Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Malware gefunden, acroFF.dll (https://www.trojaner-board.de/105428-malware-gefunden-acroff-dll.html)

markusg 26.11.2011 16:37

ok
bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Maximal 26.11.2011 16:43

Vielen Dank.
Ich werde das heute Abend fortsetzen!

Maximal 26.11.2011 22:01

So..Hatte da einige Probleme.
Das Programm hat korrekt gearbeitet und auch eine Log-Datei erstellt.
Jedoch konnte ich nach dem vorgang nichts mehr öffnen; Internet weder Antivir oder anderes. Hab eine Systemwiederherstellung gemacht da gings dann wieder und die Logdatei war noch da:
Combofix Logfile:
Code:

ComboFix 11-11-26.04 - Admin 26.11.2011  21:47:32.2.4 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.4077.2583 [GMT 1:00]
ausgeführt von:: c:\users\Admin\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-10-26 bis 2011-11-26  ))))))))))))))))))))))))))))))
.
.
2011-11-26 20:50 . 2011-11-26 20:50        --------        d-----w-        c:\users\Default\AppData\Local\temp
2011-11-26 14:43 . 2011-11-26 14:54        --------        d-----w-        C:\_OTL
2011-11-25 17:52 . 2011-11-25 17:52        --------        d-----w-        c:\users\Admin\AppData\Roaming\Malwarebytes
2011-11-25 17:52 . 2011-11-25 17:52        --------        d-----w-        c:\programdata\Malwarebytes
2011-11-25 17:52 . 2011-08-31 16:00        25416        ----a-w-        c:\windows\system32\drivers\mbam.sys
2011-11-25 06:00 . 2011-10-07 04:16        8570192        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{DE4C8AA0-8DA7-469F-B61B-A3F72844FD7E}\mpengine.dll
2011-11-24 18:03 . 2011-11-25 11:57        --------        d-----w-        c:\users\Admin\AppData\Roaming\UAs
2011-11-21 16:51 . 2011-11-21 16:51        2300696        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2011-11-21 16:51 . 2011-11-21 16:51        42776        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2011-11-21 16:51 . 2011-11-21 16:51        1092400        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-11-14 05:55 . 2011-11-14 05:55        --------        d-----w-        c:\windows\system32\Macromed
2011-11-11 21:29 . 2007-04-04 17:55        403304        ----a-w-        c:\windows\system32\xactengine2_7.dll
2011-11-11 16:06 . 2011-11-11 16:06        --------        d-----we        C:\Programme
2011-11-11 13:12 . 2011-11-14 11:48        --------        d-----w-        c:\program files (x86)\Common Files\Steam
2011-11-11 13:12 . 2011-11-26 20:46        --------        d-----w-        c:\program files (x86)\Steam
2011-11-09 15:19 . 2011-10-01 05:45        886784        ----a-w-        c:\program files\Common Files\System\wab32.dll
2011-11-09 15:19 . 2011-10-01 04:37        708608        ----a-w-        c:\program files (x86)\Common Files\System\wab32.dll
2011-11-09 15:19 . 2011-09-29 16:29        1923952        ----a-w-        c:\windows\system32\drivers\tcpip.sys
2011-11-09 15:19 . 2011-09-29 04:03        3144704        ----a-w-        c:\windows\system32\win32k.sys
2011-11-07 17:09 . 2011-11-07 17:09        --------        d-----w-        c:\program files (x86)\SystemRequirementsLab
2011-11-07 17:09 . 2011-11-07 17:09        --------        d-----w-        c:\users\Admin\SystemRequirementsLab
2011-11-06 18:19 . 2011-11-12 15:28        280904        ----a-w-        c:\windows\SysWow64\PnkBstrB.xtr
2011-11-06 18:16 . 2011-11-06 18:16        --------        d-----w-        c:\users\Admin\AppData\Local\PunkBuster
2011-10-28 21:36 . 2011-10-28 21:36        --------        d-----w-        c:\programdata\DriverBoost
2011-10-28 20:35 . 2011-10-28 20:35        --------        d-----w-        c:\users\UpdatusUser
2011-10-28 17:23 . 2011-11-07 06:06        --------        d-----w-        c:\program files (x86)\Battlelog Web Plugins
2011-10-28 17:20 . 2011-10-28 17:20        --------        d-----w-        c:\program files (x86)\SmartTools
2011-10-28 17:18 . 2011-10-28 17:18        --------        d-----w-        c:\programdata\EA Core
2011-10-28 12:57 . 2011-10-28 12:57        --------        d-----w-        c:\users\Admin\AppData\Roaming\TuneUp Software
2011-10-28 12:57 . 2011-10-28 15:27        --------        d-----w-        c:\programdata\TuneUp Software
2011-10-28 12:57 . 2011-10-28 12:57        --------        d-sh--w-        c:\programdata\{32364CEA-7855-4A3C-B674-53D8E9B97936}
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-21 06:05 . 2011-06-03 18:30        414368        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-11-12 15:28 . 2011-06-25 17:43        280904        ----a-w-        c:\windows\SysWow64\PnkBstrB.exe
2011-11-12 15:20 . 2011-06-25 17:43        280904        ----a-w-        c:\windows\SysWow64\PnkBstrB.ex0
2011-10-28 11:58 . 2011-06-25 17:43        75136        ----a-w-        c:\windows\SysWow64\PnkBstrA.exe
2011-10-15 08:53 . 2011-05-18 22:10        8791360        ----a-w-        c:\windows\system32\nvwgf2umx.dll
2011-10-15 08:53 . 2011-05-18 22:10        2808128        ----a-w-        c:\windows\system32\nvapi64.dll
2011-10-15 08:53 . 2011-04-07 21:19        3074368        ----a-w-        c:\windows\system32\nvsvcr.dll
2011-10-15 08:53 . 2011-04-07 21:19        222528        ----a-w-        c:\windows\system32\nvmctray.dll
2011-10-15 08:53 . 2011-04-07 21:19        1640768        ----a-w-        c:\windows\system32\nvvsvc.exe
2011-10-15 08:53 . 2011-04-07 21:19        137536        ----a-w-        c:\windows\system32\nvshext.dll
2011-10-15 08:53 . 2011-04-07 21:19        837952        ----a-w-        c:\windows\system32\easyUpdatusAPIU64.dll
2011-10-15 08:53 . 2011-04-07 21:19        10406208        ----a-w-        c:\windows\system32\nvcpl.dll
2011-10-15 08:53 . 2011-04-07 21:18        5067584        ----a-w-        c:\windows\system32\nvsvc64.dll
2011-10-14 23:54 . 2011-10-14 23:54        321856        ----a-w-        c:\windows\SysWow64\nvStreaming.exe
2011-10-10 14:42 . 2011-06-25 17:43        2580552        ----a-w-        c:\windows\SysWow64\pbsvc.exe
2011-10-01 03:25 . 2011-10-12 06:51        1638912        ----a-w-        c:\windows\system32\mshtml.tlb
2011-10-01 02:42 . 2011-10-12 06:51        1638912        ----a-w-        c:\windows\SysWow64\mshtml.tlb
2011-09-13 15:55 . 2011-09-13 15:55        472808        ----a-w-        c:\windows\SysWow64\deployJava1.dll
.
.
(((((((((((((((((((((((((((((  SnapShot@2011-11-26_20.37.19  )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-05-18 22:14 . 2011-11-26 20:48        34828              c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
- 2009-07-14 05:10 . 2011-11-26 20:06        27200              c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-11-26 20:48        27200              c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2011-05-18 22:11 . 2011-11-26 20:48        9170              c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3611147833-1045768289-4282168533-1000_UserData.bin
+ 2011-11-26 20:51 . 2011-11-26 20:51        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-11-26 20:36 . 2011-11-26 20:36        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-11-26 20:36 . 2011-11-26 20:36        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-11-26 20:51 . 2011-11-26 20:51        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-07-14 02:36 . 2011-11-26 20:10        615760              c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2011-11-26 20:41        615760              c:\windows\system32\perfh009.dat
+ 2009-07-14 17:58 . 2011-11-26 20:41        654096              c:\windows\system32\perfh007.dat
- 2009-07-14 17:58 . 2011-11-26 20:10        654096              c:\windows\system32\perfh007.dat
+ 2009-07-14 02:36 . 2011-11-26 20:41        107396              c:\windows\system32\perfc009.dat
- 2009-07-14 02:36 . 2011-11-26 20:10        107396              c:\windows\system32\perfc009.dat
- 2009-07-14 17:58 . 2011-11-26 20:10        130952              c:\windows\system32\perfc007.dat
+ 2009-07-14 17:58 . 2011-11-26 20:41        130952              c:\windows\system32\perfc007.dat
- 2009-07-14 05:01 . 2011-11-26 20:36        225076              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2011-11-26 20:50        225076              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-06-04 17:47 . 2011-11-26 20:50        4648240              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3611147833-1045768289-4282168533-1000-8192.dat
- 2011-06-04 17:47 . 2011-11-26 20:36        4648240              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3611147833-1045768289-4282168533-1000-8192.dat
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-06-03 39408]
"Facebook Update"="c:\users\Admin\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2011-09-02 137536]
"Steam"="c:\program files (x86)\Steam\Steam.exe" [2011-11-11 1242448]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"D-Link D-Link Wireless N DWA-140"="c:\program files (x86)\D-Link\DWA-140 revB\AirNCFG.exe" [2010-06-30 1024000]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-03-28 281768]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
.
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-03 136176]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-10-15 2253120]
R3 athrusb;Atheros Wireless LAN USB device driver;c:\windows\system32\DRIVERS\athrxusb.sys [x]
R3 GPU-Z;GPU-Z;c:\users\Admin\AppData\Local\Temp\GPU-Z.sys [x]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-03 136176]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S1 anodlwf;ANOD Network Security Filter driver;c:\windows\system32\DRIVERS\anodlwfx.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-03-28 136360]
S2 D-Link Wireless N DWA-140_WPS;D-Link Wireless N DWA-140_WPS Service;c:\program files (x86)\D-Link\DWA-140 revB\ANIWConnService.exe [2010-06-03 53248]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-10-14 381248]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys [x]
S3 netr28ux;D-Link dnetr28u USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\Dnetr28ux.sys [x]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2011-11-25 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3611147833-1045768289-4282168533-1000Core.job
- c:\users\Admin\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-09-02 16:11]
.
2011-11-26 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3611147833-1045768289-4282168533-1000UA.job
- c:\users\Admin\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-09-02 16:11]
.
2011-11-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-03 18:30]
.
2011-11-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-03 18:30]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-11-19 11613288]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2269050
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
IE: Translate this web page with Babylon - c:\program files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm
IE: Translate with Babylon - c:\program files (x86)\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\f5hy3nxa.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/?ref=hp
FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?babsrc=toolbar2&q=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10r_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10r_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10r.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10r.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10r.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10r.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\windows\SysWOW64\PnkBstrA.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-11-26  21:53:28 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2011-11-26 20:53
ComboFix2.txt  2011-11-26 20:39
.
Vor Suchlauf: 14 Verzeichnis(se), 68.447.432.704 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 68.822.372.352 Bytes frei
.
- - End Of File - - E72A7C4356BCE553E2E4D8D843483F05

--- --- ---

markusg 27.11.2011 11:37

lade den CCleaner standard:
CCleaner Download - CCleaner 3.12.1572
falls der CCleaner
bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

Maximal 28.11.2011 17:29

Adobe Flash Player 10 ActiveX Adobe Systems Incorporated 02.06.2011 6,00MB 10.3.181.16 nötig
Adobe Flash Player 11 Plugin 64-bit Adobe Systems Incorporated 20.11.2011 6,00MB 11.1.102.55 nötig
Asmedia ASM104x USB 3.0 Host Controller Driver Asmedia Technology 18.05.2011 2,12MB 1.4.5.0 nötig
Avira AntiVir Personal - Free Antivirus Avira GmbH 16.10.2011 70,6MB 10.2.0.704 nötig
Battlefield 3™ Electronic Arts 25.10.2011 1.0.0.0 unnötig
Battlelog Web Plugins EA Digital Illusions CE AB 05.11.2011 1.102.0 unnötig
CCleaner Piriform 27.11.2011 3.12 unnötig (cccleaner)
Compatibility Pack für 2007 Office System Microsoft Corporation 16.11.2011 121,6MB 12.0.6514.5001 nötig
Crysis(R) Electronic Arts 24.06.2011 6.558MB 1.00.0000 unnötig
D-Link DWA-140 D-Link 02.06.2011 nötig
Die Schlacht um Mittelerde™ II 07.07.2011 unnötig
DivX-Setup DivX, LLC 05.06.2011 2.5.0.11 unnötig
ESN Sonar ESN Social Software AB 05.11.2011 0.70.4 unbekannt
Facebook Video Calling 1.0.0.8953 Skype Limited 14.11.2011 3,93MB 1.0.8953 unnötig
Free YouTube to MP3 Converter version 3.10.815 DVDVideoSoft Ltd.. 16.08.2011 45,3MB unnötig
Google Chrome Google Inc. 05.06.2011 15.0.874.121 unnötig
Google Toolbar for Internet Explorer Google Inc. 24.11.2011 7.2.2308.2056 unnötig
Java(TM) 6 Update 27 Oracle 12.09.2011 95,0MB 6.0.270 nötig
Microsoft .NET Framework 1.1 Microsoft 24.06.2011 34,8MB 1.1.4322 nötig
Microsoft Office Word Viewer 2003 Microsoft Corporation 07.06.2011 28,2MB 11.0.8173.0 nötig
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 02.09.2011 0,34MB 8.0.59193 nötig
Microsoft Visual C++ 2005 Redistributable (x64) Microsoft Corporation 24.06.2011 0,69MB 8.0.56336 nötig
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 Microsoft Corporation 27.10.2011 0,77MB 9.0.30729 nötig
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 25.10.2011 0,23MB 9.0.30729 nötig
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 02.06.2011 0,58MB 9.0.30729.4148 nötig
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 Microsoft Corporation 25.10.2011 13,8MB 10.0.40219 nötig
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Corporation 25.10.2011 11,1MB 10.0.40219 nötig
Mozilla Firefox 8.0 (x86 de) Mozilla 10.11.2011 36,5MB 8.0 nötig
NVIDIA 3D Vision Controller-Treiber 285.62 NVIDIA Corporation 27.10.2011 285.62 nötig
NVIDIA 3D Vision Treiber 285.62 NVIDIA Corporation 06.11.2011 285.62 nötig
NVIDIA Grafiktreiber 285.62 NVIDIA Corporation 06.11.2011 285.62 nötig
NVIDIA HD-Audiotreiber 1.2.24.0 NVIDIA Corporation 27.10.2011 1.2.24.0 nötig
NVIDIA PhysX-Systemsoftware 9.11.0621 NVIDIA Corporation 27.10.2011 9.11.0621 nötig
NVIDIA Update 1.5.20 NVIDIA Corporation 27.10.2011 1.5.20 nötig
Origin Electronic Arts, Inc. 11.11.2011 8.3.7.3619 unnötig
Realtek Ethernet Controller Driver Realtek 18.05.2011 7.37.1229.2010 nötig
Realtek High Definition Audio Driver Realtek Semiconductor Corp. 18.05.2011 6.0.1.6251 nötig
Skype Click to Call Skype Technologies S.A. 17.11.2011 14,4MB 5.6.8442 nötig
Skype™ 5.5 Skype Technologies S.A. 17.11.2011 17,0MB 5.5.124 nötig
SmartTools Office DDE-Fix SmartTools Publishing 27.10.2011 v1.20 nötig
Steam Valve Corporation 10.11.2011 35,5MB 1.0.0.0 nötig
System Requirements Lab CYRI Husdawg, LLC 06.11.2011 0,45MB 4.4.26.0 unbekannt
The Elder Scrolls V: Skyrim Bethesda Game Studios 10.11.2011 nötig
Unity Web Player Unity Technologies ApS 23.10.2011 12,0MB unbekannt
WinRAR 4.01 (32-Bit) win.rar GmbH 03.09.2011 4.01.0 nötig

Maximal 28.11.2011 17:32

Hey,
habe gerade etwas gefunden was sich beim start meines Computers automatisch ausführt:
swg.dll
Habe das gegoogled und da steht, dass sich diese Datei oft als Prozess tarnt jedoch ein Virus sein könnte.
Vielleicht hilft dir das bei der analyse.

markusg 28.11.2011 17:36

edit..........

markusg 28.11.2011 17:38

nein mir hilft das logfile von hitman pro bei der analyse, testlizenz aktivieren, scannen, log file posten.

Maximal 28.11.2011 17:44

Alles Klar .. Scan läuft Logfile hast du dann gleich.

Maximal 28.11.2011 17:52

- <Log computer="ADMIN-PC" scan="Normal" version="3.5.9.131" date="2011-11-28T17:47:11" timeSpentInSecs="78" filesProcessed="15619">
- <Item type="Malware" malwareName="Trojan" score="108.0" status="Deleted">
- <Scanners>
<Scanner id="Ikarus" name="Trojan-PWS.Agent!IK" />
</Scanners>
<File path="C:\Users\Admin\AcroFF0505.dll" hash="0B9EE9463D0FEF744AFA4877C2F8473A60F6C718D13EE90D81746B4E5534B504" />
</Item>
- <Item type="Malware" malwareName="Trojan" score="108.0" status="Deleted">
- <Scanners>
<Scanner id="Ikarus" name="Trojan-PWS.Agent!IK" />
</Scanners>
<File path="C:\Users\Admin\AcroFF0508.dll" hash="CD0EAAD2AD0603B0CFB466977B31B1A356BFABFAF68A048E87A0A99AD1F4379F" />
</Item>
- <Item type="Repair" score="0.0" status="Deleted">
<File path="C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:doubleclick.net" />
</Item>
- <Item type="Repair" score="0.0" status="Deleted">
<File path="C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:serving-sys.com" />
</Item>
- <Item type="Repair" score="0.0" status="Deleted">
<File path="C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:yadro.ru" />
</Item>
- <Item type="Repair" score="0.0" status="Deleted">
<File path="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@ad.adc-serv[1].txt" />
</Item>
- <Item type="Repair" score="0.0" status="Deleted">
<File path="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@ad.adserver01[2].txt" />
</Item>
- <Item type="Repair" score="0.0" status="Deleted">
<File path="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@ad.yieldmanager[1].txt" />
</Item>
- <Item type="Repair" score="0.0" status="Deleted">
<File path="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@ads.creative-serving[2].txt" />
</Item>
- <Item type="Repair" score="0.0" status="Deleted">
<File path="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@apmebf[2].txt" />
</Item>
- <Item type="Repair" score="0.0" status="Deleted">
<File path="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@bs.serving-sys[2].txt" />
</Item>
- <Item type="Repair" score="0.0" status="Deleted">
<File path="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@casalemedia[2].txt" />
</Item>
- <Item type="Repair" score="0.0" status="Deleted">
<File path="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@content.yieldmanager[2].txt" />
</Item>
- <Item type="Repair" score="0.0" status="Deleted">
<File path="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@content.yieldmanager[3].txt" />
</Item>
- <Item type="Repair" score="0.0" status="Deleted">
<File path="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@doubleclick[3].txt" />
</Item>
- <Item type="Repair" score="0.0" status="Deleted">
<File path="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@microsoftinternetexplorer.112.2o7[1].txt" />
</Item>
- <Item type="Repair" score="0.0" status="Deleted">
<File path="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@serving-sys[2].txt" />
</Item>
- <Item type="Repair" score="0.0" status="Deleted">
<File path="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@smartadserver[2].txt" />
</Item>
- <Item type="Repair" score="0.0" status="Deleted">
<File path="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@tradedoubler[3].txt" />
</Item>
- <Item type="Repair" score="0.0" status="Deleted">
<File path="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\EDTZSOXV.txt" />
</Item>
- <Item type="Repair" score="0.0" status="Deleted">
<File path="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\G24QZPEY.txt" />
</Item>
- <Item type="Suspicious" score="46.0" status="None">
<File path="C:\Users\Admin\Desktop\COD 6\# Crack\iw4mp.exe" hash="D75C29300F96ADF3C775DFA674D59869CB96F423912488B71733FD79563EE520" />
</Item>
- <Item type="Suspicious" score="46.0" status="None">
<File path="C:\Users\Admin\Desktop\COD 6\# Crack\iw4sp.exe" hash="5C5CE00841BCAC1A25EB47A31CB87434AC386B34234BF559003161B6E156D477" />
</Item>
- <Item type="Suspicious" score="50.0" status="None">
<File path="C:\users\admin\desktop\cod 6\reininstalliert\modern warfare 2\iw4mp.dat" hash="0FF05E5682CB0B67505523DDBC6896BF819350D486DC5E0F5052A84618753C5B" />
- <References>
<Key path="HKU\S-1-5-21-3611147833-1045768289-4282168533-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\users\admin\desktop\cod 6\reininstalliert\modern warfare 2\iw4mp.dat" />
</References>
</Item>
- <Item type="Suspicious" score="46.0" status="None">
<File path="C:\users\admin\desktop\cod 6\reininstalliert\modern warfare 2\iw4sp.exe" hash="5C5CE00841BCAC1A25EB47A31CB87434AC386B34234BF559003161B6E156D477" />
- <References>
<Key path="HKU\S-1-5-21-3611147833-1045768289-4282168533-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\users\admin\desktop\cod 6\reininstalliert\modern warfare 2\iw4sp.exe" />
</References>
</Item>
- <Item type="Suspicious" score="46.0" status="None">
<File path="E:\spiele\cod 7\call of duty black ops-skidrow\call of duty - black ops installl\blackopsmp.exe" hash="6FCF50EE5492527A8B83C97B05BBF6DD0FB4CA64622483D427716EF9746BC876" />
- <References>
<Key path="HKU\S-1-5-21-3611147833-1045768289-4282168533-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\E:\spiele\cod 7\call of duty black ops-skidrow\call of duty - black ops installl\blackopsmp.exe" />
</References>
</Item>
</Log>

markusg 28.11.2011 18:17

ich sehe cracks keygens.
diese sind illegal.
illegale software unterstützen wir nicht, da gibts nur hilfe beim formatieren und neu aufsetzen und absichern des pcs

Maximal 28.11.2011 18:35

Was heißt das jetzt für mich?
Ich werde diese Cracks auch gerne löschen, ich habe sie nicht selbst generiert o.ä.
Ich will nur nicht meine ganze Festplatte formatieren -.- :heulen:

markusg 28.11.2011 18:38

wie gesagt, das ist das einzige wobei ich dir helfen werde, und auch alle helfer in diesem forum.
keygens etc unterstützen wir hier nicht, sie sind illegal und verursachen häufig malware probleme, da wir illegale software nicht unterstützen ist formatiren und dann absichern des pcs angesagt


Alle Zeitangaben in WEZ +1. Es ist jetzt 19:04 Uhr.

Copyright ©2000-2024, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130