata\Lavasoft
2010-09-30 16:24 . 2009-08-29 15:48 -------- d-----w- v:\program files\Lavasoft
2010-09-30 16:23 . 2009-08-29 16:23 -------- d-----w- v:\programdata\Spybot - Search & Destroy
2010-09-30 15:40 . 2009-09-26 20:09 -------- d-----w- v:\program files\Google
2010-09-24 16:02 . 2009-08-29 17:56 -------- d-----w- v:\program files\Common Files\Adobe
2010-09-24 15:26 . 2009-09-16 20:44 1 ----a-w- v:\users\*****\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-09-23 16:25 . 2009-08-23 21:05 -------- d-----w- v:\program files\HP
2010-09-23 16:19 . 2006-11-02 10:25 86016 ----a-w- v:\windows\Inf\infstor.dat
2010-09-23 16:19 . 2006-11-02 10:25 51200 ----a-w- v:\windows\Inf\infpub.dat
2010-09-23 16:19 . 2006-11-02 10:25 143360 ----a-w- v:\windows\Inf\infstrng.dat
2010-09-20 22:06 . 2009-08-24 19:56 -------- d-----w- v:\programdata\Messenger Plus!
2010-09-20 22:03 . 2009-08-24 19:54 -------- d-----w- v:\program files\Messenger Plus! Live
2010-09-15 18:48 . 2009-08-23 22:24 -------- d-----w- v:\program files\Steganos Internet Anonym VPN
2010-09-15 18:46 . 2010-04-04 15:53 -------- d-sh--w- v:\programdata\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2010-09-15 18:46 . 2009-08-23 17:21 -------- d-----w- v:\programdata\NVIDIA
2010-09-15 18:46 . 2009-08-23 17:14 -------- d-----w- v:\program files\SystemRequirementsLab
2010-09-15 18:46 . 2009-08-23 21:00 -------- d--h--w- v:\program files\InstallShield Installation Information
2010-09-14 19:40 . 2009-08-24 17:15 -------- d-----w- v:\program files\CCleaner
2010-09-14 18:58 . 2009-08-24 15:25 -------- d-----w- v:\program files\TuneUp Utilities 2009
2010-09-14 18:53 . 2009-08-29 15:33 -------- d-----w- v:\programdata\Norton
2010-09-14 18:38 . 2009-08-29 15:32 -------- d-----w- v:\programdata\NortonInstaller
2010-09-07 08:29 . 2009-08-25 15:36 -------- d-----w- v:\users\*****\AppData\Roaming\vlc
2010-08-26 11:39 . 2009-04-11 16:55 628430 ----a-w- v:\windows\system32\perfh007.dat
2010-08-26 11:39 . 2009-04-11 16:55 126236 ----a-w- v:\windows\system32\perfc007.dat
2010-08-20 14:23 . 2010-08-20 14:23 -------- d-----w- v:\program files\City Interactive
2010-08-17 17:42 . 2010-08-17 17:42 -------- d-----w- v:\program files\MyRealGames.com
2010-08-07 18:27 . 2010-08-07 18:27 -------- d-----w- v:\program files\prophetsoft
2010-08-03 18:41 . 2010-08-03 18:41 0 ---ha-w- v:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2010-08-02 16:15 . 2010-07-29 16:14 -------- d-----w- v:\program files\Panzer Simulator - 30 Minuten Demo
2010-08-02 16:13 . 2009-08-26 22:18 -------- d-----w- v:\program files\AGEIA Technologies
2010-08-02 16:12 . 2010-08-02 16:12 -------- d-----w- v:\program files\Common Files\Wise Installation Wizard
2010-08-01 12:56 . 2010-08-01 12:56 53248 ----a-r- v:\users\*****\AppData\Roaming\Microsoft\Installer\{3F5635E9-FDB2-4220-8D4B-17E0035994DA}\SC_stargame1_3F5635E9FDB242208D4B17E0035994DA.exe
2010-08-01 12:56 . 2010-08-01 12:56 53248 ----a-r- v:\users\*****\AppData\Roaming\Microsoft\Installer\{3F5635E9-FDB2-4220-8D4B-17E0035994DA}\NewShortcut1_3F5635E9FDB242208D4B17E0035994DA.exe
2010-08-01 12:56 . 2010-08-01 12:56 10134 ----a-r- v:\users\*****\AppData\Roaming\Microsoft\Installer\{3F5635E9-FDB2-4220-8D4B-17E0035994DA}\ARPPRODUCTICON.exe
2010-07-17 18:02 . 2010-06-15 16:10 1024 ----a-w- v:\programdata\BVRP Software\mobile PhoneTools\faxres.cmd
2010-07-05 14:51 . 2009-09-04 23:44 139128 ----a-w- v:\windows\system32\drivers\PnkBstrK.sys
2010-07-05 14:51 . 2009-09-04 23:44 215128 ----a-w- v:\windows\system32\PnkBstrB.exe
2010-07-04 20:55 . 2009-08-23 17:05 8268 ----a-w- v:\users\*****\AppData\Local\d3d9caps.dat
2010-07-04 15:51 . 2010-07-04 15:51 552 ----a-w- v:\users\*****\AppData\Local\d3d8caps.dat
2010-07-04 14:10 . 2009-09-04 23:44 75064 ----a-w- v:\windows\system32\PnkBstrA.exe
2010-07-04 14:08 . 2010-07-04 14:08 138056 ----a-w- v:\users\*****\AppData\Roaming\PnkBstrK.sys
2010-07-04 14:08 . 2010-07-04 14:08 138056 ----a-w- v:\users\*****\AppData\Roaming\PnkBstrK.sys
2010-07-04 14:08 . 2010-07-04 14:08 2434856 ----a-w- v:\windows\system32\pbsvc_bc2.exe
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Logitech Vid"="v:\program files\Logitech\Logitech Vid\vid.exe" [2009-07-16 5458704]
"msnmsgr"="v:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-08-24 3883840]
"WMPNSCFG"="v:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"ehTray.exe"="v:\windows\ehome\ehTray.exe" [2008-01-21 125952]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="v:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-03-12 6965792]
"OODefragTray"="v:\windows\system32\oodtray.exe" [2008-09-04 2524416]
"LogitechQuickCamRibbon"="v:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-10-14 2793304]
"NvSvc"="v:\windows\system32\nvsvc.dll" [2007-06-16 86016]
"NvCplDaemon"="v:\windows\system32\NvCpl.dll" [2007-06-16 8466432]
"NvMediaCenter"="v:\windows\system32\NvMcTray.dll" [2007-06-16 81920]
"HP Software Update"="v:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
v:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - v:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-792815470-2588575354-2298569724-1000]
"EnableNotificationsRef"=dword:00000001
R0 Lbd;Lbd;v:\windows\system32\DRIVERS\Lbd.sys [x]
R2 AVPNStarter;Steganos Anonym VPN Starter Service;v:\program files\Steganos Internet Anonym VPN\AVPNStarter.exe [2009-01-05 21504]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;v:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);v:\program files\Google\Update\GoogleUpdate.exe [2009-09-26 133104]
R3 WDC_SAM;WD SCSI Pass Thru driver;v:\windows\system32\DRIVERS\wdcsam.sys [2009-02-13 11520]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;v:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 sptd;sptd;v:\windows\system32\Drivers\sptd.sys [2009-08-26 722416]
S2 acedrv11;acedrv11;v:\windows\system32\drivers\acedrv11.sys [2009-01-19 277544]
S2 MotoConnect Service;MotoConnect Service;v:\program files\Motorola\MotoConnectService\MotoConnectService.exe [2009-12-14 92928]
S3 3xHybrid;Philips SAA713x PCI Card;v:\windows\system32\DRIVERS\3xHybrid.sys [2008-01-08 1302368]
S3 tapavpn;Steganos Anonym VPN Adapter;v:\windows\system32\DRIVERS\tapavpn.sys [2007-10-19 24320]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7070D8E0-650A-46b3-B03C-9497582E6A74}]
2008-04-11 15:23 38400 ----a-w- v:\windows\System32\SoundSchemes.exe
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{B3688A53-AB2A-4b1d-8CEF-8F93D8C51C24}]
2008-08-28 08:50 30720 ----a-w- v:\windows\System32\soundschemes2.exe
.
Inhalt des "geplante Tasks" Ordners
2010-09-30 v:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- v:\program files\Google\Update\GoogleUpdate.exe [2009-09-26 20:08]
2010-09-30 v:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- v:\program files\Google\Update\GoogleUpdate.exe [2009-09-26 20:08]
2009-08-24 v:\windows\Tasks\{2034705D-2D06-4701-8766-5D6C9CE0234E}.job
- v:\program files\Skype\Phone\Skype.exe [2009-07-16 11:20]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
LSP: %SystemRoot%\system32\PrxerDrv.dll
FF - ProfilePath - v:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\yf15we85.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2719325&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - google.de
FF - plugin: v:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: v:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: v:\program files\Veetle\Player\npvlc.dll
FF - plugin: v:\program files\Veetle\plugins\npVeetle.dll
FF - plugin: v:\program files\VistaCodecPack\rm\browser\plugins\nppl3260.dll
FF - plugin: v:\program files\VistaCodecPack\rm\browser\plugins\nprpjplug.dll
FF - plugin: v:\windows\system32\TVUAx\npTVUAx.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - v:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX Richtlinien ----
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
v:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
v:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
v:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
AddRemove-Monopoly Deluxe - h:\spiele\Monopoly2\Monopoly Deluxe\GameInstlr.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-09-30 19:11
Windows 6.0.6002 Service Pack 2 NTFS
Scanne versteckte Prozesse...
Scanne versteckte Autostarteinträge...
Scanne versteckte Dateien...
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
[HKEY_USERS\S-1-5-21-792815470-2588575354-2298569724-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:e0,d3,f8,ff,1e,7a,a0,34,e9,e7,9d,61,7c,d9,17,68,87,29,08,50,6e,52,db,
fb,d0,82,aa,63,27,59,fa,b1,d3,b7,3b,70,a8,77,00,d0,13,fc,e0,f6,aa,67,93,56,\
"??"=hex:f4,21,c1,5a,54,86,41,09,f6,cd,22,86,5e,3c,20,f0
[HKEY_USERS\S-1-5-21-792815470-2588575354-2298569724-1000\Software\SecuROM\License information*]
@Allowed: (Read) (RestrictedCode)
"datasecu"=hex:9a,6d,c5,8b,15,7c,7b,8e,4f,ef,ad,e4,14,54,58,77,f9,db,4a,8f,dc,
cc,25,fa,ca,79,c6,1a,47,08,ec,99,d0,e9,2a,46,dc,4f,4d,66,a3,52,12,f7,1a,d6,\
"rkeysecu"=hex:9f,cb,91,12,08,ea,67,33,f1,85,d1,81,a6,c8,1f,99
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG11.00.00.01WORKSTATION"="8FD0A80169DD31AD8D0F7F066D7C9CBF52607CDB52DD2DF9ED0F4754B0733DA0101657E9FD3379156215FA9FE8F4B1DD6A2174AFC7A9BB8185FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933C038D530D6EB3452FEBC9E127BECC74CBA7FD869164D67943AE8511FB3777587C6202EC645077DD48D1ABB06DC2C1AF96339A9314EF405920CE439BE983BA602099CE7B59C876F6AB0A3F7AA2082FAAD24BF38CC22770F0A82FE2D0B7F655F407C157AB8E7262AC22AC22857A31C1D863ED630D9A3F78D52FD2F608BED078726105B8B7AC71D9BB6954488F642FC926C9C6302220EE3DA01D5151A8D9A985B1FA7E85767108B069F05956939110DC1CA9B6FB3B8D00E2033D470B3A3F3726D979AD6AC324C757F5C7A4D2F105598E5920D27DD6E8E29DF8AB6299BA29A54A081B2E46F5239C1F0CFED22D0348A508E3435DBAEDE1FD1E92BAFC8D2A2E0DEAED1B0F49601493C97DF4DEEDCA05E481DAACC02E5630F02E9BD65FB7102D19AA484460F2CBB201486F7F6B57193B379496F0132DA1D9C1ED96FEF16A1E1A9EFE1149A5DD1461ADC23863F19449020BF1E03732AF4F03C6A09EFDF8C21A6D6AF1D05482FB825410E27FDED611C5EEFDB79E939CA3286140F9D74B5794278008ADDDA5F7728A35A82A05640F95789A0730FA95B19A4C9021B8CB5681A6AC67C170120624D7D5058FA7008E473645F640C644F55BC6FEA9300237061D096425ACF3862496AA67B6619CD9381014974239355EA9A03CEDD8D1200657EA3D15E58930634FCAEA63CE1E5417AACFA9C9EF5DB10100EDE8DDBE68B195891BB4056EB24C6A95E9D94ED5B4BA74472DC8A7BAB9618550AE18E604A89B312E1E89626BC2824DDC05C1DAC191AB5F9D24855E6C75EC3565BC7462B980D6D61A81A220FA82A20ECE8387E5C15046F2C437E4F0600AE3D34426B3DBFE4FB35139367BD173F188FF9931E8B217C222E6C2AE9E2BF3E680591F3CF92E7F6A04F00458ADD0646C41B296FA02DE7AF6FA0D2E3140A3FA2CDEB169A9876AF4AA652FCD3600869B4E73FA5A078DCDC454B48F7C1AE56737E8A1AED538E2EE50D9F2CE9C86C5792B719CC9C3C002B710778FA7B060C6A90582988482D9E9320A4031AA52353F8972F58E93F4E35BADDF29EE2006926810CEA9A88D8AE599336A8A73294D35E2F5031888D44D5BB421CB8C97C2C9818652125B23BD65074AEC2E1CCDAA0C07DD0DA05EF8463C45A0FE83F681A2B339F7750A92A97FE804AFA2853124FB5454148182737715C05FB7E479FCE622B4C24AB5CCE1EE8119D54A2892FFEA1C42DDF93AC48EEC6EEEDAF84FD27B3CEDE6C2B0B4B1F8ECDCE7FB5E1CE5B7B3342BD334581CD88CEE251A7A89458B22D7B11E1B0E9D7DE39"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2010-09-30 19:14:57
ComboFix-quarantined-files.txt 2010-09-30 17:14
Vor Suchlauf: 10 Verzeichnis(se), 11.874.267.136 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 11.598.757.888 Bytes frei
- - End Of File - - 71A9AE47D41F8FBB7831F6D4E48F7265
Vielleicht besteht eine Chance den Übeltäter zu entfernen. :\ Achja, hast Du vllt eine Idee wie ich diese 3 Einträge aus dem HijackThis Log korrekt entferne, ohne LSP-Fix. LSP-Fix sagt "No Problems Founds O10 - Unknown file in Winsock LSP: v:\windows\system32\prxernsp.dll O10 - Unknown file in Winsock LSP: v:\windows\system32\prxerdrv.dll O10 - Unknown file in Winsock LSP: v:\windows\system32\prxerdrv.dll MfG, Dennis |
|
| Themen zu Internet sehr langsam, keine Downloads möglich -> Winsock LSP / prxerdrv.dll im Logfile |
| ad-aware, ad-watch, adobe, avp, bho, dll, explorer, firefox, google, hijack, hijackthis, internet, internet explorer, internet sehr langsam, keine downloads, langsam, logfile, mozilla, object, plug-in, problem, realtek, rundll, safer networking, security, sehr langsam, software, system, tcp/ip, vista, windows, wmp |
Hybrid-Darstellung
