Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13"

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML

Antwort
Alt 14.10.2010, 16:11   #1
Maikeost
 
Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13" - Standard

Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13"



Hallo!

Seit 2 Tagen erhalte ich immer wieder Meldungen von Norton, dass folgender Angriff erkannt wurde:

HTTP Malicious Toolkit Variant Activity 13
Angreifender Computer: Mein eigener?!
Agreifer-URL: bikleman.com/sex/inex.php?s=IBB@G
Zieladresse: bikleman.com (80.156.86.78 80)
Beschreibung des Datenverkehrs: TCP, Port 49178

Habe nun das Programm SUPERAntiSpyware mein System scannen lassen und folgenden Log erhalten:

SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 10/14/2010 at 04:57 PM

Application Version : 4.44.1000

Core Rules Database Version : 5682
Trace Rules Database Version: 3494

Scan type : Complete Scan
Total Scan Time : 01:37:48

Memory items scanned : 795
Memory threats detected : 0
Registry items scanned : 9796
Registry threats detected : 0
File items scanned : 52369
File threats detected : 111

Adware.Tracking Cookie
cdn5.specificclick.net [ C:\Users\Arbeit\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\FQBFC2YY ]
.doubleclick.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.apmebf.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.ads.quartermedia.de [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.ads.quartermedia.de [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.mediaplex.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.mediaplex.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.imrworldwide.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.imrworldwide.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.ads.quartermedia.de [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.bs.serving-sys.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.serving-sys.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.serving-sys.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.serving-sys.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.serving-sys.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.serving-sys.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.ads.quartermedia.de [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.ads.quartermedia.de [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.adfarm1.adition.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
track.effiliation.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.adtech.de [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.smartadserver.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.smartadserver.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.smartadserver.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.smartadserver.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.tradedoubler.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.tradedoubler.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.webmasterplan.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.traffictrack.de [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.atdmt.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.atdmt.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.guj.122.2o7.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
de.sitestat.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
track.webtrekk.de [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.tradedoubler.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
ad.zanox.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.tracking.quisma.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
tracking.quisma.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.adbrite.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.fastclick.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.specificclick.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.specificclick.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.specificclick.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.specificclick.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.specificclick.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.specificclick.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.specificclick.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.adviva.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
cdn5.specificclick.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
eas.apm.emediate.eu [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
cdn5.specificclick.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.specificclick.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.statcounter.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.revsci.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.revsci.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.revsci.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.4stats.de [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.serving-sys.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.serving-sys.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
www.zanox-affiliate.de [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.fastclick.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.adinterax.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.adinterax.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.xiti.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.secmedia.de [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
de.sitestat.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
de.sitestat.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
rotator.adjuggler.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
rotator.adjuggler.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
track.effiliation.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
ad.adserver01.de [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
adsrv.admediate.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
adsrv.admediate.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.bluestreak.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.tradedoubler.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.tradedoubler.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.specificclick.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.specificclick.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
eas.apm.emediate.eu [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
eas.apm.emediate.eu [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.zieltrack.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
studivz.adfarm1.adition.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
adfarm1.adition.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.webmasterplan.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
www.etracker.de [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
track.adform.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
track.adform.net [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.tradedoubler.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
.tradedoubler.com [ C:\Users\Arbeit\AppData\Roaming\Mozilla\Firefox\Profiles\1p9fqmk9.default\cookies.sqlite ]
akamai.smartadserver.com [ C:\Users\Maike\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\6HMJC5ML ]
bc.youporn.com [ C:\Users\Maike\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\6HMJC5ML ]
cdn5.specificclick.net [ C:\Users\Maike\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\6HMJC5ML ]
content.oddcast.com [ C:\Users\Maike\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\6HMJC5ML ]
imagesrv.adition.com [ C:\Users\Maike\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\6HMJC5ML ]
media01.kyte.tv [ C:\Users\Maike\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\6HMJC5ML ]
objects.tremormedia.com [ C:\Users\Maike\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\6HMJC5ML ]
www.pornme.in [ C:\Users\Maike\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\6HMJC5ML ]
www.revenuewire.com [ C:\Users\Maike\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\6HMJC5ML ]
www.sexkiste.com [ C:\Users\Maike\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\6HMJC5ML ]
C:\Users\Maike\AppData\Roaming\Microsoft\Windows\Cookies\Low\maike@www.googleadservices[1].txt
C:\Users\Maike\AppData\Roaming\Microsoft\Windows\Cookies\Low\maike@www.googleadservices[7].txt
C:\Users\Maike\AppData\Roaming\Microsoft\Windows\Cookies\Low\maike@www.googleadservices[6].txt
C:\Users\Maike\AppData\Roaming\Microsoft\Windows\Cookies\Low\maike@www.googleadservices[4].txt
C:\Users\Maike\AppData\Roaming\Microsoft\Windows\Cookies\Low\maike@www.googleadservices[3].txt
C:\Users\Maike\AppData\Roaming\Microsoft\Windows\Cookies\Low\maike@www.googleadservices[2].txt
C:\Users\Maike\AppData\Roaming\Microsoft\Windows\Cookies\Low\maike@www.googleadservices[5].txt


mehrere Tracking Cookies.
Was kann ich gegen den Hack Angriff tun? Habe in keinem Forum wirkliche Hilfen finden können.
Wisst ihr, was zu tun ist?

Alt 14.10.2010, 20:53   #2
Swisstreasure
/// Malwareteam
 
Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13" - Standard

Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13"





Eine Bereinigung ist mitunter mit viel Arbeit für Dich verbunden.
  • Bitte arbeite alle Schritte der Reihe nach ab.
  • Lese die Anleitungen sorgfältig. Sollte es Probleme geben, bitte stoppen und hier so gut es geht beschreiben.
  • Nur Scanns durchführen zu denen Du von einem Helfer aufgefordert wirst.
  • Bitte kein Crossposting ( posten in mehreren Foren).
  • Installiere oder Deinstalliere während der Bereinigung keine Software ausser Du wurdest dazu aufgefordert.
  • Lese Dir die Anleitung zuerst vollständig durch. Sollte etwas unklar sein, frage bevor Du beginnst.
  • Poste die Logfiles direkt in deinen Thread. Nicht anhängen ausser ich fordere Dich dazu auf. Erschwert mir nämlich das auswerten.

Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der Schnellere und immer der sicherste Weg.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist.

Vista und Win7 User
Alle Tools mit Rechtsklick "als Administrator ausführen" starten.

Schritt 1

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
  • Starte bitte die OTL.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Kopiere nun den Inhalt in die Textbox.
Code:
ATTFilter
netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
/md5start
explorer.exe
winlogon.exe
wininit.exe
/md5stop
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
         
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Quick Scan Button.
  • Klick auf .
  • Kopiere nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

Schritt 2

Rootkit-Suche mit Gmer

Was sind Rootkits?

Wichtig: Bei jedem Rootkit-Scans soll/en:
  • Deaktiviere zunächst nach dieser Anleitung evtl. vorhandene CD-Emulatoren wie Alcohol, Daemon-Tools oder ähnliche.
  • Alle anderen Programme gegen Viren, Spyware, usw. deaktiviert sein,
  • keine Verbindung zu einem Netzwerk/Internet bestehen (WLAN nicht vergessen),
  • nichts am Rechner getan werden,
  • nach jedem Scan der Rechner neu gestartet werden.
  • Nicht vergessen, nach dem Rootkit-Scan die Security-Programme wieder einzuschalten!

Lade Dir Gmer von dieser Seite herunter
(auf den Button Download EXE drücken) und das Programm auf dem Desktop speichern.
  • Alle anderen Programme sollen geschlossen sein.
  • Starte gmer.exe (hat einen willkürlichen Programm-Namen).
  • Vista-User mit Rechtsklick und als Administrator starten.
  • Gmer startet automatisch einen ersten Scan.
  • Sollte sich ein Fenster mit folgender Warnung öffnen:
    Code:
    ATTFilter
    WARNING !!!
    GMER has found system modification, which might have been caused by ROOTKIT activity.
    Do you want to fully scan your system?
             
  • Unbedingt auf "No" klicken,
    in dem Fall über den Save-Button das bisherige Resultat auf dem Desktop als gmer_first.log speichern.

    .
  • Falls das nicht der Fall war, wähle nun den Reiter "Rootkit/Malware",
  • Hake an: System, Sections, Devices, Modules, Processes, Threads, Libraries, Services, Registry und Files.
  • Wichtig: "Show all" darf nicht angehakt sein!
  • Starte den Scan durch Drücken des Buttons "Scan".
    Mache nichts am Computer während der Scan läuft (unten links wird angezeigt, was gerade gescannt wird).
  • Wenn der Scan fertig ist, bleibt die Zeile leer.
    Kllicke auf "Save" und speichere das Logfile als gmer.log auf dem Desktop.
    Mit "Ok" wird GMER beendet.
Antiviren-Programm und sonstige Scanner wieder einschalten, bevor Du ins Netz gehst!

Nun das Logfile in Code-Tags posten.
__________________


Alt 15.10.2010, 16:03   #3
Maikeost
 
Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13" - Standard

Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13"



Hallo!

ERstmal super lieben Dank für die rasche Unterstützung. Das gibt mir Hoffnung!

Hier nun der neue Log:OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 15.10.2010 16:38:26 - Run 1
OTL by OldTimer - Version 3.2.15.2     Folder = C:\Users\Maike\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18975)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 60,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 82,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 149,04 Gb Total Space | 73,63 Gb Free Space | 49,40% Space Free | Partition Type: NTFS
Drive D: | 137,33 Gb Total Space | 136,19 Gb Free Space | 99,17% Space Free | Partition Type: NTFS
Drive F: | 149,04 Gb Total Space | 148,83 Gb Free Space | 99,86% Space Free | Partition Type: NTFS
Drive G: | 149,04 Gb Total Space | 148,95 Gb Free Space | 99,94% Space Free | Partition Type: NTFS
 
Computer Name: MAIKESPC | User Name: Maike | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 90 Days
 
========== Processes (SafeList) ==========
 
PRC - [2010.10.15 16:36:03 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\Maike\Desktop\OTL.exe
PRC - [2010.08.13 12:58:56 | 000,144,672 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010.02.26 02:21:50 | 000,126,392 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton Internet Security\Engine\17.8.0.5\ccSvcHst.exe
PRC - [2009.08.04 03:29:47 | 000,033,136 | ---- | M] () -- C:\Windows\ASScrPro.exe
PRC - [2009.05.06 08:54:13 | 007,440,928 | ---- | M] (Realtek Semiconductor) -- C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.03.04 19:26:24 | 008,392,704 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe
PRC - [2009.02.21 06:08:12 | 000,211,512 | ---- | M] (ATK) -- C:\Program files\P4G\BatteryLife.exe
PRC - [2008.12.30 01:32:54 | 000,237,693 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\SB Audigy\Volume Panel\VolPanlu.exe
PRC - [2008.12.29 12:27:37 | 000,307,200 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\Shared Files\CTAudSvc.exe
PRC - [2008.12.10 00:00:58 | 000,297,528 | ---- | M] (ASUS) -- C:\Program Files\ASUS\SmartLogon\sensorsrv.exe
PRC - [2008.10.01 08:02:48 | 000,851,968 | ---- | M] (ATK) -- C:\Program Files\ASUS\Splendid\ACMON.exe
PRC - [2008.08.19 19:34:04 | 000,159,744 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Media\DMedia.exe
PRC - [2008.08.18 19:56:22 | 000,098,304 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
PRC - [2008.07.19 04:52:16 | 000,104,936 | ---- | M] (CyberLink) -- C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
PRC - [2008.04.01 08:09:30 | 000,266,240 | ---- | M] (ASUSTek Computer Inc.) -- C:\Program Files\ASUS\ASUS Data Security Manager\ADSMTray.exe
PRC - [2008.03.31 11:55:48 | 000,225,280 | ---- | M] (ASUSTek Computer Inc.) -- C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe
PRC - [2007.11.30 20:20:44 | 000,051,768 | ---- | M] () -- C:\Program Files\ASUS\ASUS Live Update\ALU.exe
PRC - [2007.08.03 12:24:54 | 000,125,496 | ---- | M] () -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
PRC - [2005.07.07 00:43:42 | 000,155,648 | ---- | M] (ASUSTeK) -- C:\Windows\System32\ACEngSvr.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2010.10.15 16:36:03 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\Maike\Desktop\OTL.exe
MOD - [2010.09.20 21:26:01 | 000,415,088 | R--- | M] (Symantec Corporation) -- C:\PROGRAM FILES\NORTON INTERNET SECURITY\ENGINE\17.8.0.5\ASOEHOOK.DLL
MOD - [2010.08.31 17:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll
MOD - [2009.07.12 10:02:02 | 000,653,120 | R--- | M] (Microsoft Corporation) -- C:\PROGRAM FILES\NORTON INTERNET SECURITY\ENGINE\17.8.0.5\Microsoft.VC90.CRT\MSVCR90.dll
MOD - [2009.07.12 10:02:00 | 000,569,664 | R--- | M] (Microsoft Corporation) -- C:\PROGRAM FILES\NORTON INTERNET SECURITY\ENGINE\17.8.0.5\Microsoft.VC90.CRT\MSVCP90.dll
MOD - [2008.01.21 04:24:37 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msscript.ocx
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2010.08.13 12:58:56 | 000,144,672 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010.03.18 13:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.26 02:21:50 | 000,126,392 | R--- | M] (Symantec Corporation) [Unknown | Running] -- C:\Program Files\Norton Internet Security\Engine\17.8.0.5\ccSvcHst.exe -- (NIS)
SRV - [2009.12.04 11:23:14 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2009.09.25 03:27:04 | 000,793,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache)
SRV - [2009.08.04 03:03:16 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe -- (Creative ALchemy AL6 Licensing Service)
SRV - [2009.08.04 03:03:05 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service)
SRV - [2008.12.29 12:27:37 | 000,307,200 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService)
SRV - [2008.12.08 17:01:58 | 000,533,344 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Live\Family Safety\fsssvc.exe -- (fsssvc)
SRV - [2008.08.14 05:59:52 | 000,100,920 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe -- (ASLDRService)
SRV - [2008.03.31 11:55:48 | 000,225,280 | ---- | M] (ASUSTek Computer Inc.) [Auto | Running] -- C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe -- (ADSMService)
SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2007.08.08 09:08:40 | 000,094,208 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv)
SRV - [2007.08.03 12:24:54 | 000,125,496 | ---- | M] () [Auto | Running] -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe -- (spmgr)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipswuio.sys -- (ipswuio)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - [2010.09.29 17:32:22 | 001,371,184 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20101014.040\NAVEX15.SYS -- (NAVEX15)
DRV - [2010.09.29 17:32:21 | 000,086,064 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20101014.040\NAVENG.SYS -- (NAVENG)
DRV - [2010.09.15 20:02:21 | 000,353,840 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20101012.001\IDSvix86.sys -- (IDSVix86)
DRV - [2010.09.01 00:57:04 | 000,692,272 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20101001.001\BHDrvx86.sys -- (BHDrvx86)
DRV - [2010.05.27 07:52:53 | 000,102,448 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2010.05.27 07:52:52 | 000,371,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2010.05.10 20:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010.05.06 06:01:59 | 000,339,504 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\Drivers\NIS\1108000.005\SYMTDIV.SYS -- (SYMTDIv)
DRV - [2010.04.29 07:03:51 | 000,116,784 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\system32\drivers\NIS\1108000.005\Ironx86.SYS -- (SymIRON)
DRV - [2010.04.22 05:02:20 | 000,173,104 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\system32\drivers\NIS\1108000.005\SYMEFA.SYS -- (SymEFA)
DRV - [2010.04.22 04:29:50 | 000,325,680 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\Drivers\NIS\1108000.005\SRTSP.SYS -- (SRTSP)
DRV - [2010.04.22 04:29:50 | 000,043,696 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\system32\drivers\NIS\1108000.005\SRTSPX.SYS -- (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV - [2010.02.26 02:22:57 | 000,501,888 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\system32\drivers\NIS\1108000.005\ccHPx86.sys -- (ccHP)
DRV - [2010.02.17 20:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS -- (SASDIFSV)
DRV - [2009.12.30 15:58:16 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2009.12.30 15:58:16 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2009.11.14 17:11:08 | 000,124,976 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2009.11.06 00:06:13 | 000,328,752 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\NIS\1108000.005\SYMDS.SYS -- (SymDS)
DRV - [2009.07.02 01:59:00 | 009,786,752 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009.05.04 11:25:55 | 002,365,792 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2009.02.11 11:11:49 | 000,329,752 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\iaStor.sys -- (iaStor)
DRV - [2008.12.08 17:01:52 | 000,055,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\fssfltr.sys -- (fssfltr)
DRV - [2008.08.11 04:14:11 | 001,752,704 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
DRV - [2008.08.07 02:26:07 | 000,124,928 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2008.07.29 00:53:46 | 000,919,552 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2008.07.10 03:16:21 | 000,081,960 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btwaudio.sys -- (btwaudio)
DRV - [2008.06.25 00:55:12 | 000,047,104 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2008.06.03 08:41:51 | 000,015,928 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\kbfiltr.sys -- (kbfiltr)
DRV - [2008.05.14 07:02:25 | 000,017,320 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btwrchid.sys -- (btwrchid)
DRV - [2008.05.14 07:02:23 | 000,100,392 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btwavdt.sys -- (btwavdt)
DRV - [2008.01.29 20:46:57 | 000,029,736 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btwl2cap.sys -- (btwl2cap)
DRV - [2008.01.21 04:23:27 | 000,386,616 | ---- | M] (LSI Corporation, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasr.sys -- (MegaSR)
DRV - [2008.01.21 04:23:27 | 000,149,560 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)
DRV - [2008.01.21 04:23:27 | 000,031,288 | ---- | M] (LSI Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)
DRV - [2008.01.21 04:23:26 | 000,101,432 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2008.01.21 04:23:26 | 000,074,808 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2008.01.21 04:23:26 | 000,040,504 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)
DRV - [2008.01.21 04:23:25 | 000,300,600 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)
DRV - [2008.01.21 04:23:25 | 000,089,656 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2008.01.21 04:23:24 | 001,122,360 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)
DRV - [2008.01.21 04:23:24 | 000,118,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R)
DRV - [2008.01.21 04:23:24 | 000,079,928 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)
DRV - [2008.01.21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)
DRV - [2008.01.21 04:23:23 | 000,130,616 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2008.01.21 04:23:23 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2008.01.21 04:23:23 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2008.01.21 04:23:23 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2008.01.21 04:23:23 | 000,079,416 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)
DRV - [2008.01.21 04:23:22 | 000,342,584 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)
DRV - [2008.01.21 04:23:21 | 000,422,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2008.01.21 04:23:21 | 000,102,968 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)
DRV - [2008.01.21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)
DRV - [2008.01.21 04:23:20 | 000,238,648 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)
DRV - [2008.01.21 04:23:00 | 000,020,024 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)
DRV - [2008.01.21 04:23:00 | 000,019,000 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)
DRV - [2008.01.21 04:23:00 | 000,017,464 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)
DRV - [2007.12.19 02:12:12 | 000,054,784 | ---- | M] (ITE Tech. Inc. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\itecir.sys -- (itecir)
DRV - [2007.12.06 12:12:47 | 000,196,400 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SynTP.sys -- (SynTP)
DRV - [2007.08.11 05:19:26 | 000,029,752 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [File_System | Boot | Running] -- C:\Windows\System32\drivers\AsDsm.sys -- (AsDsm)
DRV - [2007.08.03 22:26:22 | 000,020,936 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys -- (ghaio)
DRV - [2007.07.30 20:54:02 | 000,038,400 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2007.07.30 19:42:58 | 000,043,008 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2007.07.24 20:09:04 | 000,013,880 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ATKGFNEX\ASMMAP.sys -- (ASMMAP)
DRV - [2006.12.14 09:11:57 | 000,007,680 | ---- | M] (ATK0100) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ATKACPI.sys -- (MTsensor)
DRV - [2006.11.02 11:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006.11.02 11:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)
DRV - [2006.11.02 11:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006.11.02 11:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)
DRV - [2006.11.02 11:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006.11.02 11:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)
DRV - [2006.11.02 11:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006.11.02 11:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006.11.02 11:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006.11.02 11:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)
DRV - [2006.11.02 11:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006.11.02 10:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006.11.02 10:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)
DRV - [2006.11.02 10:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
DRV - [2006.11.02 10:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
DRV - [2006.11.02 10:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
DRV - [2006.11.02 10:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
DRV - [2006.11.02 09:41:49 | 001,010,560 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)
DRV - [2006.11.02 09:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)
DRV - [2006.11.02 09:30:56 | 000,194,048 | ---- | M] (Marvell) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\yk60x86.sys -- (yukonwlh)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultthis.engineName: "Winload Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.startup.homepage: "hxxp://search.conduit.com/?ctid=CT2319825&SearchSource=13"
FF - prefs.js..extensions.enabledItems: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.29
FF - prefs.js..extensions.enabledItems: {0545b830-f0aa-4d7e-8820-50a4629a56fe}:3.9.2
FF - prefs.js..extensions.enabledItems: {0b457cAA-602d-484a-8fe7-c1d894a011ba}:0.85
FF - prefs.js..extensions.enabledItems: {EF522540-89F5-46b9-B6FE-1829E2B572C6}:3.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0
FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:4.6
FF - prefs.js..extensions.enabledItems: {1280606b-2510-4fe0-97ef-9b5a22eafe30}:0.6.5
FF - prefs.js..extensions.enabledItems: {29c4afe1-db19-4298-8785-fcc94d1d6c1d}:0.6.2009050101
 
FF - HKLM\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2009.10.02 13:25:36 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\IPSFFPlgn\ [2010.05.26 07:24:42 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\coFFPlgn\ [2010.01.27 10:36:29 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.10.13 20:34:20 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.10.13 20:34:19 | 000,000,000 | ---D | M]
 
[2009.09.08 12:52:05 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\mozilla\Extensions
[2010.10.14 15:00:22 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\mozilla\Firefox\Profiles\n98g2py1.default\extensions
[2010.09.27 18:03:03 | 000,000,000 | ---D | M] (FireShot) -- C:\Users\Maike\AppData\Roaming\mozilla\Firefox\Profiles\n98g2py1.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}
[2010.07.26 20:31:32 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Maike\AppData\Roaming\mozilla\Firefox\Profiles\n98g2py1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.10.13 15:16:48 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\mozilla\Firefox\Profiles\n98g2py1.default\extensions\finder@meingutscheincode.de
[2010.03.24 16:13:02 | 000,000,917 | ---- | M] () -- C:\Users\Maike\AppData\Roaming\Mozilla\FireFox\Profiles\n98g2py1.default\searchplugins\conduit.xml
[2010.10.02 15:26:08 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions
[2009.08.23 08:50:01 | 000,000,000 | ---D | M] (Forecastfox) -- C:\Program Files\mozilla firefox\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}
[2009.09.08 12:52:22 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe}
[2009.08.23 08:50:06 | 000,000,000 | ---D | M] (Session Manager) -- C:\Program Files\mozilla firefox\extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}
[2009.08.23 08:50:07 | 000,000,000 | ---D | M] (Site Launcher) -- C:\Program Files\mozilla firefox\extensions\{20291fcc-1471-46c8-8213-5911f5ce6d67}
[2009.09.08 12:52:23 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions\{29c4afe1-db19-4298-8785-fcc94d1d6c1d}
[2009.08.23 08:50:04 | 000,000,000 | ---D | M] (Minimap Addon) -- C:\Program Files\mozilla firefox\extensions\{398e77b8-2304-11dc-8314-0800200c9a66}
[2010.04.26 08:12:53 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2009.08.23 08:50:00 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions\{CE6E6E3B-84DD-4cac-9F63-8D2AE4F30A4B}
[2009.08.23 08:49:59 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}
[2009.08.23 08:50:01 | 000,000,000 | ---D | M] (FoxTab) -- C:\Program Files\mozilla firefox\extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}
[2009.08.23 08:50:02 | 000,000,000 | ---D | M] (GooglePreview) -- C:\Program Files\mozilla firefox\extensions\{EF522540-89F5-46b9-B6FE-1829E2B572C6}
[2009.09.08 12:52:22 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\autopager@mozilla.org
[2009.09.08 12:52:05 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\cbsf-config@com.extensions.mattiasschlenker.de
[2009.08.23 08:50:05 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\CompactMenuCE@Merci.chao
[2009.08.23 08:50:03 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\lazarus@interclue.com
[2009.09.08 12:52:21 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\metaswitcher@com.extensions.mattiasschlenker.de
[2009.09.08 12:52:23 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\printpdf@pavlov.net
[2009.09.08 12:52:05 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\cbsf-config@com.extensions.mattiasschlenker.de\chrome
[2009.09.08 12:52:05 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\cbsf-config@com.extensions.mattiasschlenker.de\defaults
[2009.09.08 12:52:21 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\metaswitcher@com.extensions.mattiasschlenker.de\chrome
[2009.09.08 12:52:21 | 000,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\metaswitcher@com.extensions.mattiasschlenker.de\defaults
[2010.04.12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2009.11.13 17:39:34 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2009.11.13 17:39:34 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2009.11.13 17:39:34 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2009.11.13 17:39:34 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2009.11.13 17:39:34 | 000,000,801 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\17.8.0.5\coIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\17.8.0.5\IPSBHO.DLL (Symantec Corporation)
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\17.8.0.5\coIEPlg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\17.8.0.5\coIEPlg.dll (Symantec Corporation)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ACMON] C:\Program Files\ASUS\Splendid\ACMON.exe (ATK)
O4 - HKLM..\Run: [ADSMTray] C:\Program Files\ASUS\ASUS Data Security Manager\ADSMTray.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [ASUS Screen Saver Protector] C:\Windows\ASScrPro.exe ()
O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMedia.exe (ASUS)
O4 - HKLM..\Run: [ATKOSD2] C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe (ASUS)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe (ASUS)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [P2Go_Menu] C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [VolPanel] C:\Program Files\Creative\SB Audigy\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: HP Intelligente Auswahl - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Maike\Pictures\chams\08_10\P1020381.JPG
O24 - Desktop BackupWallPaper: C:\Users\Maike\Pictures\chams\08_10\P1020381.JPG
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
Drivers32: aux - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi3 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\Windows\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: mixer3 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.imaadpcm - C:\Windows\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - C:\Windows\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\Windows\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\Windows\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: msacm.siren - C:\Windows\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.i420 - C:\Windows\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: VIDC.IYUV - C:\Windows\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.mrle - C:\Windows\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\Windows\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: VIDC.UYVY - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.VP60 - C:\Windows\System32\vp6vfw.dll (On2.com)
Drivers32: vidc.VP61 - C:\Windows\System32\vp6vfw.dll (On2.com)
Drivers32: VIDC.YUY2 - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVU9 - C:\Windows\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVYU - C:\Windows\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave1 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave2 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wave3 - C:\Windows\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\Windows\System32\msacm32.drv (Microsoft Corporation)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 90 Days ==========
 
[2010.10.15 16:34:50 | 000,574,464 | ---- | C] (OldTimer Tools) -- C:\Users\Maike\Desktop\OTL.exe
[2010.10.14 17:35:49 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2010.10.14 17:29:04 | 000,000,000 | ---D | C] -- C:\Users\Maike\Documents\Simply Super Software
[2010.10.14 17:28:31 | 000,000,000 | ---D | C] -- C:\Program Files\Trojan Remover
[2010.10.14 17:28:31 | 000,000,000 | ---D | C] -- C:\Users\Maike\AppData\Roaming\Simply Super Software
[2010.10.14 17:28:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Simply Super Software
[2010.10.14 16:59:20 | 000,000,000 | ---D | C] -- C:\Users\Maike\Logs
[2010.10.14 16:41:45 | 000,000,000 | ---D | C] -- C:\ProgramData\WindowsSearch
[2010.10.14 15:13:49 | 000,000,000 | ---D | C] -- C:\Users\Maike\AppData\Roaming\SUPERAntiSpyware.com
[2010.10.14 15:13:49 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2010.10.14 15:13:40 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2010.10.13 21:57:14 | 000,000,000 | ---D | C] -- C:\Users\Maike\Documents\Audible
[2010.10.13 21:57:13 | 000,000,000 | ---D | C] -- C:\Program Files\Audible
[2010.10.13 20:35:31 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2010.10.13 20:35:29 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2010.10.13 20:33:19 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2010.10.13 15:19:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Vokabel Trainer
[2010.10.13 15:18:53 | 000,000,000 | ---D | C] -- C:\Program Files\vokabeltrainer
[2010.10.13 15:16:57 | 000,000,000 | ---D | C] -- C:\Program Files\Conduit
[2010.10.04 18:09:49 | 000,000,000 | ---D | C] -- C:\Program Files\Joomla
[2010.09.28 16:19:25 | 000,000,000 | ---D | C] -- C:\Users\Maike\AppData\Roaming\FireShot
[2010.09.04 14:40:31 | 000,000,000 | ---D | C] -- C:\Users\Maike\Documents\mirko
[2010.09.02 17:55:39 | 000,000,000 | ---D | C] -- C:\Users\Maike\Phone Browser
[2010.09.02 17:14:04 | 000,000,000 | ---D | C] -- C:\Users\Maike\AppData\Roaming\Apple Computer
[2010.09.02 17:14:04 | 000,000,000 | ---D | C] -- C:\Users\Maike\AppData\Local\Apple Computer
[2010.09.02 17:13:13 | 000,000,000 | ---D | C] -- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010.09.02 17:12:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2010.09.02 17:12:04 | 000,000,000 | ---D | C] -- C:\Users\Maike\AppData\Local\Apple
[2010.09.02 17:11:57 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update
[2010.09.02 17:10:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple
[2010.09.02 17:10:28 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple
[2010.08.30 14:32:45 | 000,000,000 | ---D | C] -- C:\Users\Maike\Documents\gitarre_lehre
[2010.08.12 14:36:46 | 000,000,000 | ---D | C] -- C:\Users\Maike\chords
[2010.08.08 13:20:01 | 000,000,000 | ---D | C] -- C:\Program Files\Ankh
[2010.08.08 13:15:17 | 000,000,000 | ---D | C] -- C:\Users\Maike\AppData\Roaming\Ankh
[2010.07.17 18:37:18 | 000,000,000 | ---D | C] -- C:\Users\Maike\homepage
[2010.04.02 13:40:25 | 000,454,656 | ---- | C] (Simon Tatham) -- C:\Program Files\putty06.exe
[2008.06.03 08:41:51 | 000,015,928 | ---- | C] ( ) -- C:\Windows\System32\drivers\kbfiltr.sys
 
========== Files - Modified Within 90 Days ==========
 
[2010.10.15 16:41:16 | 002,162,502 | ---- | M] () -- C:\Windows\System32\drivers\NIS\1108000.005\Cat.DB
[2010.10.15 16:36:03 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\Maike\Desktop\OTL.exe
[2010.10.15 16:27:13 | 000,151,411 | ---- | M] () -- C:\ProgramData\nvModes.001
[2010.10.15 16:26:28 | 000,151,411 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2010.10.15 16:25:39 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.10.15 16:25:39 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.10.15 16:25:25 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.10.15 16:25:20 | 3220,295,680 | -HS- | M] () -- C:\hiberfil.sys
[2010.10.14 19:55:14 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2010.10.14 15:13:45 | 000,001,807 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010.10.14 14:42:53 | 001,750,288 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010.10.13 20:36:48 | 000,001,804 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010.10.13 15:18:54 | 000,000,834 | ---- | M] () -- C:\Users\Public\Desktop\Vokabel Trainer.lnk
[2010.10.11 17:15:18 | 000,633,580 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.10.11 17:15:18 | 000,600,138 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.10.11 17:15:18 | 000,128,990 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.10.11 17:15:18 | 000,106,014 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.10.02 15:39:41 | 000,000,600 | ---- | M] () -- C:\Users\Maike\AppData\Local\PUTTY.RND
[2010.09.20 23:52:57 | 000,000,172 | ---- | M] () -- C:\Windows\System32\drivers\NIS\1108000.005\isolate.ini
[2010.09.17 12:04:09 | 000,014,931 | ---- | M] () -- C:\Users\Maike\Documents\finnland.xlsx
[2010.09.02 18:04:11 | 000,000,019 | ---- | M] () -- C:\Windows\SoundConverter.INI
[2010.08.30 09:37:05 | 002,329,923 | R--- | M] () -- C:\Users\Maike\Documents\TS_Preise_Fahrplaene_2010.pdf
 
========== Files Created - No Company Name ==========
 
[2010.10.14 17:28:38 | 000,162,304 | ---- | C] () -- C:\Windows\System32\ztvunrar36.dll
[2010.10.14 17:28:38 | 000,077,312 | ---- | C] () -- C:\Windows\System32\ztvunace26.dll
[2010.10.14 17:28:38 | 000,075,264 | ---- | C] () -- C:\Windows\System32\unacev2.dll
[2010.10.14 17:28:37 | 000,153,088 | ---- | C] () -- C:\Windows\System32\UNRAR3.dll
[2010.10.14 15:13:45 | 000,001,807 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010.10.13 20:36:48 | 000,001,804 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010.10.13 15:18:54 | 000,000,834 | ---- | C] () -- C:\Users\Public\Desktop\Vokabel Trainer.lnk
[2010.09.02 18:04:11 | 000,000,019 | ---- | C] () -- C:\Windows\SoundConverter.INI
[2010.08.30 09:37:05 | 002,329,923 | R--- | C] () -- C:\Users\Maike\Documents\TS_Preise_Fahrplaene_2010.pdf
[2010.08.30 09:35:42 | 000,014,931 | ---- | C] () -- C:\Users\Maike\Documents\finnland.xlsx
[2010.05.31 16:01:16 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2010.05.18 13:31:29 | 000,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll
[2010.05.01 13:59:45 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.04.29 20:39:38 | 000,000,680 | ---- | C] () -- C:\Users\Maike\AppData\Local\d3d9caps.dat
[2010.04.26 08:25:00 | 000,000,600 | ---- | C] () -- C:\Users\Maike\AppData\Local\PUTTY.RND
[2010.01.14 14:04:26 | 000,004,096 | -H-- | C] () -- C:\Users\Maike\AppData\Local\keyfile3.drm
[2009.12.30 15:58:16 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2009.12.30 15:58:16 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2009.11.06 17:28:02 | 002,463,976 | ---- | C] () -- C:\Windows\System32\NPSWF32.dll
[2009.10.31 12:05:11 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2009.10.27 21:13:20 | 000,008,704 | ---- | C] () -- C:\Users\Maike\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.10.02 13:17:58 | 000,001,161 | ---- | C] () -- C:\ProgramData\hpzinstall.log
[2009.09.12 12:40:31 | 000,151,411 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009.09.12 10:58:15 | 000,151,411 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2009.09.01 10:39:04 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2009.08.30 15:32:19 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.08.19 20:00:02 | 000,000,024 | ---- | C] () -- C:\Windows\ATKPF.ini
[2009.08.04 03:03:20 | 000,004,352 | ---- | C] () -- C:\Windows\System32\cfgfx.ini
[2009.08.04 03:03:20 | 000,000,735 | ---- | C] () -- C:\Windows\FF05_Render_Spk_Hp.ini
[2009.08.04 03:03:20 | 000,000,508 | ---- | C] () -- C:\Windows\FF05_not_Spk_Hp.ini
[2009.08.04 03:02:21 | 000,148,480 | ---- | C] () -- C:\Windows\System32\APOMngr.DLL
[2009.08.04 03:02:21 | 000,073,728 | ---- | C] () -- C:\Windows\System32\CmdRtr.DLL
[2008.11.08 03:08:20 | 000,362,029 | ---- | C] () -- C:\Windows\System32\sqlite3.dll
[2008.08.11 04:14:11 | 001,752,704 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys
[2008.07.30 02:33:22 | 000,057,344 | ---- | C] () -- C:\Windows\System32\BtwNamespaceExt2.dll
[2008.05.12 05:20:31 | 000,028,672 | ---- | C] () -- C:\Windows\System32\drivers\sncduvc.sys
[2008.04.16 12:43:39 | 000,000,010 | ---- | C] () -- C:\Windows\System32\ABLKSR.ini
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.03.09 03:57:59 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2003.02.20 15:53:42 | 000,005,702 | ---- | C] () -- C:\Windows\System32\OUTLPERF.INI
[2001.11.14 22:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll
 
========== LOP Check ==========
 
[2010.08.08 13:15:17 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\Ankh
[2010.05.18 13:04:22 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\Atari
[2010.09.29 17:55:38 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\FileZilla
[2010.09.28 16:19:25 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\FireShot
[2010.10.14 17:28:31 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\Simply Super Software
[2010.04.22 16:08:11 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\SmartDraw
[2010.03.16 20:18:23 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\SparweltGutschein
[2010.04.07 18:30:51 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\Tific
[2009.12.30 16:02:02 | 000,000,000 | ---D | M] -- C:\Users\Maike\AppData\Roaming\Ubisoft
[2010.10.14 19:55:14 | 000,032,510 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*.* >
[2010.05.18 13:32:43 | 000,453,006 | ---- | M] () -- C:\AnalysisLog.sr0
[2009.03.12 04:11:47 | 000,000,023 | ---- | M] () -- C:\app3.LOG
[2006.09.18 23:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
[2009.04.11 08:36:36 | 000,333,257 | RHS- | M] () -- C:\bootmgr
[2008.04.16 13:27:17 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK
[2007.04.04 21:01:54 | 000,000,019 | ---- | M] () -- C:\CA21.txt
[2006.09.18 23:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
[2010.07.21 12:34:25 | 000,286,720 | ---- | M] () -- C:\Debug.txt
[2009.08.04 03:45:04 | 000,019,994 | ---- | M] () -- C:\devlist.txt
[2009.06.23 08:28:11 | 000,000,027 | ---- | M] () -- C:\Driver.20
[2009.08.03 13:48:21 | 000,000,769 | ---- | M] () -- C:\faclog.txt
[2009.08.04 03:41:42 | 000,000,009 | ---- | M] () -- C:\Finish.log
[2009.06.07 17:31:15 | 000,000,021 | ---- | M] () -- C:\Fix.log
[2009.05.27 08:02:07 | 001,048,576 | RH-- | M] () -- C:\G60VxAS.BIN
[2010.10.15 16:25:20 | 3220,295,680 | -HS- | M] () -- C:\hiberfil.sys
[2009.08.04 03:37:50 | 001,546,580 | ---- | M] () -- C:\if.log
[2009.08.04 02:27:34 | 000,000,481 | ---- | M] () -- C:\igoogle_log.txt
[2009.08.04 02:58:55 | 022,216,704 | ---- | M] () -- C:\inject.log
[2009.08.04 02:58:55 | 019,533,351 | ---- | M] () -- C:\inject.log.txt
[2010.06.14 12:11:19 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010.06.14 12:11:19 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2008.08.08 09:22:19 | 000,000,030 | ---- | M] () -- C:\NERO.LOG
[2009.01.07 11:16:08 | 000,000,030 | ---- | M] () -- C:\NIS2009.TXT
[2007.03.16 01:18:45 | 000,000,025 | ---- | M] () -- C:\OFFICE2007_A.TXT
[2010.10.15 16:25:18 | 3533,873,152 | -HS- | M] () -- C:\pagefile.sys
[2009.08.03 14:34:44 | 000,000,146 | ---- | M] () -- C:\Pass.txt
[2009.06.19 14:10:05 | 000,003,502 | ---- | M] () -- C:\Patch.LOG
[2009.01.15 10:13:21 | 000,000,017 | ---- | M] () -- C:\READER_A.TXT
[2009.03.31 05:04:29 | 000,000,022 | ---- | M] () -- C:\RECOVERY.DAT
[2009.08.04 03:02:22 | 000,001,783 | ---- | M] () -- C:\RHDSetup.log
[2010.07.21 12:36:42 | 000,000,166 | ---- | M] () -- C:\setup.log
[2006.05.14 18:22:24 | 000,000,005 | ---- | M] () -- C:\store.log
[2009.08.04 02:17:16 | 000,000,170 | ---- | M] () -- C:\SumHidd.txt
[2009.08.04 02:16:22 | 000,000,098 | ---- | M] () -- C:\SumOS.txt
[2010.07.01 15:27:15 | 000,002,433 | ---- | M] () -- C:\test.spr
[2009.06.02 13:11:40 | 000,000,024 | ---- | M] () -- C:\v55.txt
[2009.02.09 07:30:41 | 000,000,041 | ---- | M] () -- C:\WindowsLive_A.TXT
 
< %systemroot%\system32\*.wt >
 
< %systemroot%\system32\*.ruy >
 
< %systemroot%\Fonts\*.com >
[2006.11.02 14:37:12 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006.11.02 14:37:12 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006.11.02 14:37:12 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009.08.30 15:38:25 | 000,037,665 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont
 
< %systemroot%\Fonts\*.dll >
 
< %systemroot%\Fonts\*.ini >
[2006.09.18 23:37:34 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini
 
< %systemroot%\Fonts\*.ini2 >
 
< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006.11.02 11:46:03 | 000,070,144 | ---- | M] (CANON INC.) -- C:\Windows\System32\spool\prtprocs\w32x86\CNBPP3.DLL
[2008.10.28 12:49:30 | 000,321,536 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\hpzpp696.dll
[2006.11.02 14:35:48 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2007.04.09 13:23:54 | 000,028,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\mdippr.dll
[2006.10.26 19:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll
 
< %systemroot%\REPAIR\*.bak1 >
 
< %systemroot%\REPAIR\*.ini >
 
< %systemroot%\system32\*.jpg >
 
< %systemroot%\*.scr >
[2008.12.05 00:19:40 | 000,308,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\WLXPGSS.SCR
 
< %systemroot%\*._sy >
 
< %APPDATA%\Adobe\Update\*.* >
 
< %ALLUSERSPROFILE%\Favorites\*.* >
 
< %APPDATA%\Microsoft\*.* >
 
< %PROGRAMFILES%\*.* >
[2008.01.21 04:43:21 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini
[2010.04.02 13:40:46 | 000,454,656 | ---- | M] (Simon Tatham) -- C:\Program Files\putty06.exe
 
< %APPDATA%\Update\*.* >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2009.04.11 08:27:47 | 000,241,128 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll
[2009.04.11 08:28:23 | 000,228,352 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll
 
< %systemroot%\Tasks\*.job /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2008.01.21 05:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2008.01.21 05:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2008.01.21 05:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\system32\user32.dll /md5 >
[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
 
< %systemroot%\system32\ws2_32.dll /md5 >
[2008.01.21 04:24:48 | 000,179,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\ws2_32.dll
 
< %systemroot%\system32\ws2help.dll /md5 >
[2006.11.02 11:44:30 | 000,004,608 | ---- | M] (Microsoft Corporation) MD5=17C0671BF57057108A6D949510EE42C8 -- C:\Windows\System32\ws2help.dll
 
 
< MD5 for: EXPLORER.EXE  >
[2009.08.04 02:45:44 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2009.08.04 02:45:44 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2009.08.04 02:45:44 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2009.08.04 02:45:44 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2008.01.21 04:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.21 04:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.21 04:23:42 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2008.01.21 04:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-10-13 20:58:23

< End of report >
         
--- --- ---
__________________

Alt 15.10.2010, 17:05   #4
Swisstreasure
/// Malwareteam
 
Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13" - Standard

Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13"



Und wo bleibt der Rest?

Alt 16.10.2010, 11:57   #5
Maikeost
 
Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13" - Standard

Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13"



HIer der Rest - Sorry - musste gestern noch schnell weg...

<code>
GMER Logfile:
Code:
ATTFilter
GMER 1.0.15.15315 - hxxp://www.gmer.net
Rootkit scan 2010-10-16 12:48:13
Windows 6.0.6002 Service Pack 2
Running: 9gni6flu.exe; Driver: C:\Users\Maike\AppData\Local\Temp\kxlcypoc.sys


---- System - GMER 1.0.15 ----

SSDT            93745108                                                                                         ZwAlertResumeThread
SSDT            9373E118                                                                                         ZwAlertThread
SSDT            93AA08C0                                                                                         ZwAllocateVirtualMemory
SSDT            89180C68                                                                                         ZwAlpcConnectPort
SSDT            937AD120                                                                                         ZwAssignProcessToJobObject
SSDT            93AB0B00                                                                                         ZwCreateMutant
SSDT            93AB5D78                                                                                         ZwCreateSymbolicLinkObject
SSDT            93A9EA90                                                                                         ZwCreateThread
SSDT            937A0068                                                                                         ZwDebugActiveProcess
SSDT            93AA0A98                                                                                         ZwDuplicateObject
SSDT            93AA02A0                                                                                         ZwFreeVirtualMemory
SSDT            93750068                                                                                         ZwImpersonateAnonymousToken
SSDT            9374B068                                                                                         ZwImpersonateThread
SSDT            891FDA48                                                                                         ZwLoadDriver
SSDT            93AA0180                                                                                         ZwMapViewOfSection
SSDT            9374F128                                                                                         ZwOpenEvent
SSDT            93AA0CF8                                                                                         ZwOpenProcess
SSDT            90FDA120                                                                                         ZwOpenProcessToken
SSDT            9378F118                                                                                         ZwOpenSection
SSDT            93AA0BA8                                                                                         ZwOpenThread
SSDT            93AB4A78                                                                                         ZwProtectVirtualMemory
SSDT            931FDE00                                                                                         ZwResumeThread
SSDT            90FE7578                                                                                         ZwSetContextThread
SSDT            93AA1EB8                                                                                         ZwSetInformationProcess
SSDT            9379E110                                                                                         ZwSetSystemInformation
SSDT            93789120                                                                                         ZwSuspendProcess
SSDT            931F9068                                                                                         ZwSuspendThread
SSDT            90FCDEC8                                                                                         ZwTerminateProcess
SSDT            91BF8110                                                                                         ZwTerminateThread
SSDT            90FE63A8                                                                                         ZwUnmapViewOfSection
SSDT            93AA05B0                                                                                         ZwWriteVirtualMemory
SSDT            93AB4258                                                                                         ZwCreateThreadEx

---- Kernel code sections - GMER 1.0.15 ----

.text           ntkrnlpa.exe!KeSetEvent + 11D                                                                    828EB880 8 Bytes  [08, 51, 74, 93, 18, E1, 73, ...] {OR [ECX+0x74], DL; XCHG EBX, EAX; SBB CL, AH; JAE 0xffffffffffffff9b}
.text           ntkrnlpa.exe!KeSetEvent + 131                                                                    828EB894 4 Bytes  [C0, 08, AA, 93] {ROR BYTE [EAX], 0xaa; XCHG EBX, EAX}
.text           ntkrnlpa.exe!KeSetEvent + 13D                                                                    828EB8A0 4 Bytes  [68, 0C, 18, 89]
.text           ntkrnlpa.exe!KeSetEvent + 191                                                                    828EB8F4 4 Bytes  [20, D1, 7A, 93] {AND CL, DL; JP 0xffffffffffffff97}
.text           ntkrnlpa.exe!KeSetEvent + 1F5                                                                    828EB958 4 Bytes  [00, 0B, AB, 93] {ADD [EBX], CL; STOSD ; XCHG EBX, EAX}
.text           ...                                                                                              
.text           C:\Windows\system32\DRIVERS\atksgt.sys                                                           section is writeable [0xA68F3300, 0x3B6D8, 0xE8000020]
.text           C:\Windows\system32\DRIVERS\lirsgt.sys                                                           section is writeable [0xA6939300, 0x1BEE, 0xE8000020]

---- User code sections - GMER 1.0.15 ----

.text           C:\Program Files\Mozilla Firefox\firefox.exe[3332] ntdll.dll!RtlEncodeSystemPointer + 873        76E1938B 10 Bytes  JMP 011E003A 

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                           AsDsm.sys (Data Security Manager Driver/Windows (R) Codename Longhorn DDK provider)
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                          Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                          Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice  \Driver\tdx \Device\Tcp                                                                          SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice  \Driver\tdx \Device\Udp                                                                          SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice  \Driver\tdx \Device\RawIp                                                                        SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice  \FileSystem\fastfat \Fat                                                                         fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\002243c94add                      
Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\002243c94add@001370ac8176         0x24 0xC7 0x7A 0x7B ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\002243c94add@00236cf48a41         0x95 0x25 0x9C 0xE7 ...
Reg             HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\002243c94add (not active ControlSet)  
Reg             HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\002243c94add@001370ac8176             0x24 0xC7 0x7A 0x7B ...
Reg             HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\002243c94add@00236cf48a41             0x95 0x25 0x9C 0xE7 ...

---- Files - GMER 1.0.15 ----

File            C:\ADSM_PData_0150                                                                               0 bytes
File            C:\ADSM_PData_0150\DB                                                                            0 bytes
File            C:\ADSM_PData_0150\DB\SI.db                                                                      624 bytes
File            C:\ADSM_PData_0150\DB\UL.db                                                                      16 bytes
File            C:\ADSM_PData_0150\DB\VL.db                                                                      16 bytes
File            C:\ADSM_PData_0150\DB\WAL.db                                                                     2048 bytes
File            C:\ADSM_PData_0150\DB\_avt                                                                       512 bytes
File            C:\ADSM_PData_0150\DragWait.exe                                                                  315392 bytes executable
File            C:\ADSM_PData_0150\_avt                                                                          512 bytes
File            C:\Program Files\ASUS\ASUS Data Security Manager\driver\x86                                      0 bytes
File            C:\Program Files\ASUS\ASUS Data Security Manager\driver\x86\AsDsm.sys                            29752 bytes executable
File            C:\Program Files\ASUS\ASUS Data Security Manager\driver\x86\_avt                                 512 bytes

---- EOF - GMER 1.0.15 ----
         
--- --- ---

</code>


Alt 16.10.2010, 14:28   #6
Swisstreasure
/// Malwareteam
 
Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13" - Standard

Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13"



Schritt 1
  • Starte bitte die OTL.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Kopiere nun den Inhalt in die Textbox.
Code:
ATTFilter
:OTL
O4 - HKLM..\Run: []  File not found
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
:commands
[emptytemp]
[purity]
         
  • Schliesse bitte nun alle Programme.
  • Klicke nun bitte auf den Fix Button.
  • Klick auf .
  • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
  • Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
    ( Auch zu finden unter C:\_OTL\MovedFiles\<time_date>.txt)
    Kopiere nun den Inhalt hier in Deinen Thread

Schritt 2

ESET Online Scanner
Bitte während der Online-Scans evtl. vorhandene externe Festplatten einschalten! Bitte während der Scans alle Hintergrundwächter (Anti-Virus-Programm, Firewall, Skriptblocking und ähnliches) abstellen und nicht vergessen, alles hinterher wieder einzuschalten.
  • Anmerkung für Vista und Win7 User: Bitte den Browser unbedingt als Administrator starten.
  • Dein Anti-Virus-Programm während des Scans deaktivieren.

    Button (<< klick) drücken.
    • Firefox-User:
      Bitte esetsmartinstaller_enu.exe downloaden.Das Firefox-Addon auf dem Desktop speichern und dann installieren.
    • IE-User:
      müssen das Installieren eines ActiveX Elements erlauben.
  • Setze den einen Hacken bei Yes, i accept the Terms of Use.
  • Drücke den Button.
  • Warte bis die Komponenten herunter geladen wurden.
  • Setze einen Haken bei "Scan archives".
  • Gehe sicher das bei Remove Found Threads kein Hacken gesetzt ist.
  • drücken.
  • Die Signaturen werden herunter geladen.Der Scan beginnt automatisch.
Wenn der Scan beendet wurde
  • Klicke Finish.
  • Browser schließen.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt suchen und mit Deinem Editor öffnen.
  • Logfile hier posten.

Alt 16.10.2010, 23:41   #7
Maikeost
 
Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13" - Standard

Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13"



Hier die beiden Logs:



<code>
All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Arbeit
->Temp folder emptied: 25845064 bytes
->Temporary Internet Files folder emptied: 3738960 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 137987954 bytes
->Flash cache emptied: 1081 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Maike
->Temp folder emptied: 456264862 bytes
->Temporary Internet Files folder emptied: 116774110 bytes
->Java cache emptied: 52477785 bytes
->FireFox cache emptied: 222502194 bytes
->Flash cache emptied: 3406 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 23618153 bytes
RecycleBin emptied: 341052468 bytes

Total Files Cleaned = 1.316,00 mb


OTL by OldTimer - Version 3.2.15.2 log created on 10162010_165031

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...
</code>


<code>
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=604da2f81aceea478a84209f697855ad
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-10-16 06:28:33
# local_time=2010-10-16 08:28:33 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=3588 16777214 85 88 1750114 26822611 0 0
# compatibility_mode=5892 16776574 100 95 35601785 124775309 0 0
# compatibility_mode=8192 67108863 100 0 913 913 0 0
# scanned=243771
# found=0
# cleaned=0
# scan_time=11132
</code>

Alt 17.10.2010, 19:03   #8
Swisstreasure
/// Malwareteam
 
Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13" - Standard

Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13"



Ich würde mir noch gerne eine zweitmeinung einholen mit einem Onlinescan:

Schritt 1

Temp File Cleaner

Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop.
Schließe nun alle offenen Programme und trenne Dich von dem Internet.
Doppelklick auf die TFC.exe
Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen.

Schritt 2
Bitte während der Online-Scans evtl. vorhandene externe Festplatten einschalten! Bitte während der Scans alle Hintergrundwächter (Anti-Virus-Programm, Firewall, Skriptblocking und ähnliches) abstellen und nicht vergessen, alles hinterher wieder einzuschalten.
  • Anmerkung für Vista und Win7 User: Bitte den Browser unbedingt als Administrator starten.
  • Bitte während des Scans alle Hintergrundwächter abstellen/deaktivieren.
  • Java muss installiert, aktiv und erlaubt sein.
  • Bebilderte Anleitung von sundavis.
  • Dieser Scanner entfernt die Funde nicht, gibt aber einen guten Überblick.
  • Wir werden Dir helfen, die Funde manuell vom System zu entfernen.
  • Die Datenschutzerklärung akzeptieren.
  • Programm installieren lassen.
  • Update der Signaturen installieren lassen.
  • Wenn der Status "Complete" ist,
  • Scan-Einstellungen (Settings) Standard lassen
  • Links den Link "My Computer" anklicken.
  • Scan beginnt automatisch.
  • Wenn der Scan fertig ist, auf "View scan report" klicken,
  • "Save report as" und Dateityp auf .txt umstellen,
  • und auf dem Desktop als Kaspersky.txt speichern.
  • Logdatei hier posten.
  • Deinstallation ist nicht nötig, alle Dateien werden in temporären Ordnern gespeichert.

Schritt 3

Kommen von Norton noch Meldungen?

Alt 18.10.2010, 14:40   #9
Maikeost
 
Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13" - Standard

Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13"



Hallo Swiss,

habe ein Problembeo Kaspersky - der Download der Signaturen dauert bei mir extrem lange!!! Habe nun bereits 3 Std gedownloaded und bin immer noch bei nur 28%....Habe nun abgebrochen. Gibt es hier nicht noch eine andere Möglichkeit?

Ja, die Meldung von Norton kommt nach wie vor!

Grüße

Alt 19.10.2010, 16:15   #10
Swisstreasure
/// Malwareteam
 
Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13" - Standard

Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13"



Downloade Dir bitte RKUnhookerLE und speichere die Datei auf deinem Desktop.
  • Deaktiviere alle Hintergrundwächter. Besonders den deiner Anti Virensoftware.
  • Starte die RKUnhookerLE.exe
  • Klicke auf den Report Tab und danach auf Scan
  • Setze ein Häckchen bei
    • Drivers
    • Stealth Code
  • Entferne alle anderen Hacken
  • Wenn Du gefragt wirst welcher Bereich gescannt werden soll, gehe sicher das deine Systemplatte ( meistens C: ) angehackt ist.
  • Klicke OK
  • Wenn der Scan beendet wurde
    File --> Save Report
    klicken.
  • Speichere die Datei als RKU.txt auf dem Desktop.
  • Klicke Close
Hinweis: Solltest Du folgende Warnung bekommen
Zitat:
"Rootkit Unhooker has detected a parasite inside itself! It is recommended to remove parasite, okay?"
einfach ignorieren.

Alt 20.10.2010, 11:44   #11
Maikeost
 
Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13" - Standard

Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13"



RkU Version: 3.8.388.590, Type LE (SR2)
==============================================
OS Name: Windows Vista
Version 6.0.6002 (Service Pack 2)
Number of processors #2
==============================================
>Drivers
==============================================
0x8EC0C000 C:\Windows\system32\DRIVERS\nvlddmkm.sys 9789440 bytes (NVIDIA Corporation, NVIDIA Windows Kernel Mode Driver, Version 186.31 )
0x82801000 C:\Windows\system32\ntkrnlpa.exe 3903488 bytes (Microsoft Corporation, NT Kernel & System)
0x82801000 PnpManager 3903488 bytes
0x82801000 RAW 3903488 bytes
0x82801000 WMIxWDM 3903488 bytes
0x90209000 C:\Windows\system32\drivers\RTKVHDA.sys 2359296 bytes (Realtek Semiconductor Corp., Realtek(r) High Definition Audio Function Driver)
0x9FC00000 Win32k 2109440 bytes
0x9FC00000 C:\Windows\System32\win32k.sys 2109440 bytes (Microsoft Corporation, Mehrbenutzer-Win32-Treiber)
0x92202000 C:\Windows\system32\DRIVERS\snp2uvc.sys 1753088 bytes (-, UVC Camera Streaming Driver)
0xAAE00000 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20101019.039\NAVEX15.SYS 1368064 bytes (Symantec Corporation, AV Engine)
0x8AE07000 C:\Windows\System32\Drivers\Ntfs.sys 1114112 bytes (Microsoft Corporation, NT-Dateisystemtreiber)
0x8AA78000 C:\Windows\system32\drivers\ndis.sys 1093632 bytes (Microsoft Corporation, NDIS 6.0 wrapper driver)
0x8AC0F000 C:\Windows\System32\drivers\tcpip.sys 958464 bytes (Microsoft Corporation, TCP/IP Driver)
0x8FC0B000 C:\Windows\system32\DRIVERS\athr.sys 946176 bytes (Atheros Communications, Inc., Atheros Extensible Wireless LAN device driver)
0x804D2000 C:\Windows\system32\CI.dll 917504 bytes (Microsoft Corporation, Codeintegritätsmodul)
0xA7603000 C:\Windows\system32\drivers\peauth.sys 909312 bytes (Microsoft Corporation, Protected Environment Authentication and Authorization Export Driver)
0x920B0000 C:\Windows\System32\Drivers\dump_iaStor.sys 897024 bytes
0x82E07000 C:\Windows\system32\DRIVERS\iaStor.sys 897024 bytes (Intel Corporation, Intel Matrix Storage Manager driver - ia32)
0x8AD14000 C:\Windows\system32\drivers\spsys.sys 720896 bytes (Microsoft Corporation, security processor)
0x92004000 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20101001.001\BHDrvx86.sys 704512 bytes (Symantec Corporation, BASH Driver)
0x8FA0B000 C:\Windows\System32\drivers\dxgkrnl.sys 659456 bytes (Microsoft Corporation, DirectX Graphics Kernel)
0x8FB10000 C:\Windows\system32\DRIVERS\HDAudBus.sys 577536 bytes (Microsoft Corporation, High Definition Audio Bus Driver)
0x918F3000 C:\Windows\system32\drivers\NIS\1108000.005\ccHPx86.sys 520192 bytes (Symantec Corporation, Common Client Hash Provider Driver)
0x80606000 C:\Windows\system32\drivers\Wdf01000.sys 507904 bytes (Microsoft Corporation, WDF Dynamic)
0x8AA07000 C:\Windows\System32\Drivers\ksecdd.sys 462848 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0x80408000 C:\Windows\system32\mcupdate_GenuineIntel.dll 458752 bytes (Microsoft Corporation, Intel Microcode Update Library)
0x91972000 C:\Windows\system32\drivers\HTTP.sys 446464 bytes (Microsoft Corporation, HTTP-Protokollstapel)
0x91861000 C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys 385024 bytes (Symantec Corporation, Symantec Eraser Control Driver)
0xAAF8F000 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20101019.001\IDSvix86.sys 372736 bytes (Symantec Corporation, IDS Core Driver)
0x90571000 C:\Windows\System32\Drivers\NIS\1108000.005\SYMTDIV.SYS 364544 bytes (Symantec Corporation, Network Dispatch Driver)
0x8F564000 C:\Windows\system32\DRIVERS\itecir.sys 360448 bytes (ITE Tech. Inc. , ITE Consumer IR Driver for eHome)
0xA76FB000 C:\Windows\System32\Drivers\NIS\1108000.005\SRTSP.SYS 356352 bytes (Symantec Corporation, Symantec AutoProtect)
0x82F62000 C:\Windows\system32\drivers\NIS\1108000.005\SYMDS.SYS 352256 bytes (Symantec Corporation, Symantec Data Store)
0x8FD71000 C:\Windows\system32\DRIVERS\rixdptsk.sys 335872 bytes (REDC, RICOH XD SM Driver)
0xA6AA0000 C:\Windows\System32\DRIVERS\srv.sys 319488 bytes (Microsoft Corporation, Server driver)
0x9FE50000 C:\Windows\System32\ATMFD.DLL 311296 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)
0x80738000 C:\Windows\System32\drivers\volmgrx.sys 303104 bytes (Microsoft Corporation, Volume Manager Extension Driver)
0x900B7000 C:\Windows\system32\drivers\afd.sys 294912 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0x8068F000 C:\Windows\system32\drivers\acpi.sys 286720 bytes (Microsoft Corporation, ACPI-Treiber für NT)
0xA6AEE000 C:\Windows\system32\DRIVERS\atksgt.sys 274432 bytes
0x80491000 C:\Windows\system32\CLFS.SYS 266240 bytes (Microsoft Corporation, Common Log File System Driver)
0x80792000 C:\Windows\system32\DRIVERS\storport.sys 266240 bytes (Microsoft Corporation, Microsoft Storage Port Driver)
0x8FAC3000 C:\Windows\system32\DRIVERS\USBPORT.SYS 253952 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0x901A5000 C:\Windows\system32\DRIVERS\rdbss.sys 245760 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0x8ABAE000 C:\Windows\system32\drivers\NETIO.SYS 241664 bytes (Microsoft Corporation, Network I/O Subsystem)
0xA6A27000 C:\Windows\system32\DRIVERS\mrxsmb10.sys 233472 bytes (Microsoft Corporation, Longhorn SMB Downlevel SubRdr)
0x8AF17000 C:\Windows\system32\drivers\volsnap.sys 233472 bytes (Microsoft Corporation, Volumeschattenkopie-Treiber)
0x9005D000 C:\Windows\system32\DRIVERS\usbhub.sys 217088 bytes (Microsoft Corporation, Default Hub Driver for USB)
0x82BBA000 ACPI_HAL 208896 bytes
0x82BBA000 C:\Windows\system32\hal.dll 208896 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0x82F20000 C:\Windows\system32\drivers\fltmgr.sys 204800 bytes (Microsoft Corporation, Microsoft Dateisystem-Filter-Manager)
0x900FF000 C:\Windows\System32\DRIVERS\netbt.sys 204800 bytes (Microsoft Corporation, MBT Transport driver)
0x8F5BC000 C:\Windows\system32\DRIVERS\msiscsi.sys 192512 bytes (Microsoft Corporation, Microsoft iSCSI Initiator Driver)
0x8FB9D000 C:\Windows\system32\DRIVERS\SynTP.sys 192512 bytes (Synaptics, Inc., Synaptics Touchpad Driver)
0x90449000 C:\Windows\system32\drivers\portcls.sys 184320 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0x82FC2000 C:\Windows\system32\drivers\NIS\1108000.005\SYMEFA.SYS 184320 bytes (Symantec Corporation, Symantec Extended File Attributes)
0x8AB83000 C:\Windows\system32\drivers\msrpc.sys 176128 bytes (Microsoft Corporation, Kernel Remote Procedure Call Provider)
0x9000E000 C:\Windows\system32\DRIVERS\ks.sys 172032 bytes (Microsoft Corporation, Kernel CSA Library)
0x921A6000 C:\Windows\system32\DRIVERS\nwifi.sys 172032 bytes (Microsoft Corporation, NativeWiFi Miniport Driver)
0xA6B39000 C:\Windows\System32\Drivers\fastfat.SYS 163840 bytes (Microsoft Corporation, Fast FAT File System Driver)
0xA6A78000 C:\Windows\System32\DRIVERS\srv2.sys 163840 bytes (Microsoft Corporation, Smb 2.0 Server driver)
0x8AF67000 C:\Windows\System32\drivers\ecache.sys 159744 bytes (Microsoft Corporation, Special Memory Device Cache)
0x806E6000 C:\Windows\system32\drivers\pci.sys 159744 bytes (Microsoft Corporation, NT-Plug & Play PCI-Enumerator)
0x90476000 C:\Windows\system32\drivers\drmk.sys 151552 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
0x905CA000 C:\Windows\system32\Drivers\SYMEVENT.SYS 151552 bytes (Symantec Corporation, Symantec Event Library)
0x807D3000 C:\Windows\system32\DRIVERS\ndiswan.sys 143360 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0x8FCF2000 C:\Windows\system32\DRIVERS\Rtlh86.sys 139264 bytes (Realtek Corporation , Realtek 8101E/8168/8169 NDIS6 32-bit Driver )
0x90183000 C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS 139264 bytes (SUPERAdBlocker.com and SUPERAntiSpyware.com, SASKUTIL.SYS)
0x8AF9F000 C:\Windows\system32\drivers\CLASSPNP.SYS 135168 bytes (Microsoft Corporation, SCSI Class System Dll)
0x805DB000 C:\Windows\system32\drivers\mrxdav.sys 135168 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
0x904F1000 C:\Windows\System32\drivers\VIDEOPRT.SYS 135168 bytes (Microsoft Corporation, Video Port Driver)
0x9015A000 C:\Windows\system32\drivers\NIS\1108000.005\Ironx86.SYS 126976 bytes (Symantec Corporation, Iron Driver)
0xA6A08000 C:\Windows\system32\DRIVERS\mrxsmb.sys 126976 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0x82EEA000 C:\Windows\system32\drivers\ataport.SYS 122880 bytes (Microsoft Corporation, ATAPI Driver Extension)
0x918BF000 C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys 118784 bytes (Symantec Corporation, Symantec Eraser Utility Driver)
0x919DF000 C:\Windows\System32\DRIVERS\srvnet.sys 118784 bytes (Microsoft Corporation, Server Network driver)
0x8ACF9000 C:\Windows\System32\drivers\fwpkclnt.sys 110592 bytes (Microsoft Corporation, FWP/IPsec Kernel-Mode API)
0x9218B000 C:\Windows\system32\drivers\luafv.sys 110592 bytes (Microsoft Corporation, LUA-Filtertreiber zur Dateivirtualisierung)
0x8FD32000 C:\Windows\system32\DRIVERS\sdbus.sys 106496 bytes (Microsoft Corporation, SecureDigital Bus Driver)
0x8ADC4000 C:\Windows\system32\DRIVERS\bowser.sys 102400 bytes (Microsoft Corporation, NT Lan Manager Datagram Receiver Driver)
0x8FBCC000 C:\Windows\system32\DRIVERS\cdrom.sys 98304 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0xA6A60000 C:\Windows\system32\DRIVERS\mrxsmb20.sys 98304 bytes (Microsoft Corporation, Longhorn SMB 2.0 Redirector)
0x918DC000 C:\Windows\System32\Drivers\dfsc.sys 94208 bytes (Microsoft Corporation, DFS Namespace Client Driver)
0x8ABE9000 C:\Windows\system32\DRIVERS\rasl2tp.sys 94208 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0x9052D000 C:\Windows\system32\DRIVERS\usbccgp.sys 94208 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver)
0xAAF70000 C:\Windows\system32\DRIVERS\cdfs.sys 90112 bytes (Microsoft Corporation, CD-ROM File System Driver)
0x90131000 C:\Windows\system32\DRIVERS\pacer.sys 90112 bytes (Microsoft Corporation, QoS-Paketplaner)
0x9055B000 C:\Windows\system32\DRIVERS\tdx.sys 90112 bytes (Microsoft Corporation, TDI Translation Driver)
0x901EB000 C:\Windows\System32\drivers\mpsdrv.sys 86016 bytes (Microsoft Corporation, Microsoft Protection Service Driver)
0x805C6000 C:\Windows\system32\DRIVERS\rassstp.sys 86016 bytes (Microsoft Corporation, RAS SSTP Miniport Call Manager)
0xAAF4E000 C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20101019.039\NAVENG.SYS 81920 bytes (Symantec Corporation, AV Engine)
0x805B2000 C:\Windows\system32\DRIVERS\raspptp.sys 81920 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0x8FD5D000 C:\Windows\system32\DRIVERS\rimsptsk.sys 81920 bytes (REDC, RICOH MS Driver)
0x900A3000 C:\Windows\system32\DRIVERS\smb.sys 81920 bytes (Microsoft Corporation, SMB Transport driver)
0x8FDC3000 C:\Windows\system32\DRIVERS\i8042prt.sys 77824 bytes (Microsoft Corporation, i8042-Anschlusstreiber)
0x921DA000 C:\Windows\system32\DRIVERS\rspndr.sys 77824 bytes (Microsoft Corporation, Link-Layer Topology Responder Driver for NDIS 6)
0x90147000 C:\Windows\system32\DRIVERS\wanarp.sys 77824 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0x8AF8E000 C:\Windows\system32\drivers\disk.sys 69632 bytes (Microsoft Corporation, PnP Disk Driver)
0x90092000 C:\Windows\System32\Drivers\NDProxy.SYS 69632 bytes (Microsoft Corporation, NDIS Proxy)
0x80478000 C:\Windows\system32\PSHED.dll 69632 bytes (Microsoft Corporation, Plattformspezifischer Hardwarefehlertreiber)
0x8FD4C000 C:\Windows\system32\DRIVERS\rimmptsk.sys 69632 bytes (REDC, RICOH SD Driver)
0x82F52000 C:\Windows\system32\drivers\fileinfo.sys 65536 bytes (Microsoft Corporation, FileInfo Filter Driver)
0x904A6000 C:\Windows\system32\DRIVERS\HIDCLASS.SYS 65536 bytes (Microsoft Corporation, Hid Class Library)
0x923E8000 C:\Windows\system32\DRIVERS\lltdio.sys 65536 bytes (Microsoft Corporation, Link-Layer Topology Mapper I/O Driver)
0x80782000 C:\Windows\System32\drivers\mountmgr.sys 65536 bytes (Microsoft Corporation, Mount Point Manager)
0x8FD14000 C:\Windows\system32\DRIVERS\ohci1394.sys 65536 bytes (Microsoft Corporation, 1394 OpenHCI Port Driver)
0x8ADEF000 C:\Windows\system32\DRIVERS\termdd.sys 65536 bytes (Microsoft Corporation, Terminal Server Driver)
0x8AFEA000 C:\Windows\system32\DRIVERS\intelppm.sys 61440 bytes (Microsoft Corporation, Processor Device Driver)
0x923D9000 C:\Windows\system32\DRIVERS\monitor.sys 61440 bytes (Microsoft Corporation, Monitor Driver)
0x8AF58000 C:\Windows\System32\Drivers\mup.sys 61440 bytes (Microsoft Corporation, Multiple UNC Provider driver)
0x8070D000 C:\Windows\System32\drivers\partmgr.sys 61440 bytes (Microsoft Corporation, Partition Management Driver)
0x8F5EB000 C:\Windows\system32\DRIVERS\raspppoe.sys 61440 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0x8FB01000 C:\Windows\system32\DRIVERS\usbehci.sys 61440 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0x80729000 C:\Windows\system32\drivers\volmgr.sys 61440 bytes (Microsoft Corporation, Volume Manager Driver)
0x8FD24000 C:\Windows\system32\DRIVERS\1394BUS.SYS 57344 bytes (Microsoft Corporation, 1394 Bus Device Driver)
0x9FE40000 C:\Windows\System32\cdd.dll 57344 bytes (Microsoft Corporation, Canonical Display Driver)
0x90038000 C:\Windows\system32\DRIVERS\circlass.sys 57344 bytes (Microsoft Corporation, Consumer IR Class Driver for eHome)
0x905EF000 C:\Windows\system32\DRIVERS\netbios.sys 57344 bytes (Microsoft Corporation, NetBIOS interface driver)
0x90544000 C:\Windows\System32\Drivers\Npfs.SYS 57344 bytes (Microsoft Corporation, NPFS Driver)
0x82F12000 C:\Windows\system32\drivers\PCIIDEX.SYS 57344 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0x923C2000 C:\Windows\System32\Drivers\crashdmp.sys 53248 bytes (Microsoft Corporation, Crash Dump Driver)
0x923AE000 C:\Windows\system32\DRIVERS\STREAM.SYS 53248 bytes (Microsoft Corporation, WDM CODEC Class Device Driver 2.0)
0x90050000 C:\Windows\system32\DRIVERS\umbus.sys 53248 bytes (Microsoft Corporation, User-Mode Bus Enumerator)
0x80682000 C:\Windows\system32\drivers\WDFLDR.SYS 53248 bytes (Microsoft Corporation, WDFLDR)
0xA76EB000 C:\Windows\System32\drivers\tcpipreg.sys 49152 bytes (Microsoft Corporation, TCP/IP Registry Compatibility Driver)
0x904E5000 C:\Windows\System32\drivers\vga.sys 49152 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0x8FAAC000 C:\Windows\System32\drivers\watchdog.sys 49152 bytes (Microsoft Corporation, Watchdog Driver)
0x9049B000 C:\Windows\system32\DRIVERS\hidir.sys 45056 bytes (Microsoft Corporation, Infrared Miniport Driver for Input Devices)
0x8FDDE000 C:\Windows\system32\DRIVERS\kbdclass.sys 45056 bytes (Microsoft Corporation, Tastaturklassentreiber)
0x8FDEB000 C:\Windows\system32\DRIVERS\mouclass.sys 45056 bytes (Microsoft Corporation, Mausklassentreiber)
0x90522000 C:\Windows\System32\Drivers\Msfs.SYS 45056 bytes (Microsoft Corporation, Mailslot driver)
0x8FBEF000 C:\Windows\system32\DRIVERS\ndistapi.sys 45056 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0x8FBE4000 C:\Windows\system32\DRIVERS\TDI.SYS 45056 bytes (Microsoft Corporation, TDI Wrapper)
0x8AFD6000 C:\Windows\system32\DRIVERS\tunnel.sys 45056 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver)
0x8FAB8000 C:\Windows\system32\DRIVERS\usbuhci.sys 45056 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
0x82FB8000 C:\Windows\System32\Drivers\AsDsm.sys 40960 bytes (Windows (R) Codename Longhorn DDK provider, Data Security Manager Driver)
0x8071F000 C:\Windows\system32\DRIVERS\BATTC.SYS 40960 bytes (Microsoft Corporation, Battery Class Driver)
0x923CF000 C:\Windows\System32\drivers\Dxapi.sys 40960 bytes (Microsoft Corporation, DirectX API Driver)
0x82F08000 C:\Windows\system32\drivers\msahci.sys 40960 bytes (Microsoft Corporation, MS AHCI 1.0 Standard Driver)
0x90046000 C:\Windows\system32\DRIVERS\mssmbios.sys 40960 bytes (Microsoft Corporation, System Management BIOS Driver)
0x921D0000 C:\Windows\system32\DRIVERS\ndisuio.sys 40960 bytes (Microsoft Corporation, NDIS User mode I/O driver)
0x901E1000 C:\Windows\system32\drivers\nsiproxy.sys 40960 bytes (Microsoft Corporation, NSI Proxy)
0xA76E1000 C:\Windows\System32\Drivers\secdrv.SYS 40960 bytes (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K., Macrovision SECURITY Driver)
0x90179000 C:\Windows\system32\drivers\NIS\1108000.005\SRTSPX.SYS 40960 bytes (Symantec Corporation, Symantec AutoProtect)
0xAAF86000 C:\Windows\system32\DRIVERS\asyncmac.sys 36864 bytes (Microsoft Corporation, MS Remote Access serial network driver)
0x8AFC0000 C:\Windows\system32\drivers\crcdisk.sys 36864 bytes (Microsoft Corporation, Disk Block Verification Filter Driver)
0x904CE000 C:\Windows\System32\Drivers\Fs_Rec.SYS 36864 bytes (Microsoft Corporation, File System Recognizer Driver)
0x904BD000 C:\Windows\system32\DRIVERS\kbdhid.sys 36864 bytes (Microsoft Corporation, HID-Tastaturfiltertreiber)
0xAAF62000 C:\Windows\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)
0x90552000 C:\Windows\System32\DRIVERS\rasacd.sys 36864 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
0x9FE20000 C:\Windows\System32\TSDDD.dll 36864 bytes (Microsoft Corporation, Framebuffer Display Driver)
0x8AFE1000 C:\Windows\system32\DRIVERS\tunmp.sys 36864 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver)
0x806D5000 C:\Windows\system32\drivers\WMILIB.SYS 36864 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0x82EE2000 C:\Windows\system32\drivers\atapi.sys 32768 bytes (Microsoft Corporation, ATAPI IDE Miniport Driver)
0x8FC00000 C:\Windows\system32\DRIVERS\ATKACPI.sys 32768 bytes (ATK0100, ATK0100 ACPI Utility)
0x80489000 C:\Windows\system32\BOOTVID.dll 32768 bytes (Microsoft Corporation, VGA Boot Driver)
0x8FDD6000 C:\Windows\system32\DRIVERS\kbfiltr.sys 32768 bytes ( , Keyboard Filter Driver)
0x904C6000 C:\Windows\system32\DRIVERS\mouhid.sys 32768 bytes (Microsoft Corporation, HID-Mausfiltertreiber)
0x806DE000 C:\Windows\system32\drivers\msisadrv.sys 32768 bytes (Microsoft Corporation, ISA Driver)
0x90512000 C:\Windows\System32\DRIVERS\RDPCDD.sys 32768 bytes (Microsoft Corporation, RDP Miniport)
0x9051A000 C:\Windows\system32\drivers\rdpencdd.sys 32768 bytes (Microsoft Corporation, RDP Miniport)
0x8AF50000 C:\Windows\System32\Drivers\spldr.sys 32768 bytes (Microsoft Corporation, loader for security processor)
0x923F8000 C:\Program Files\ATKGFNEX\ASMMAP.sys 28672 bytes (-, -)
0x904DE000 C:\Windows\System32\Drivers\Beep.SYS 28672 bytes (Microsoft Corporation, BEEP Driver)
0x904B6000 C:\Windows\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
0x80401000 C:\Windows\system32\kdcom.dll 28672 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
0x904D7000 C:\Windows\System32\Drivers\Null.SYS 28672 bytes (Microsoft Corporation, NULL Driver)
0x923BB000 C:\Windows\system32\DRIVERS\sncduvc.SYS 28672 bytes (-, USBCAMD for Sonix UVC)
0x8FDF6000 C:\Windows\system32\DRIVERS\GEARAspiWDM.sys 24576 bytes (GEAR Software Inc., CD DVD Filter)
0x90200000 C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS 24576 bytes (SUPERAdBlocker.com and SUPERAntiSpyware.com, SASDIFSV.SYS)
0xA6B34000 C:\Windows\system32\DRIVERS\lirsgt.sys 20480 bytes
0x8FDFC000 C:\Windows\system32\DRIVERS\CmBatt.sys 16384 bytes (Microsoft Corporation, Control Method Battery Driver)
0x8071C000 C:\Windows\system32\DRIVERS\compbatt.sys 12288 bytes (Microsoft Corporation, Composite Battery Driver)
0xA6B31000 C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys 12288 bytes
0x8F562000 C:\Windows\system32\DRIVERS\nvBridge.kmd 8192 bytes (NVIDIA Corporation, NVIDIA Compatible Windows Vista Kernel Mode Driver, Version 186.31 )
0x8FC08000 C:\Windows\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0x8FDE9000 C:\Windows\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
==============================================
>Stealth
==============================================

Alt 20.10.2010, 12:43   #12
Swisstreasure
/// Malwareteam
 
Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13" - Standard

Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13"



Betreibst Du selber eine Internetseite und hast evtl auf anderen Seiten Werbebanner gesetzt?

Alt 21.10.2010, 14:09   #13
Maikeost
 
Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13" - Standard

Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13"



Ja, die Internetseite www.griechen-farm.de. Aber ich betreibe keine Werbebanner auf anderen Seiten...

Gruß
Maike

Alt 21.10.2010, 18:50   #14
Swisstreasure
/// Malwareteam
 
Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13" - Standard

Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13"



Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.
Lade ComboFix von einem der unten aufgeführten Links herunter. Du musst diese umbenennen, bevor Du es auf den Desktop speicherst. Speichere ComboFix auf deinen Desktop.**NB: Es ist wichtig, das ComboFix.exe auf dem Desktop gespeichert wird**



  • Deaktivere Deine Anti-Virus- und Anti-Spyware-Programme. Normalerweise kannst Du dies über einen Rechtsklick auf das Systemtray-Icon tun. Die Programme könnten sonst eventuell unsere Programme bei deren Arbeit stören.
  • Doppel-klicke auf ComboFix.exe und folge den Aufforderungen.
    • Wenn ComboFix fertig ist, wird es ein Log für dich erstellen.
    • Bitte poste mir den Inhalt von C:\ComboFix.txt hier in de Thread.

Alt 25.10.2010, 17:34   #15
Maikeost
 
Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13" - Standard

Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13"



Combofix Logfile:
Code:
ATTFilter
ComboFix 10-10-24.06 - Maike 25.10.2010  17:56:51.1.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3070.1807 [GMT 2:00]
ausgeführt von:: c:\users\Maike\Desktop\Combo-Fix.exe
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Maike\AppData\Local\TempDIR
c:\windows\system32\sqlite3.dll

.
(((((((((((((((((((((((   Dateien erstellt von 2010-09-25 bis 2010-10-25  ))))))))))))))))))))))))))))))
.

2010-10-25 16:12 . 2010-10-25 16:17        --------        d-----w-        c:\users\Maike\AppData\Local\temp
2010-10-25 16:12 . 2010-10-25 16:12        --------        d-----w-        c:\users\Default\AppData\Local\temp
2010-10-25 16:12 . 2010-10-25 16:12        --------        d-----w-        c:\users\Arbeit\AppData\Local\temp
2010-10-18 10:24 . 2010-10-18 10:24        --------        d-----w-        c:\windows\Sun
2010-10-17 11:32 . 2010-10-17 11:32        --------        d-sh--w-        c:\programdata\System Restore
2010-10-16 15:07 . 2010-10-16 15:07        --------        d-----w-        c:\program files\ESET
2010-10-16 14:50 . 2010-10-16 14:50        --------        d-----w-        C:\_OTL
2010-10-14 15:28 . 2006-06-19 11:01        69632        ----a-w-        c:\windows\system32\ztvcabinet.dll
2010-10-14 15:28 . 2006-05-25 13:52        162304        ----a-w-        c:\windows\system32\ztvunrar36.dll
2010-10-14 15:28 . 2005-08-25 23:50        77312        ----a-w-        c:\windows\system32\ztvunace26.dll
2010-10-14 15:28 . 2002-03-05 23:00        75264        ----a-w-        c:\windows\system32\unacev2.dll
2010-10-14 15:28 . 2003-02-02 18:06        153088        ----a-w-        c:\windows\system32\UNRAR3.dll
2010-10-14 15:28 . 2010-10-14 15:42        --------        d-----w-        c:\program files\Trojan Remover
2010-10-14 15:28 . 2010-10-14 15:28        --------        d-----w-        c:\users\Maike\AppData\Roaming\Simply Super Software
2010-10-14 15:28 . 2010-10-14 15:28        --------        d-----w-        c:\programdata\Simply Super Software
2010-10-14 14:59 . 2010-10-20 10:43        --------        d-----w-        c:\users\Maike\Logs
2010-10-14 14:41 . 2010-10-14 14:41        --------        d-----w-        c:\programdata\WindowsSearch
2010-10-14 13:13 . 2010-10-14 13:13        --------        d-----w-        c:\users\Maike\AppData\Roaming\SUPERAntiSpyware.com
2010-10-14 13:13 . 2010-10-14 13:13        --------        d-----w-        c:\programdata\SUPERAntiSpyware.com
2010-10-14 13:13 . 2010-10-14 13:13        --------        d-----w-        c:\program files\SUPERAntiSpyware
2010-10-13 19:57 . 2010-10-13 19:57        --------        d-----w-        c:\program files\Audible
2010-10-13 18:36 . 2009-05-18 11:17        26600        ----a-w-        c:\windows\system32\drivers\GEARAspiWDM.sys
2010-10-13 18:36 . 2008-04-17 10:12        107368        ----a-w-        c:\windows\system32\GEARAspi.dll
2010-10-13 18:35 . 2010-10-13 18:35        --------        d-----w-        c:\program files\iPod
2010-10-13 18:35 . 2010-10-13 18:36        --------        d-----w-        c:\program files\iTunes
2010-10-13 13:23 . 2010-09-13 13:56        168960        ----a-w-        c:\program files\Windows Media Player\wmplayer.exe
2010-10-13 13:23 . 2010-09-13 13:56        8147456        ----a-w-        c:\windows\system32\wmploc.DLL
2010-10-13 13:23 . 2010-08-31 15:46        954752        ----a-w-        c:\windows\system32\mfc40.dll
2010-10-13 13:23 . 2010-08-31 15:46        954288        ----a-w-        c:\windows\system32\mfc40u.dll
2010-10-13 13:23 . 2010-09-06 16:20        125952        ----a-w-        c:\windows\system32\srvsvc.dll
2010-10-13 13:23 . 2010-09-06 13:45        304128        ----a-w-        c:\windows\system32\drivers\srv.sys
2010-10-13 13:23 . 2010-09-06 13:45        102400        ----a-w-        c:\windows\system32\drivers\srvnet.sys
2010-10-13 13:23 . 2010-09-06 16:19        17920        ----a-w-        c:\windows\system32\netevent.dll
2010-10-13 13:23 . 2010-09-06 13:45        145408        ----a-w-        c:\windows\system32\drivers\srv2.sys
2010-10-13 13:22 . 2010-08-10 15:53        274944        ----a-w-        c:\windows\system32\schannel.dll
2010-10-13 13:19 . 2010-10-13 13:19        --------        d-----w-        c:\programdata\Vokabel Trainer
2010-10-13 13:18 . 2010-10-13 13:18        --------        d-----w-        c:\program files\vokabeltrainer
2010-10-13 13:16 . 2010-10-13 13:16        --------        d-----w-        c:\program files\Conduit
2010-10-13 13:12 . 2010-08-31 13:27        2038272        ----a-w-        c:\windows\system32\win32k.sys
2010-10-13 13:12 . 2010-05-04 19:13        231424        ----a-w-        c:\windows\system32\msshsq.dll
2010-10-13 13:09 . 2010-08-20 16:05        867328        ----a-w-        c:\windows\system32\wmpmde.dll
2010-10-13 13:07 . 2010-08-31 15:44        531968        ----a-w-        c:\windows\system32\comctl32.dll
2010-10-04 16:09 . 2010-10-04 16:15        --------        d-----w-        c:\program files\Joomla
2010-09-29 15:26 . 2010-06-22 13:30        2048        ----a-w-        c:\windows\system32\tzres.dll
2010-09-29 15:26 . 2010-08-26 04:23        13312        ----a-w-        c:\program files\Internet Explorer\iecompat.dll
2010-09-28 14:19 . 2010-09-28 14:19        --------        d-----w-        c:\users\Maike\AppData\Roaming\FireShot
2010-09-25 18:02 . 2010-09-26 09:13        --------        d-----w-        c:\windows\system32\drivers\NIS\1108000.005

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-17 14:11 . 2010-09-17 06:06        128000        ----a-w-        c:\windows\system32\spoolsv.exe
2010-08-10 03:15 . 2010-08-10 03:15        94208        ----a-w-        c:\windows\system32\QuickTimeVR.qtx
2010-08-10 03:15 . 2010-08-10 03:15        69632        ----a-w-        c:\windows\system32\QuickTime.qts
2010-07-27 16:44 . 2010-07-27 16:44        91424        ----a-w-        c:\windows\system32\dnssd.dll
2010-07-27 16:44 . 2010-07-27 16:44        75040        ----a-w-        c:\windows\system32\jdns_sd.dll
2010-07-27 16:44 . 2010-07-27 16:44        197920        ----a-w-        c:\windows\system32\dnssdX.dll
2010-07-27 16:44 . 2010-07-27 16:44        107808        ----a-w-        c:\windows\system32\dns-sd.exe
2010-04-02 11:40 . 2010-04-02 11:40        454656        ----a-w-        c:\program files\putty06.exe
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ADSMOverlayIcon1]
@="{A8D448F4-0431-45AC-9F5E-E1B434AB2249}"
[HKEY_CLASSES_ROOT\CLSID\{A8D448F4-0431-45AC-9F5E-E1B434AB2249}]
2007-06-02 00:08        143360        ----a-w-        c:\program files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2008-07-19 104936]
"P2Go_Menu"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]
"HControlUser"="c:\program files\ASUS\ATK Hotkey\HControlUser.exe" [2008-08-18 98304]
"ATKOSD2"="c:\program files\ASUS\ATKOSD2\ATKOSD2.exe" [2009-03-04 8392704]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-05-06 7440928]
"VolPanel"="c:\program files\Creative\SB Audigy\Volume Panel\VolPanlu.exe" [2008-12-29 237693]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1029416]
"ATKMEDIA"="c:\program files\ASUS\ATK Media\DMedia.exe" [2008-08-19 159744]
"ACMON"="c:\program files\ASUS\Splendid\ACMON.exe" [2008-10-01 851968]
"ADSMTray"="c:\program files\ASUS\ASUS Data Security Manager\ADSMTray.exe" [2008-04-01 266240]
"ASUS Screen Saver Protector"="c:\windows\ASScrPro.exe" [2009-08-04 33136]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-07-02 13789728]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-08-10 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-01 421160]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-10-16 214360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Audible Download Manager.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Audible Download Manager.lnk
backup=c:\windows\pss\Audible Download Manager.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-20 21:07        932288        ----a-r-        c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-09-23 02:47        35760        ----a-w-        c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Camera ScreenSaver]
2009-08-04 01:29        47672        ----a-w-        c:\windows\AsScrProlog.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RunDLLEntry]
2009-02-26 19:07        14848        ----a-w-        c:\windows\System32\AmbRunE.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 09:43        248040        ----a-w-        c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2010-09-28 14:04        2424560        ----a-w-        c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2009-09-25 07:41        198160        ----a-w-        c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrojanScanner]
2010-07-05 10:49        1167296        ----a-w-        c:\program files\Trojan Remover\Trjscan.exe

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2008-01-29 29736]
R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2009-08-04 79360]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2009-08-04 79360]
R3 ipswuio;ipswuio;c:\windows\system32\DRIVERS\ipswuio.sys [x]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1108000.005\SYMDS.SYS [2009-11-05 328752]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1108000.005\SYMEFA.SYS [2010-04-22 173104]
S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20101001.001\BHDrvx86.sys [2010-08-31 692272]
S1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1108000.005\ccHPx86.sys [2010-02-26 501888]
S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20101021.003\IDSvix86.sys [2010-10-19 353840]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1108000.005\Ironx86.SYS [2010-04-29 116784]
S1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\System32\Drivers\NIS\1108000.005\SYMTDIV.SYS [2010-05-06 339504]
S2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\17.8.0.5\ccSvcHst.exe [2010-02-26 126392]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2010-05-27 102448]
S3 itecir;ITECIR Infrared Receiver;c:\windows\system32\DRIVERS\itecir.sys [2007-12-19 54784]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs        REG_MULTI_SZ           BthServ
HPZ12        REG_MULTI_SZ           Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt        REG_MULTI_SZ           hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 17:14        451872        ----a-w-        c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
.
------- Zusätzlicher Suchlauf -------
.
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Nach Microsoft &Excel exportieren - c:\progra~3\MICROS~1\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Maike\AppData\Roaming\Mozilla\Firefox\Profiles\n98g2py1.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT2319825&SearchSource=13
FF - component: c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\coFFPlgn\components\coFFPlgn.dll
FF - component: c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\IPSFFPlgn\components\IPSFFPl.dll
FF - component: c:\users\Maike\AppData\Roaming\Mozilla\Firefox\Profiles\n98g2py1.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\platform\WINNT_x86-msvc\components\SSSLauncher.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\programme\Real Player\Netscape6\nppl3260.dll
FF - plugin: c:\programme\Real Player\Netscape6\nprjplug.dll
FF - plugin: c:\programme\Real Player\Netscape6\nprpjplug.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX Richtlinien ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true);  // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true);  // Simplified
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

MSConfigStartUp-PcSync - c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe



**************************************************************************
Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien:

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\17.8.0.5\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\17.8.0.5\diMaster.dll\" /prefetch:1"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'Explorer.exe'(3424)
c:\program files\ASUS\ASUS Data Security Manager\OverlayIconShlExt.dll
c:\program files\ASUS\ASUS Data Security Manager\OverlayIconShlExt1.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\Creative\Shared Files\CTAudSvc.exe
c:\program files\ASUS\ASUS Data Security Manager\ADSMSrv.exe
c:\windows\system32\nvvsvc.exe
c:\windows\system32\WLANExt.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\ASUS\NB Probe\SPM\spmgr.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\servicing\TrustedInstaller.exe
c:\windows\system32\DllHost.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\P4G\BatteryLife.exe
c:\program files\ASUS\SmartLogon\sensorsrv.exe
c:\windows\system32\conime.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-10-25  18:24:08 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2010-10-25 16:23

Vor Suchlauf: 9 Verzeichnis(se), 74.360.156.160 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 73.951.416.320 Bytes frei

- - End Of File - - 0A674F12552A37260CCA035983A4576E
         
--- --- ---

Antwort

Themen zu Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13"
angriff, appdata, computer, detected, erkannt, firefox, flash player, folge, forum, hack, hackangriff, log, logfile auswerten, macromedia, malicious, microsoft, mozilla, norton, port, programm, roaming, scan, superantispyware, system, tcp, toolkit variant, variant, windows



Ähnliche Themen: Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13"


  1. Ist ein Download von "http://au.v4.download.windowsupdate.com..." sicher? Avast meldet eine Bedrohung
    Plagegeister aller Art und deren Bekämpfung - 12.09.2015 (1)
  2. Windwos 7: Norton meldet sich ca. jede Minute mit "system infected: trojan.ransomlock.g"
    Plagegeister aller Art und deren Bekämpfung - 30.01.2015 (15)
  3. Norton meldet ständig "System Infected: Trojan.Ransomlock.G" blockiert
    Plagegeister aller Art und deren Bekämpfung - 20.01.2015 (17)
  4. Win7: Malwarebytes zeigt zwei "Malicious items" an
    Log-Analyse und Auswertung - 30.11.2014 (11)
  5. Windows Vista: ständige Virusmeldung bei Avira Antivirus "Malicious.Flash.Gen"
    Log-Analyse und Auswertung - 22.12.2013 (11)
  6. Windows 7 "PUP Babylon Toolbar" und "a variant of Win32/Bundled.Toolbar.Ask.D" gefunden
    Log-Analyse und Auswertung - 26.09.2013 (9)
  7. Norton meldet "Eindringversuch von ...insert IP here... wurde blockiert" - Quelle angeblich Skype
    Antiviren-, Firewall- und andere Schutzprogramme - 12.08.2013 (2)
  8. GMER meldet "hidden rootkit activity" & Rechner langsam
    Plagegeister aller Art und deren Bekämpfung - 14.02.2013 (19)
  9. Wie kann man das "Java Deployment Toolkit" im Browser deinstallieren?
    Alles rund um Windows - 19.01.2013 (2)
  10. AVIRA meldet "W32/Patched.ZA", "TR/ATRAPS.Gen2", "TR/ATRAPS.Gen", "ZR/sirefe.P.487"
    Log-Analyse und Auswertung - 30.07.2012 (9)
  11. "Trojan.Vundo-Variant/F" in Datei "C:\Windows\Syswow64\avsredirect.dll" + vorher weitere Schädlinge
    Plagegeister aller Art und deren Bekämpfung - 19.12.2010 (15)
  12. MBR reparieren, da mbr.exe "malicious code" und "copy of MBR" meldet
    Plagegeister aller Art und deren Bekämpfung - 28.11.2010 (24)
  13. Internet Explorer: Kein Serverzugriff wg. "Malicious Acitivity"
    Plagegeister aller Art und deren Bekämpfung - 02.09.2010 (22)
  14. "Your System is infected - Spyware activity has been detected..."
    Log-Analyse und Auswertung - 16.01.2010 (1)
  15. ">"">><meta http-equiv="Refresh" content="0;url=http://askimizsonsuza.com/code/">"">
    Plagegeister aller Art und deren Bekämpfung - 04.09.2006 (4)
  16. Norton meldet "IRC.Backdoor.trojan"
    Log-Analyse und Auswertung - 01.05.2006 (13)
  17. Bekomme "http://default.home/" und "ACCESS BLOCKED - VIRUS WARNING" nicht mehr los
    Log-Analyse und Auswertung - 16.01.2005 (5)

Zum Thema Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13" - Hallo! Seit 2 Tagen erhalte ich immer wieder Meldungen von Norton, dass folgender Angriff erkannt wurde: HTTP Malicious Toolkit Variant Activity 13 Angreifender Computer: Mein eigener?! Agreifer-URL: bikleman.com/sex/inex.php?s=IBB@G Zieladresse: bikleman.com - Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13"...
Archiv
Du betrachtest: Norton meldet Zwischenfall: "HTTP Malicious Toolkit Variant Activity 13" auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.