| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: svchost.bat? Was ist das?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
| |
18.01.2011, 15:26
| #1 |
 |  svchost.bat? Was ist das? Wie kann ich Norton 360 vollständig deaktivieren? |
|
18.01.2011, 16:05
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | svchost.bat? Was ist das? Musst im Handbuch nachsehen. Ich kann unmöglich wissen, wie alle 2965 Virenscanner, die es so auf der Welt gibt, im Detail funktionieren / zu bedienen sind. Etwas Eigeninitiative schadet nie!
__________________
__________________ |
|
18.01.2011, 16:10
| #3 |
| | svchost.bat? Was ist das? Habe das Handbuch verlegt ~_~
__________________Dann muss ich wohl Norton deinstallieren - der Key geht eh nur noch wenige Tage und ich habe sowieso bald vor mir GData zu kaufen, da Norton für mich Müll ist. |
|
18.01.2011, 16:15
| #4 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | svchost.bat? Was ist das?Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
18.01.2011, 16:32
| #5 |
| | svchost.bat? Was ist das?Code:
ATTFilter ComboFix 11-01-17.05 - Daniel 18.01.2011 16:26:53.1.2 - x86
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.49.1031.18.3327.2578 [GMT 1:00]
ausgeführt von:: c:\users\Daniel\Desktop\cofi.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
((((((((((((((((((((((( Dateien erstellt von 2010-12-18 bis 2011-01-18 ))))))))))))))))))))))))))))))
.
2011-01-18 15:30 . 2011-01-18 15:30 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-01-18 14:07 . 2011-01-18 14:07 -------- d-----w- c:\program files\CCleaner
2011-01-18 13:47 . 2011-01-18 13:47 -------- d-----w- C:\_OTL
2011-01-17 13:30 . 2011-01-18 14:09 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2011-01-17 13:30 . 2011-01-17 13:30 -------- d-----w- c:\program files\Spybot - Search & Destroy
2011-01-17 13:23 . 2011-01-17 13:23 -------- d-----w- c:\users\Daniel\AppData\Roaming\Malwarebytes
2011-01-17 13:23 . 2011-01-17 13:23 -------- d-----w- c:\programdata\Malwarebytes
2011-01-17 13:23 . 2010-12-20 17:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-01-17 13:23 . 2011-01-17 13:23 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-01-17 13:23 . 2010-12-20 17:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-01-15 20:14 . 2011-01-15 21:56 -------- d-----w- c:\users\Daniel\AppData\Roaming\Windows Live Writer
2011-01-15 20:14 . 2011-01-15 20:14 -------- d-----w- c:\users\Daniel\AppData\Local\Windows Live Writer
2011-01-15 19:43 . 2011-01-15 19:43 -------- d-----w- c:\users\Daniel\AppData\Roaming\Leadertech
2011-01-15 19:43 . 2011-01-15 19:43 53248 ----a-r- c:\users\Daniel\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2011-01-15 19:43 . 2011-01-15 19:43 16400 ----a-w- c:\windows\system32\drivers\LNonPnP.sys
2011-01-15 19:42 . 2011-01-15 19:43 -------- d-----w- c:\programdata\Logishrd
2011-01-15 19:42 . 2011-01-15 19:42 -------- d-----w- c:\program files\Logitech
2011-01-15 19:41 . 2011-01-15 19:43 -------- d-----w- c:\program files\Common Files\LogiShrd
2011-01-15 19:40 . 2011-01-15 19:46 -------- d-----w- c:\users\Daniel\AppData\Roaming\Logitech
2011-01-15 19:40 . 2011-01-15 19:41 -------- d-----w- c:\users\Daniel\AppData\Roaming\Logishrd
2011-01-14 21:11 . 2011-01-14 21:11 -------- d-----w- c:\program files\Electronic Arts
2011-01-14 21:10 . 2001-09-05 04:18 225280 ------w- c:\program files\Common Files\InstallShield\IScript\IScript.dll
2011-01-14 21:10 . 2001-09-05 04:14 176128 ------w- c:\program files\Common Files\InstallShield\engine\6\Intel 32\iuser.dll
2011-01-14 21:10 . 2001-09-05 04:13 32768 ------w- c:\program files\Common Files\InstallShield\engine\6\Intel 32\objectps.dll
2011-01-14 21:10 . 2001-09-05 04:18 77824 ----a-w- c:\program files\Common Files\InstallShield\engine\6\Intel 32\ctor.dll
2011-01-13 19:00 . 2011-01-16 13:58 -------- d-----w- C:\Fraps
2011-01-11 19:20 . 2000-01-04 05:39 212992 ----a-w- c:\program files\Common Files\InstallShield\engine\6\Intel 32\ILog.dll
2011-01-09 19:37 . 2011-01-09 19:37 -------- d-----w- c:\users\Daniel\AppData\Local\Diagnostics
2011-01-06 19:01 . 2011-01-06 19:01 -------- d-----w- c:\users\Daniel\AppData\Local\Zattoo
2011-01-06 19:01 . 2011-01-06 19:01 -------- d-----w- c:\program files\Zattoo4
2010-12-30 12:12 . 2010-12-30 12:12 -------- d-----w- c:\users\Daniel\AppData\Local\{20AE1908-0B43-449A-8231-399911053B25}
2010-12-30 11:23 . 2010-12-30 11:23 -------- d-----w- c:\programdata\Synetic
2010-12-30 11:18 . 2010-12-30 11:18 -------- d-----w- c:\program files\ProtectDisc Driver Installer
2010-12-30 11:18 . 2010-12-30 11:18 -------- d-----w- c:\users\Daniel\AppData\Roaming\ProtectDISC
2010-12-30 11:17 . 2010-12-30 23:23 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE
2010-12-30 11:17 . 2010-12-30 11:17 -------- d-----w- c:\windows\system32\xlive
2010-12-30 00:23 . 2010-12-30 00:23 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-12-30 00:22 . 2010-12-30 00:23 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-12-30 00:22 . 2010-12-30 11:09 -------- d-----w- c:\users\Daniel\AppData\Roaming\DAEMON Tools Lite
2010-12-30 00:22 . 2010-12-30 00:22 -------- d-----w- c:\programdata\DAEMON Tools Lite
2010-12-29 14:18 . 2008-11-04 12:12 23096 ----a-w- c:\windows\system32\drivers\MTiCtwl.sys
2010-12-29 13:42 . 2010-12-29 13:42 -------- d-----w- c:\program files\CPUID
2010-12-29 13:42 . 2010-07-09 12:18 20328 ----a-w- c:\windows\system32\drivers\cpuz134_x32.sys
2010-12-29 12:08 . 2010-12-29 12:11 -------- d-----w- c:\users\Daniel\AppData\Local\{83E78A7F-678C-419C-86F6-F271115401A4}
2010-12-28 23:24 . 2010-12-28 23:24 -------- d-----w- c:\program files\MSXML 4.0
2010-12-28 21:06 . 2010-12-28 21:06 -------- d-----w- c:\users\Daniel\AppData\Local\{4EF3B195-5BEA-4421-8C86-819D57AFDA2B}
2010-12-28 17:26 . 2010-12-28 17:26 -------- d-----w- c:\users\Daniel\AppData\Roaming\NVIDIA
2010-12-28 17:26 . 2010-12-28 17:26 -------- d-----w- c:\users\Daniel\AppData\Local\2K Games
2010-12-28 16:35 . 2010-12-29 12:08 -------- d-----w- c:\program files\Common Files\Steam
2010-12-28 13:47 . 2010-12-28 13:47 -------- d-----w- c:\program files\MSI Kombustor (DX11)
2010-12-28 13:03 . 2010-12-28 13:03 -------- d-----w- C:\NVIDIA
2010-12-28 13:02 . 2011-01-18 15:22 -------- d-----w- c:\programdata\NVIDIA
2010-12-28 12:43 . 2010-12-28 12:43 -------- d-----w- c:\programdata\NVIDIA Corporation
2010-12-28 12:43 . 2010-12-28 17:26 -------- d-----w- c:\program files\NVIDIA Corporation
2010-12-28 09:05 . 2010-12-28 09:06 -------- d-----w- c:\users\Daniel\AppData\Local\{3C200DEE-2DB4-447B-B4F7-E814DB398D81}
2010-12-27 23:55 . 2010-12-27 23:55 229224 ----a-w- c:\windows\system32\drivers\VMM.sys
2010-12-27 17:15 . 2010-12-27 17:15 -------- d-----w- c:\users\Daniel\AppData\Local\MCEdit
2010-12-27 16:44 . 2009-04-16 13:08 312832 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\hpfpp70v.dll
2010-12-27 16:43 . 2010-12-27 16:43 -------- d-----w- c:\program files\Common Files\HP
2010-12-27 16:43 . 2010-12-27 16:43 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
2010-12-27 16:42 . 2009-04-16 13:08 123904 ----a-w- c:\windows\system32\hpf3l70v.dll
2010-12-27 16:42 . 2010-12-27 16:43 -------- d-----w- c:\program files\HP
2010-12-27 16:41 . 2010-12-27 16:41 -------- d-----w- c:\programdata\HP
2010-12-27 16:41 . 2009-04-16 11:53 452408 ----a-w- c:\windows\system32\hpzids01.dll
2010-12-27 16:41 . 2009-02-11 11:03 712704 ----a-w- c:\windows\system32\hposwia_d02c.dll
2010-12-27 16:41 . 2009-02-11 11:03 589824 ----a-w- c:\windows\system32\hpost_d02c.dll
2010-12-27 16:41 . 2009-02-11 11:03 315392 ----a-w- c:\windows\system32\hposc_d02a.dll
2010-12-27 16:41 . 2008-10-29 00:27 372736 ----a-w- c:\windows\system32\hppldcoi.dll
2010-12-27 16:29 . 2010-12-27 16:29 -------- d-----w- c:\users\Daniel\AppData\Local\ElevatedDiagnostics
2010-12-27 16:05 . 2010-12-27 16:05 -------- d-----w- c:\users\Daniel\AppData\Local\{B75D4B22-08C3-4F00-97B6-F37AD93F0742}
2010-12-27 16:05 . 2011-01-18 14:09 -------- d-----w- c:\users\Daniel\Tracing
2010-12-27 15:32 . 2010-12-27 15:32 -------- d-----w- c:\windows\PCHEALTH
2010-12-27 15:25 . 2011-01-15 20:10 -------- d-----w- c:\program files\Windows Live
2010-12-27 15:22 . 2010-12-29 17:41 -------- d-----w- c:\program files\Microsoft Silverlight
2010-12-27 15:19 . 2010-05-23 10:15 1619456 ----a-w- c:\windows\system32\WMVDECOD.DLL
2010-12-27 15:19 . 2010-05-23 10:11 196608 ----a-w- c:\windows\system32\mfreadwrite.dll
2010-12-27 15:19 . 2010-05-23 10:11 3181568 ----a-w- c:\windows\system32\mf.dll
2010-12-27 15:17 . 2011-01-15 20:13 -------- d-----w- c:\users\Daniel\AppData\Local\Windows Live
2010-12-27 15:17 . 2010-12-27 15:17 -------- d-----w- c:\program files\Common Files\Windows Live
2010-12-27 10:29 . 2010-12-27 10:29 -------- d-----w- c:\program files\Microsoft.NET
2010-12-26 23:21 . 2009-09-10 05:52 257024 ----a-w- c:\windows\system32\msv1_0.dll
2010-12-26 23:20 . 2009-11-25 11:47 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2010-12-26 23:20 . 2009-11-25 11:47 49472 ----a-w- c:\windows\system32\netfxperf.dll
2010-12-26 23:20 . 2009-11-25 11:47 297808 ----a-w- c:\windows\system32\mscoree.dll
2010-12-26 23:20 . 2009-11-25 11:47 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2010-12-26 23:20 . 2009-11-25 11:47 1130824 ----a-w- c:\windows\system32\dfshim.dll
2010-12-26 23:16 . 2010-02-11 07:10 293376 ----a-w- c:\windows\system32\browserchoice.exe
2010-12-26 23:16 . 2010-03-04 03:57 190976 ----a-w- c:\windows\system32\drivers\ks.sys
2010-12-26 21:56 . 2010-12-26 21:57 -------- d-----w- c:\users\Daniel\AppData\Roaming\.minecraft
2010-12-26 16:33 . 2010-04-07 07:10 571904 ----a-w- c:\windows\system32\oleaut32.dll
2010-12-26 16:31 . 2010-12-26 16:31 -------- d-----w- c:\programdata\Hewlett-Packard
2010-12-26 16:31 . 2009-07-14 01:15 280064 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\hpzppw71.dll
2010-12-26 16:30 . 2010-10-20 03:00 2327552 ----a-w- c:\windows\system32\win32k.sys
2010-12-26 15:16 . 2010-12-26 15:16 -------- d-----w- c:\program files\Safari
2010-12-26 15:15 . 2010-12-26 15:15 -------- d-----w- c:\program files\iPod
2010-12-26 15:11 . 2010-12-26 15:11 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin7.dll
2010-12-26 15:11 . 2010-12-26 15:11 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin6.dll
2010-12-26 15:11 . 2010-12-26 15:11 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2010-12-26 15:11 . 2010-12-26 15:11 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2010-12-26 15:11 . 2010-12-26 15:11 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2010-12-26 15:11 . 2010-12-26 15:11 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2010-12-26 15:11 . 2010-12-26 15:11 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-14 17:49 . 2010-12-14 17:49 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-12-12 17:57 . 2010-12-12 17:57 164880 ---ha-w- c:\users\Daniel\AppData\Roaming\Microsoft\Virtual PC\VPCKeyboard.dll
2010-11-29 16:38 . 2010-11-29 16:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-11-29 16:38 . 2010-11-29 16:38 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-11-16 11:01 . 2010-12-10 23:11 6273872 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A3830CA3-D68E-45F3-B785-3C0453B19E79}\mpengine.dll
2010-11-10 01:54 . 2010-11-10 01:54 49016 ----a-w- c:\windows\system32\sirenacm.dll
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="d:\programme\RocketDock\RocketDock.exe" [2007-09-02 495616]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2010-10-28 10:13 64592 ----a-w- c:\program files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.drv
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-12-30 691696]
S2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [2010-02-24 185472]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 20992]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-08-18 176128]
S2 cpuz134;cpuz134;c:\windows\system32\drivers\cpuz134_x32.sys [2010-07-09 20328]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-07-09 248936]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
.
------- Zusätzlicher Suchlauf -------
.
uInternet Settings,ProxyOverride = *.local
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
[HKEY_USERS\S-1-5-21-1825434329-3494875349-1569995196-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
[HKEY_USERS\S-1-5-21-1825434329-3494875349-1569995196-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2011-01-18 16:31:14
ComboFix-quarantined-files.txt 2011-01-18 15:31
Vor Suchlauf: 10 Verzeichnis(se), 27.060.678.656 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 26.837.024.768 Bytes frei
- - End Of File - - 8DBE9AABA67EA2303F4CCD9133D07042
|
|
18.01.2011, 19:15
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | svchost.bat? Was ist das? Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen. Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst. Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
__________________ --> svchost.bat? Was ist das? |
|
18.01.2011, 19:40
| #7 |
| | svchost.bat? Was ist das? GMER: Code:
ATTFilter GMER 1.0.15.15530 - hxxp://www.gmer.net
Rootkit scan 2011-01-18 19:38:47
Windows 6.1.7600 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD1600AAJB-00J3A0 rev.01.03E01
Running: tooisb8h.exe; Driver: C:\Users\Daniel\AppData\Local\Temp\uxrirpod.sys
---- Kernel code sections - GMER 1.0.15 ----
.text ntkrnlpa.exe!ZwSaveKeyEx + 13AD 82C57599 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82C7BF52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
? System32\Drivers\spnu.sys Das System kann den angegebenen Pfad nicht finden. !
.text USBPORT.SYS!DllUnload 9105ACA0 5 Bytes JMP 86A4C1D8
.text arf1h6gp.SYS 92DAF000 12 Bytes [44, 98, 02, 83, EE, 96, 02, ...]
.text arf1h6gp.SYS 92DAF00D 9 Bytes [77, 02, 83, 48, 9B, 02, 83, ...] {JA 0x4; OR DWORD [EAX-0x65], 0x2; ADD DWORD [EAX], 0x0}
.text arf1h6gp.SYS 92DAF017 20 Bytes [00, DE, C7, B1, 8B, E6, C5, ...]
.text arf1h6gp.SYS 92DAF02C 149 Bytes [00, 00, 00, 00, D0, 21, C5, ...]
.text arf1h6gp.SYS 92DAF0C3 8 Bytes [00, 00, 00, 00, 00, 00, 00, ...] {ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL}
.text ...
.vmp2 C:\Windows\system32\drivers\acedrv11.sys entry point in ".vmp2" section [0x9A15769D]
? C:\Users\Daniel\AppData\Local\Temp\catchme.sys Das System kann die angegebene Datei nicht finden. !
? C:\Windows\system32\Drivers\PROCEXP113.SYS Das System kann die angegebene Datei nicht finden. !
---- Kernel IAT/EAT - GMER 1.0.15 ----
IAT \SystemRoot\system32\DRIVERS\atapi.sys[ataport.SYS!AtaPortReadPortUchar] [8BA20042] \SystemRoot\System32\Drivers\spnu.sys
IAT \SystemRoot\system32\DRIVERS\atapi.sys[ataport.SYS!AtaPortWritePortUchar] [8BA206D6] \SystemRoot\System32\Drivers\spnu.sys
IAT \SystemRoot\system32\DRIVERS\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort] [8BA20800] \SystemRoot\System32\Drivers\spnu.sys
IAT \SystemRoot\system32\DRIVERS\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort] [8BA2013E] \SystemRoot\System32\Drivers\spnu.sys
IAT \SystemRoot\System32\Drivers\arf1h6gp.SYS[ataport.SYS!AtaPortNotification] 00147880
IAT \SystemRoot\System32\Drivers\arf1h6gp.SYS[ataport.SYS!AtaPortQuerySystemTime] 78800C75
IAT \SystemRoot\System32\Drivers\arf1h6gp.SYS[ataport.SYS!AtaPortReadPortUchar] 06750015
IAT \SystemRoot\System32\Drivers\arf1h6gp.SYS[ataport.SYS!AtaPortStallExecution] C25DC033
IAT \SystemRoot\System32\Drivers\arf1h6gp.SYS[ataport.SYS!AtaPortWritePortUchar] 458B0008
IAT \SystemRoot\System32\Drivers\arf1h6gp.SYS[ataport.SYS!AtaPortWritePortUlong] 6A006A08
IAT \SystemRoot\System32\Drivers\arf1h6gp.SYS[ataport.SYS!AtaPortGetPhysicalAddress] 50056A24
IAT \SystemRoot\System32\Drivers\arf1h6gp.SYS[ataport.SYS!AtaPortConvertPhysicalAddressToUlong] 005AB7E8
IAT \SystemRoot\System32\Drivers\arf1h6gp.SYS[ataport.SYS!AtaPortGetScatterGatherList] 0001B800
IAT \SystemRoot\System32\Drivers\arf1h6gp.SYS[ataport.SYS!AtaPortGetParentBusType] C25D0000
IAT \SystemRoot\System32\Drivers\arf1h6gp.SYS[ataport.SYS!AtaPortRequestCallback] CCCC0008
IAT \SystemRoot\System32\Drivers\arf1h6gp.SYS[ataport.SYS!AtaPortWritePortBufferUshort] CCCCCCCC
IAT \SystemRoot\System32\Drivers\arf1h6gp.SYS[ataport.SYS!AtaPortGetUnCachedExtension] CCCCCCCC
IAT \SystemRoot\System32\Drivers\arf1h6gp.SYS[ataport.SYS!AtaPortCompleteRequest] CCCCCCCC
IAT \SystemRoot\System32\Drivers\arf1h6gp.SYS[ataport.SYS!AtaPortCopyMemory] 53EC8B55
IAT \SystemRoot\System32\Drivers\arf1h6gp.SYS[ataport.SYS!AtaPortEtwTraceLog] 800C5D8B
IAT \SystemRoot\System32\Drivers\arf1h6gp.SYS[ataport.SYS!AtaPortCompleteAllActiveRequests] 7500117B
IAT \SystemRoot\System32\Drivers\arf1h6gp.SYS[ataport.SYS!AtaPortReleaseRequestSenseIrb] 127B806A
IAT \SystemRoot\System32\Drivers\arf1h6gp.SYS[ataport.SYS!AtaPortBuildRequestSenseIrb] 80647500
IAT \SystemRoot\System32\Drivers\arf1h6gp.SYS[ataport.SYS!AtaPortReadPortBufferUshort] 7500137B
IAT \SystemRoot\System32\Drivers\arf1h6gp.SYS[ataport.SYS!AtaPortInitialize] 157B805E
IAT \SystemRoot\System32\Drivers\arf1h6gp.SYS[ataport.SYS!AtaPortGetDeviceBase] 56587500
IAT \SystemRoot\System32\Drivers\arf1h6gp.SYS[ataport.SYS!AtaPortDeviceStateChange] 8008758B
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\Windows\Explorer.exe[868] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipAlloc] [747B2494] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[868] @ C:\Windows\Explorer.exe [gdiplus.dll!GdiplusStartup] [74795624] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[868] @ C:\Windows\Explorer.exe [gdiplus.dll!GdiplusShutdown] [747956E2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[868] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipFree] [747B250F] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[868] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipDeleteGraphics] [747A8573] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[868] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipDisposeImage] [747A4D27] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[868] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipGetImageWidth] [747A50CE] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[868] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipGetImageHeight] [747A51A3] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[868] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipCreateBitmapFromHBITMAP] [747A66D0] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[868] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipCreateFromHDC] [747A82CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[868] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipSetCompositingMode] [747A8819] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[868] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipSetInterpolationMode] [747A907A] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[868] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipDrawImageRectI] [747AE21D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.exe[868] @ C:\Windows\Explorer.exe [gdiplus.dll!GdipCloneImage] [747A4C59] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
---- Devices - GMER 1.0.15 ----
Device \FileSystem\Ntfs \Ntfs 857431F8
Device \FileSystem\fastfat \FatCdrom 874EB1F8
Device \Driver\volmgr \Device\VolMgrControl 8573E1F8
Device \Driver\usbohci \Device\USBPDO-0 86A4D1F8
Device \Driver\usbehci \Device\USBPDO-1 86A4E1F8
Device \Driver\ACPI_HAL \Device\00000046 halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)
Device \Driver\NetBT \Device\NetBT_Tcpip_{EE50375E-14DC-4B33-B7C7-D9AF6379614E} 869E91F8
Device \Driver\volmgr \Device\HarddiskVolume1 8573E1F8
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
Device \Driver\volmgr \Device\HarddiskVolume2 8573E1F8
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
Device \Driver\cdrom \Device\CdRom0 869233C8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0 857401F8
Device \Driver\atapi \Device\Ide\IdePort0 857401F8
Device \Driver\atapi \Device\Ide\IdePort1 857401F8
Device \Driver\volmgr \Device\HarddiskVolume3 8573E1F8
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
Device \Driver\cdrom \Device\CdRom1 869233C8
Device \Driver\volmgr \Device\HarddiskVolume4 8573E1F8
AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
Device \Driver\NetBT \Device\NetBt_Wins_Export 869E91F8
Device \Driver\USBSTOR \Device\00000078 869511F8
Device \Driver\USBSTOR \Device\00000079 869511F8
Device \Driver\nvstor \Device\RaidPort0 857411F8
Device \Driver\PCI_PNP6528 \Device\0000004f spnu.sys
Device \Driver\nvstor \Device\RaidPort1 857411F8
Device \Driver\nvstor \Device\0000005e 857411F8
Device \Driver\usbohci \Device\USBFDO-0 86A4D1F8
Device \Driver\usbehci \Device\USBFDO-1 86A4E1F8
Device \Driver\arf1h6gp \Device\Scsi\arf1h6gp1Port4Path0Target0Lun0 86BD81F8
Device \Driver\arf1h6gp \Device\Scsi\arf1h6gp1 86BD81F8
Device \Driver\sptd \Device\2146174528 spnu.sys
Device \FileSystem\fastfat \Fat 874EB1F8
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x95 0x99 0xB8 0x74 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x05 0xBC 0x3B 0x5F ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x12 0xAE 0xDC 0x0D ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x95 0x99 0xB8 0x74 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x05 0xBC 0x3B 0x5F ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x12 0xAE 0xDC 0x0D ...
---- EOF - GMER 1.0.15 ----
|
|
18.01.2011, 19:48
| #8 |
| | svchost.bat? Was ist das? OSAM: Code:
ATTFilter Report of OSAM: Autorun Manager v5.0.11926.0 hxxp://www.online-solutions.ru/en/ Saved at 19:46:39 on 18.01.2011 OS: Windows 7 Home Premium Edition (Build 7600), 32-bit Default Browser: Unable to get information Scanner Settings [x] Rootkits detection (hidden registry) [x] Rootkits detection (hidden files) [x] Retrieve files information [x] Check Microsoft signatures Filters [ ] Trusted entries [ ] Empty entries [x] Hidden registry entries (rootkit activity) [x] Exclusively opened files [x] Not found files [x] Files without detailed information [x] Existing files [ ] Non-startable services [ ] Non-startable drivers [x] Active entries [x] Disabled entries [Control Panel Objects] -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )----- "QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl [Drivers] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "acedrv11" (acedrv11) - "Protect Software GmbH" - C:\Windows\system32\drivers\acedrv11.sys "amodgld4" (amodgld4) - "Microsoft Corporation" - C:\Windows\system32\drivers\amodgld4.sys (Hidden registry entry, rootkit activity | File signed by Microsoft) "atikmdag" (atikmdag) - "ATI Technologies Inc." - C:\Windows\System32\DRIVERS\atikmdag.sys "catchme" (catchme) - ? - C:\Users\Daniel\AppData\Local\Temp\catchme.sys (File not found) "cpuz134" (cpuz134) - "Windows (R) Win 7 DDK provider" - C:\Windows\system32\drivers\cpuz134_x32.sys "GMSIPCI" (GMSIPCI) - ? - X:\INSTALL\GMSIPCI.SYS (File not found) "MagicTune" (MagicTune) - "Samsung Electronics, Inc. " - C:\Windows\system32\drivers\MTiCtwl.sys "sptd" (sptd) - "Duplex Secure Ltd." - C:\Windows\System32\Drivers\sptd.sys (File is exclusively opened, access blocked) "Virtual Machine Monitor" (vmm) - "Microsoft Corporation" - C:\Windows\system32\Drivers\vmm.sys [Explorer] -----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )----- {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - D:\Programme\OpenOffice\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll -----( HKLM\Software\Classes\Protocols\Handler )----- {828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\Program Files\Windows Live\Messenger\msgrapp.dll {828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Messenger\msgrapp.dll {03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )----- {AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? - (File not found | COM-object registry key not found) -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )----- {A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.dll {B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - D:\Programme\iTunes\iTunesMiniPlayer.dll {DC70C4A5-2044-4c59-B806-DEFB9AE0DF7C} "KbLogiExt Class" - "Logitech, Inc." - C:\Program Files\Logitech\SetPointP\kbcplext.dll {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} "NVIDIA CPL Context Menu Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvshext.dll {FFB699E0-306A-11d3-8BD1-00104B6F7516} "NVIDIA CPL Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvcpl.dll {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - D:\Programme\OpenOffice\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll {087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - D:\Programme\OpenOffice\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll {63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - D:\Programme\OpenOffice\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll {3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - D:\Programme\OpenOffice\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll {8932AEFE-9DB6-4f43-AFB2-5682F55E773A} "VPCHostCopyHook" - "Microsoft Corporation" - C:\Program Files\Microsoft Virtual PC\VPCShExH.DLL {0563DB41-F538-4B37-A92D-4659049B7766} "WLMD Message Handler" - ? - (File not found | COM-object registry key not found) Logitech Setpoint Extension "{B9B9F083-2B04-452A-8691-83694AC1037B}" - ? - (File not found | COM-object registry key not found) [Internet Explorer] -----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )----- ITBar7Height "ITBar7Height" - ? - (File not found | COM-object registry key not found) -----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )----- {8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_20.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )----- {18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll {DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll {9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID Sign-in Helper" - "Microsoft Corp." - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [LSA Providers] -----( HKLM\SYSTEM\CurrentControlSet\Control\Lsa )----- "Security Packages" - "Microsoft Corp." - C:\Windows\system32\livessp.dll [Logon] -----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )----- "desktop.ini" - ? - C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini -----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )----- "desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini -----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )----- "RocketDock" - ? - "D:\Programme\RocketDock\RocketDock.exe" (File found, but it contains no detailed information) -----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )----- "StartupPrograms" - ? - rdpclip (File not found) [Services] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "Akamai NetSession Interface" (Akamai) - ? - c:\program files\common files\akamai\netsession_win_dbc0250.dll (File found, but it contains no detailed information) "AMD External Events Utility" (AMD External Events Utility) - "AMD" - C:\Windows\system32\atiesrxx.exe "Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe "Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe "iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe "Logitech Bluetooth Service" (LBTServ) - "Logitech, Inc." - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe "Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe "Net Driver HPZ12" (Net Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZinw12.dll "NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe "NVIDIA Stereoscopic 3D Driver Service" (Stereo Service) - "NVIDIA Corporation" - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe "Pml Driver HPZ12" (Pml Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZipm12.dll "Steam Client Service" (Steam Client Service) - "Valve Corporation" - C:\Program Files\Common Files\Steam\SteamService.exe "Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corp." - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE [Winlogon] -----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )----- "LBTWlgn" - "Logitech, Inc." - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [Winsock Providers] -----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )----- "mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll "WindowsLive Local NSP" - "Microsoft Corp." - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL "WindowsLive NSP" - "Microsoft Corp." - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL ===[ Logfile end ]=========================================[ Logfile end ]=== If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru |
|
18.01.2011, 19:50
| #9 |
| | svchost.bat? Was ist das? MBR Check: Code:
ATTFilter MBRCheck, version 1.2.3
(c) 2010, AD
Command-line:
Windows Version: Windows 7 Home Premium Edition
Windows Information: (build 7600), 32-bit
Base Board Manufacturer: ECS
BIOS Manufacturer: American Megatrends Inc.
System Manufacturer: ECS
System Product Name: GeForce6100PM-M2
Logical Drives Mask: 0x008000bd
Kernel Drivers (total 170):
0x82C0A000 \SystemRoot\system32\ntkrnlpa.exe
0x8301A000 \SystemRoot\system32\halmacpi.dll
0x80BB7000 \SystemRoot\system32\kdcom.dll
0x83226000 \SystemRoot\system32\mcupdate_AuthenticAMD.dll
0x83231000 \SystemRoot\system32\PSHED.dll
0x83242000 \SystemRoot\system32\BOOTVID.dll
0x8324A000 \SystemRoot\system32\CLFS.SYS
0x8328C000 \SystemRoot\system32\CI.dll
0x83337000 \SystemRoot\system32\drivers\Wdf01000.sys
0x833A8000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x8BA0E000 \SystemRoot\System32\Drivers\spxf.sys
0x8BB01000 \SystemRoot\System32\Drivers\WMILIB.SYS
0x8BB0A000 \SystemRoot\System32\Drivers\SCSIPORT.SYS
0x8BB30000 \SystemRoot\system32\DRIVERS\ACPI.sys
0x8BB78000 \SystemRoot\system32\DRIVERS\msisadrv.sys
0x8BB80000 \SystemRoot\system32\DRIVERS\vdrvroot.sys
0x8BB8B000 \SystemRoot\system32\DRIVERS\pci.sys
0x8BBB5000 \SystemRoot\System32\drivers\partmgr.sys
0x8BBC6000 \SystemRoot\system32\DRIVERS\volmgr.sys
0x8BC25000 \SystemRoot\System32\drivers\volmgrx.sys
0x8BC70000 \SystemRoot\system32\DRIVERS\pciide.sys
0x8BC77000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x8BC85000 \SystemRoot\System32\drivers\mountmgr.sys
0x8BC9B000 \SystemRoot\system32\DRIVERS\atapi.sys
0x8BCA4000 \SystemRoot\system32\DRIVERS\ataport.SYS
0x8BCC7000 \SystemRoot\system32\DRIVERS\nvstor.sys
0x8BCEC000 \SystemRoot\system32\DRIVERS\storport.sys
0x8BD33000 \SystemRoot\system32\DRIVERS\amdxata.sys
0x8BD3C000 \SystemRoot\system32\drivers\fltmgr.sys
0x8BD70000 \SystemRoot\system32\drivers\fileinfo.sys
0x8BE3A000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8BF69000 \SystemRoot\System32\Drivers\msrpc.sys
0x8BF94000 \SystemRoot\System32\Drivers\ksecdd.sys
0x8BD81000 \SystemRoot\System32\Drivers\cng.sys
0x8BFA7000 \SystemRoot\System32\drivers\pcw.sys
0x8BFB5000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x8C003000 \SystemRoot\system32\drivers\ndis.sys
0x8C0BA000 \SystemRoot\system32\drivers\NETIO.SYS
0x8C0F8000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x8C23E000 \SystemRoot\System32\drivers\tcpip.sys
0x8C387000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8C3B8000 \SystemRoot\system32\DRIVERS\volsnap.sys
0x8C3F7000 \SystemRoot\System32\Drivers\spldr.sys
0x8C200000 \SystemRoot\System32\drivers\rdyboost.sys
0x8C22D000 \SystemRoot\System32\Drivers\mup.sys
0x8C11D000 \SystemRoot\System32\drivers\hwpolicy.sys
0x8C125000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x8C157000 \SystemRoot\system32\DRIVERS\disk.sys
0x8C168000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x8C1BF000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8C1DE000 \SystemRoot\System32\Drivers\Null.SYS
0x8C1E5000 \SystemRoot\System32\Drivers\Beep.SYS
0x8C1EC000 \SystemRoot\System32\drivers\vga.sys
0x8BFBE000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8BFDF000 \SystemRoot\System32\drivers\watchdog.sys
0x8C1F8000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8BFEC000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8BFF4000 \SystemRoot\system32\drivers\rdprefmp.sys
0x8BE00000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8BE0B000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8BE19000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8BDDE000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x90228000 \SystemRoot\system32\drivers\afd.sys
0x90282000 \SystemRoot\System32\DRIVERS\netbt.sys
0x902B4000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x902BB000 \SystemRoot\system32\DRIVERS\pacer.sys
0x902DA000 \SystemRoot\system32\DRIVERS\netbios.sys
0x902E8000 \SystemRoot\system32\DRIVERS\serial.sys
0x90302000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x90315000 \??\C:\Windows\system32\Drivers\vmm.sys
0x90350000 \SystemRoot\system32\DRIVERS\termdd.sys
0x90360000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x903A1000 \SystemRoot\system32\drivers\nsiproxy.sys
0x903AB000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x903B5000 \SystemRoot\System32\drivers\discache.sys
0x903C1000 \SystemRoot\System32\Drivers\dfsc.sys
0x903D9000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x90200000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x903E7000 \SystemRoot\system32\DRIVERS\amdppm.sys
0x8BE30000 \SystemRoot\system32\DRIVERS\serenum.sys
0x8BDE9000 \SystemRoot\system32\DRIVERS\fdc.sys
0x8BC00000 \SystemRoot\system32\DRIVERS\parport.sys
0x8BC18000 \SystemRoot\system32\DRIVERS\usbohci.sys
0x90E3C000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x90E87000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x90E96000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x90EB5000 \SystemRoot\system32\DRIVERS\nvm62x32.sys
0x90F0A000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x92235000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
0x92CB3000 \SystemRoot\system32\DRIVERS\nvBridge.kmd
0x92CB5000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x92D6C000 \SystemRoot\System32\drivers\dxgmms1.sys
0x92DA5000 \SystemRoot\System32\Drivers\amodgld4.SYS
0x92DDE000 \SystemRoot\system32\DRIVERS\VMNetSrv.sys
0x92DEF000 \SystemRoot\system32\DRIVERS\CompositeBus.sys
0x92200000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x92212000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x9222A000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x90F10000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x90F32000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x90F4A000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x90F61000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x90F78000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x90F85000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x92DFC000 \SystemRoot\system32\DRIVERS\swenum.sys
0x90F92000 \SystemRoot\system32\DRIVERS\ks.sys
0x90FC6000 \SystemRoot\system32\DRIVERS\umbus.sys
0x90FD4000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0x833B6000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x90FDE000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x96809000 \SystemRoot\system32\drivers\HdAudio.sys
0x96859000 \SystemRoot\system32\drivers\portcls.sys
0x96888000 \SystemRoot\system32\drivers\drmk.sys
0x968A1000 \SystemRoot\System32\Drivers\crashdmp.sys
0x968AE000 \SystemRoot\System32\Drivers\dump_dumpata.sys
0x968B9000 \SystemRoot\System32\Drivers\dump_atapi.sys
0x968C2000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x968D3000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x968EA000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x968EC000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x968F7000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x9690A000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x97A00000 \SystemRoot\System32\win32k.sys
0x96911000 \SystemRoot\System32\drivers\Dxapi.sys
0x9691B000 \SystemRoot\system32\DRIVERS\LHidFilt.Sys
0x96923000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x9692F000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x9693A000 \SystemRoot\system32\DRIVERS\LMouFilt.Sys
0x96942000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0x96959000 \SystemRoot\System32\Drivers\fastfat.SYS
0x96983000 \SystemRoot\system32\DRIVERS\monitor.sys
0x97C60000 \SystemRoot\System32\TSDDD.dll
0x9698E000 \SystemRoot\system32\drivers\usbaudio.sys
0x97C90000 \SystemRoot\System32\cdd.dll
0x97CB0000 \SystemRoot\System32\ATMFD.DLL
0x969A2000 \SystemRoot\system32\drivers\luafv.sys
0x969BD000 \SystemRoot\system32\drivers\WudfPf.sys
0x969D7000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x969E7000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x98E12000 \SystemRoot\system32\drivers\HTTP.sys
0x98E97000 \SystemRoot\system32\DRIVERS\bowser.sys
0x98EB0000 \SystemRoot\System32\drivers\mpsdrv.sys
0x98EC2000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x98EE5000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x98F20000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x98F3B000 \SystemRoot\system32\DRIVERS\parvdm.sys
0x98F42000 \??\C:\Windows\system32\drivers\acedrv11.sys
0x98F6E000 \??\C:\Windows\system32\drivers\cpuz134_x32.sys
0x9EE37000 \SystemRoot\system32\drivers\peauth.sys
0x9EECE000 \SystemRoot\System32\Drivers\secdrv.SYS
0x9EED8000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x9EEF9000 \SystemRoot\System32\drivers\tcpipreg.sys
0x9EF06000 \SystemRoot\System32\DRIVERS\srv2.sys
0x9EF55000 \SystemRoot\System32\DRIVERS\srv.sys
0x98F72000
0x9EFA6000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0x76FC0000 \Windows\System32\ntdll.dll
0x48190000 \Windows\System32\smss.exe
0x77200000 \Windows\System32\apisetschema.dll
0x00DA0000 \Windows\System32\autochk.exe
0x10000000 \Program Files\DAEMON Tools Lite\Engine.dll
0x771E0000 \Windows\System32\nsi.dll
0x77180000 \Windows\System32\difxapi.dll
0x76370000 \Windows\System32\shell32.dll
0x77150000 \Windows\System32\imagehlp.dll
0x762D0000 \Windows\System32\usp10.dll
0x77140000 \Windows\System32\lpk.dll
0x77120000 \Windows\System32\sechost.dll
0x76290000 \Windows\System32\ws2_32.dll
0x76200000 \Windows\System32\clbcatq.dll
Processes (total 54):
0 System Idle Process
4 System
272 C:\Windows\System32\smss.exe
368 csrss.exe
420 C:\Windows\System32\wininit.exe
436 csrss.exe
508 C:\Windows\System32\services.exe
516 C:\Windows\System32\winlogon.exe
544 C:\Windows\System32\lsass.exe
556 C:\Windows\System32\lsm.exe
656 C:\Windows\System32\svchost.exe
720 C:\Windows\System32\nvvsvc.exe
760 C:\Windows\System32\svchost.exe
812 C:\Windows\System32\atiesrxx.exe
892 C:\Windows\System32\svchost.exe
924 C:\Windows\System32\svchost.exe
952 C:\Windows\System32\svchost.exe
1040 C:\Windows\System32\audiodg.exe
1116 C:\Windows\System32\svchost.exe
1208 C:\Windows\System32\atieclxx.exe
1224 C:\Windows\System32\nvvsvc.exe
1312 C:\Windows\System32\svchost.exe
1464 C:\Windows\System32\spoolsv.exe
1504 C:\Windows\System32\svchost.exe
1576 C:\Windows\System32\svchost.exe
1600 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1664 C:\Program Files\Bonjour\mDNSResponder.exe
1704 C:\Windows\System32\svchost.exe
1736 C:\Windows\System32\svchost.exe
1812 C:\Windows\System32\svchost.exe
1844 C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
1976 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
604 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
2176 C:\Windows\System32\svchost.exe
2772 C:\Windows\System32\svchost.exe
2812 C:\Program Files\Windows Media Player\wmpnetwk.exe
2976 C:\Windows\System32\SearchIndexer.exe
2984 WmiPrvSE.exe
3424 C:\Windows\System32\dwm.exe
3500 C:\Windows\explorer.exe
3516 C:\Windows\System32\taskhost.exe
3628 D:\Programme\RocketDock\RocketDock.exe
2392 C:\Windows\System32\svchost.exe
768 D:\Programme\Mozilla Firefox\firefox.exe
2376 dllhost.exe
1908 C:\Windows\servicing\TrustedInstaller.exe
2480 C:\Windows\System32\wuauclt.exe
1048 C:\Users\Daniel\Desktop\osam\osam.exe
2256 C:\Windows\System32\SearchProtocolHost.exe
3620 C:\Windows\System32\SearchFilterHost.exe
3204 C:\Windows\explorer.exe
1644 C:\Users\Daniel\Desktop\MBRCheck.exe
2036 C:\Windows\System32\conhost.exe
1304 C:\Windows\System32\dllhost.exe
\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`06500000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x0000000c`80100000 (NTFS)
\\.\E: --> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (FAT32)
\\.\H: --> \\.\PhysicalDrive0 at offset 0x00000000`00100000 (NTFS)
PhysicalDrive0 Model Number: WDCWD1600AAJB-00J3A0, Rev: 01.03E01
PhysicalDrive1 Model Number: SamsungSTORY Station P, Rev:
Size Device Name MBR Status
--------------------------------------------
149 GB \\.\PhysicalDrive0 Windows 7 MBR code detected
SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79
931 GB \\.\PhysicalDrive1 RE: Unknown MBR code
SHA1: 639AC5CDF8A5CF3245975932C6A4215450A7B98F
Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:
|
|
18.01.2011, 20:18
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | svchost.bat? Was ist das? Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs. Denk dran beide Tools zu updaten vor dem Scan!!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
18.01.2011, 20:29
| #11 |
| | svchost.bat? Was ist das? Beide Scans laufen gerade. Übrigens möchte ich mich an dieser Stelle schon mal für die Mühe bedanken, trotz meines Crosspostings.^^ |
|
18.01.2011, 21:05
| #12 |
| | svchost.bat? Was ist das?Code:
ATTFilter Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Datenbank Version: 5549
Windows 6.1.7600
Internet Explorer 8.0.7600.16385
18.01.2011 21:04:35
mbam-log-2011-01-18 (21-04-35).txt
Art des Suchlaufs: Vollständiger Suchlauf (A:\|C:\|D:\|E:\|F:\|H:\|X:\|)
Durchsuchte Objekte: 253065
Laufzeit: 40 Minute(n), 52 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
|
|
18.01.2011, 23:26
| #13 |
| | svchost.bat? Was ist das? Also alles in Ordnung jetzt? |
|
18.01.2011, 23:32
| #14 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | svchost.bat? Was ist das? Du hast ein Log vergessen 
__________________ Logfiles bitte immer in CODE-Tags posten |
|
18.01.2011, 23:33
| #15 |
| | svchost.bat? Was ist das? Welchen? :S |
|
| Themen zu svchost.bat? Was ist das? |
| ausgeführt, datei, frage, heute, link, manager, mehrfach, nichts, norton, norton 360, nützliches, start, svchost.bat, total, troja, trojaner, wirklich, woche |
Hybrid-Darstellung
