Trojaner-Board - AKM Virus

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - AKM Virus (https://www.trojaner-board.de/114681-akm-virus.html)

Und hier das CF Log:

[code]
Combofix Logfile:

Code:

ComboFix 12-05-14.03 - admin 14.05.2012  19:40:56.1.4 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.43.1031.18.4095.2442 [GMT 2:00]

ausgeführt von:: c:\users\admin\Desktop\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\Install.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-04-14 bis 2012-05-14  ))))))))))))))))))))))))))))))

.

.

2012-05-14 11:57 . 2012-05-14 11:57        --------        d-----w-        C:\_OTL

2012-05-11 14:39 . 2012-03-03 06:35        1544704        ----a-w-        c:\windows\system32\DWrite.dll

2012-05-11 14:39 . 2012-03-03 05:31        1077248        ----a-w-        c:\windows\SysWow64\DWrite.dll

2012-05-11 14:39 . 2012-03-31 06:05        5559664        ----a-w-        c:\windows\system32\ntoskrnl.exe

2012-05-11 14:39 . 2012-03-31 04:39        3968368        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe

2012-05-11 14:39 . 2012-03-31 04:39        3913072        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe

2012-05-11 14:39 . 2012-03-31 03:10        3146240        ----a-w-        c:\windows\system32\win32k.sys

2012-05-11 14:38 . 2012-03-17 07:58        75120        ----a-w-        c:\windows\system32\drivers\partmgr.sys

2012-05-11 14:38 . 2012-03-30 11:35        1918320        ----a-w-        c:\windows\system32\drivers\tcpip.sys

2012-05-11 14:38 . 2012-03-31 05:42        1732096        ----a-w-        c:\program files\Windows Journal\NBDoc.DLL

2012-05-11 14:38 . 2012-03-31 05:40        1402880        ----a-w-        c:\program files\Windows Journal\JNWDRV.dll

2012-05-11 14:38 . 2012-03-31 05:40        1367552        ----a-w-        c:\program files\Common Files\Microsoft Shared\ink\journal.dll

2012-05-11 14:38 . 2012-03-31 05:40        1393664        ----a-w-        c:\program files\Windows Journal\JNTFiltr.dll

2012-05-11 14:38 . 2012-03-31 04:29        936960        ----a-w-        c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll

2012-05-03 14:13 . 2012-05-03 14:13        --------        d-----w-        c:\programdata\Malwarebytes

2012-05-03 14:13 . 2012-05-03 14:13        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware

2012-05-03 14:13 . 2012-04-04 13:56        24904        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-05-03 12:20 . 2012-05-03 12:20        --------        d-----w-        c:\program files (x86)\ESET

2012-05-03 12:03 . 2012-05-14 20:42        --------        d-----w-        c:\users\admin

2012-05-03 10:14 . 2012-05-03 10:15        --------        d-----w-        c:\users\Gast

2012-04-26 16:36 . 2012-04-26 16:36        --------        d-----w-        c:\program files (x86)\Dnote Software

2012-04-25 19:49 . 2012-04-25 19:49        --------        d-----w-        c:\program files (x86)\MyTomTom 3

2012-04-25 18:01 . 2012-04-25 19:49        --------        d-----w-        c:\users\Papa\AppData\Local\TomTom

2012-04-25 18:01 . 2012-04-25 18:01        --------        d-----w-        c:\users\Papa\AppData\Roaming\TomTom

2012-04-25 18:01 . 2012-04-25 19:49        --------        d-----w-        c:\program files (x86)\TomTom International B.V

2012-04-25 18:01 . 2012-04-25 18:01        --------        d-----w-        c:\program files (x86)\TomTom HOME 2

2012-04-22 14:39 . 2012-04-30 17:20        --------        d-----w-        c:\users\Daniel\AppData\Roaming\.minecraft

2012-04-20 20:49 . 2012-04-20 20:49        --------        d-----w-        c:\windows\de

2012-04-20 20:45 . 2012-04-20 20:45        --------        d-----w-        c:\windows\da

2012-04-20 20:45 . 2012-04-20 20:45        --------        d-----w-        c:\windows\el

2012-04-20 20:45 . 2012-04-20 20:45        --------        d-----w-        c:\windows\en

2012-04-20 20:45 . 2012-04-20 20:45        --------        d-----w-        c:\windows\es

2012-04-20 20:45 . 2012-04-20 20:45        --------        d-----w-        c:\windows\fr

2012-04-20 20:44 . 2012-04-20 20:44        --------        d-----w-        c:\windows\hu

2012-04-20 20:44 . 2012-04-20 20:44        --------        d-----w-        c:\windows\it

2012-04-20 20:44 . 2012-04-20 20:44        --------        d-----w-        c:\windows\nl

2012-04-20 20:44 . 2012-04-20 20:44        --------        d-----w-        c:\windows\pl

2012-04-20 20:44 . 2012-04-20 20:44        --------        d-----w-        c:\windows\sl

2012-04-20 20:44 . 2012-04-20 20:44        --------        d-----w-        c:\windows\tr

2012-04-20 20:35 . 2012-03-08 16:40        48488        ----a-w-        c:\windows\system32\drivers\fssfltr.sys

2012-04-20 20:32 . 2012-04-20 20:32        15712        ----a-w-        c:\program files (x86)\Common Files\Windows Live\.cache\bb09d7571cd1f3402\MeshBetaRemover.exe

2012-04-20 20:32 . 2012-04-20 20:32        89944        ----a-w-        c:\program files (x86)\Common Files\Windows Live\.cache\ba6a5b251cd1f3401\DSETUP.dll

2012-04-20 20:32 . 2012-04-20 20:32        537432        ----a-w-        c:\program files (x86)\Common Files\Windows Live\.cache\ba6a5b251cd1f3401\DXSETUP.exe

2012-04-20 20:32 . 2012-04-20 20:32        1801048        ----a-w-        c:\program files (x86)\Common Files\Windows Live\.cache\ba6a5b251cd1f3401\dsetup32.dll

2012-04-20 20:31 . 2012-04-20 20:31        --------        d-----w-        c:\program files (x86)\Microsoft

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-05-09 13:24 . 2011-10-16 09:29        98848        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2012-05-09 13:24 . 2011-10-16 09:29        132832        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2012-05-05 14:15 . 2012-04-13 14:30        419488        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2012-05-05 14:15 . 2011-07-02 17:27        70304        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-05-05 14:15 . 2012-04-13 15:15        8744608        ----a-w-        c:\windows\SysWow64\FlashPlayerInstaller.exe

2012-04-05 14:57 . 2012-03-29 15:01        88        ----a-w-        c:\users\Public\sdelevURL.tmp

2012-03-08 16:50 . 2012-03-08 16:50        49016        ----a-w-        c:\windows\SysWow64\sirenacm.dll

2012-03-08 16:37 . 2012-03-08 16:37        302448        ----a-w-        c:\windows\WLXPGSS.SCR

2012-03-01 06:46 . 2012-04-11 14:42        23408        ----a-w-        c:\windows\system32\drivers\fs_rec.sys

2012-03-01 06:38 . 2012-04-11 14:42        220672        ----a-w-        c:\windows\system32\wintrust.dll

2012-03-01 06:33 . 2012-04-11 14:42        81408        ----a-w-        c:\windows\system32\imagehlp.dll

2012-03-01 06:28 . 2012-04-11 14:42        5120        ----a-w-        c:\windows\system32\wmi.dll

2012-03-01 05:37 . 2012-04-11 14:42        172544        ----a-w-        c:\windows\SysWow64\wintrust.dll

2012-03-01 05:33 . 2012-04-11 14:42        159232        ----a-w-        c:\windows\SysWow64\imagehlp.dll

2012-03-01 05:29 . 2012-04-11 14:42        5120        ----a-w-        c:\windows\SysWow64\wmi.dll

2012-02-28 06:56 . 2012-04-11 14:45        2311168        ----a-w-        c:\windows\system32\jscript9.dll

2012-02-28 06:49 . 2012-04-11 14:44        1390080        ----a-w-        c:\windows\system32\wininet.dll

2012-02-28 06:48 . 2012-04-11 14:44        1493504        ----a-w-        c:\windows\system32\inetcpl.cpl

2012-02-28 06:42 . 2012-04-11 14:45        2382848        ----a-w-        c:\windows\system32\mshtml.tlb

2012-02-28 01:18 . 2012-04-11 14:45        1799168        ----a-w-        c:\windows\SysWow64\jscript9.dll

2012-02-28 01:11 . 2012-04-11 14:44        1427456        ----a-w-        c:\windows\SysWow64\inetcpl.cpl

2012-02-28 01:11 . 2012-04-11 14:44        1127424        ----a-w-        c:\windows\SysWow64\wininet.dll

2012-02-28 01:03 . 2012-04-11 14:45        2382848        ----a-w-        c:\windows\SysWow64\mshtml.tlb

2012-02-17 06:38 . 2012-03-14 16:39        1031680        ----a-w-        c:\windows\system32\rdpcore.dll

2012-02-17 05:34 . 2012-03-14 16:39        826880        ----a-w-        c:\windows\SysWow64\rdpcore.dll

2012-02-17 04:58 . 2012-03-14 16:39        210944        ----a-w-        c:\windows\system32\drivers\rdpwd.sys

2012-02-17 04:57 . 2012-03-14 16:39        23552        ----a-w-        c:\windows\system32\drivers\tdtcp.sys

2012-02-15 09:01 . 2012-02-15 09:01        52736        ----a-w-        c:\windows\system32\drivers\usbaapl64.sys

2012-02-15 09:01 . 2012-02-15 09:01        4547944        ----a-w-        c:\windows\system32\usbaaplrc.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]

2011-08-24 17:21        1299248        ----a-r-        c:\program files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]

"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2011-08-24 1299248]

.

[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]

[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]

[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]

[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]

"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-07-01 39408]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-12-09 336384]

"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-12-20 113288]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]

"CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2009-11-02 103720]

"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-05-09 348624]

"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-09-27 59240]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]

"SweetIM"="c:\program files (x86)\SweetIM\Messenger\SweetIM.exe" [2011-08-01 114992]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]

"RIMBBLaunchAgent.exe"="c:\program files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-09-01 90448]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-03-27 421736]

"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages        REG_MULTI_SZ           kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-01 136176]

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-05 257696]

R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-01 136176]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]

R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys [x]

R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys [x]

R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys [x]

R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys [x]

R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys [2010-06-14 16448]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]

R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [x]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]

S0 amd_sata;amd_sata;c:\windows\system32\drivers\amd_sata.sys [x]

S0 amd_xata;amd_xata;c:\windows\system32\drivers\amd_xata.sys [x]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]

S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2010-12-09 354304]

S2 AMD Reservation Manager;AMD Reservation Manager;c:\program files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [2010-06-17 194496]

S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-05-09 86224]

S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]

S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]

S2 TomTomHOMEService;TomTomHOMEService;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe [2012-01-23 92592]

S3 amdiox64;AMD IO Driver;c:\windows\system32\drivers\amdiox64.sys [x]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]

S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys [x]

S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]

S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x]

S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x]

S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x]

S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x]

S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]

S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [x]

.

.

Inhalt des "geplante Tasks" Ordners

.

2012-05-14 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-13 14:15]

.

2012-05-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-01 08:07]

.

2012-05-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-01 08:07]

.

.

--------- x86-64 -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-01-13 11774568]

"fssui"="c:\program files (x86)\Windows Live\Family Safety\fsui.exe" [2012-03-08 884584]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.at/

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: Search the Web - c:\program files (x86)\SweetIM\Toolbars\Internet Explorer\resources\menuext.html

IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/5221-29898-17534-1/4

TCP: DhcpNameServer = 195.3.96.67 195.3.96.68

FF - ProfilePath - 

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Wow6432Node-HKLM-Run-NPSStartup - (no file)

WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe

c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files (x86)\Windows Live\Family Safety\fsssvc.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2012-05-14  23:04:34 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2012-05-14 21:04

.

Vor Suchlauf: 6 Verzeichnis(se), 1.391.855.976.448 Bytes frei

Nach Suchlauf: 12 Verzeichnis(se), 1.397.041.537.024 Bytes frei

.

- - End Of File - - 01EC6B5F78E62B226CDD898120963B02

--- --- ---

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!

Starte die aswMBR.exe Vista und Win7 User aswMBR per Rechtsklick "als Administrator ausführen"
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr", dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

Und das nächste Log:

Code:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-05-15 19:15:02

-----------------------------

19:15:02.672    OS Version: Windows x64 6.1.7601 Service Pack 1

19:15:02.672    Number of processors: 4 586 0x503

19:15:02.672    ComputerName: STAND-PC  UserName: admin

19:15:05.214    Initialize success

19:16:41.966    AVAST engine defs: 12051500

19:16:47.613    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000005b

19:16:47.613    Disk 0 Vendor: ST315005 CC34 Size: 1430799MB BusType: 11

19:16:47.629    Disk 0 MBR read successfully

19:16:47.629    Disk 0 MBR scan

19:16:47.645    Disk 0 unknown MBR code

19:16:47.660    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048

19:16:47.660    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS      1398953 MB offset 206848

19:16:47.707    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS        30720 MB offset 2865262592

19:16:47.738    Disk 0 Partition 4 00     12  Compaq diag NTFS         1024 MB offset 2928177152

19:16:47.785    Disk 0 scanning C:\Windows\system32\drivers

19:17:00.015    Service scanning

19:17:21.387    Modules scanning

19:17:21.450    Disk 0 trace - called modules:

19:17:21.465    ntoskrnl.exe CLASSPNP.SYS disk.sys amd_xata.sys storport.sys hal.dll amd_sata.sys 

19:17:21.465    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004974790]

19:17:21.481    3 CLASSPNP.SYS[fffff880019c943f] -> nt!IofCallDriver -> [0xfffffa80039f7040]

19:17:21.481    5 amd_xata.sys[fffff880010cc7a8] -> nt!IofCallDriver -> \Device\0000005b[0xfffffa800489e9c0]

19:17:23.587    AVAST engine scan C:\Windows

19:17:34.055    AVAST engine scan C:\Windows\system32

19:21:17.119    AVAST engine scan C:\Windows\system32\drivers

19:21:31.659    AVAST engine scan C:\Users\admin

19:22:01.626    AVAST engine scan C:\ProgramData

19:23:05.446    Scan finished successfully

19:39:00.604    Disk 0 MBR has been saved successfully to "C:\Users\admin\Desktop\MBR.dat"

19:39:00.620    The log file has been saved successfully to "C:\Users\admin\Desktop\aswMBR.txt"

Wir sollten den MBR fixen, sichere für den Fall der Fälle ALLE wichtigen Daten, auch wenn meistens alles glatt geht.

Hinweis: Mach bitte NICHT den MBR-Fix, wenn du noch andere Betriebssysteme wie zB Ubuntu installiert hast, ein MBR-Fix mit Windows-Tools macht ein parallel installiertes (Dualboot) Linux unbootbar.
Mach den Fix auch dann nicht, wenn du zB mit TrueCrypt oder anderen Verschlüsselungsprogrammen eine Vollverschlüsselung der Windowspartition bzw. gesamten Festplatte hast

Starte nach der Datensicherung aswmbr erneut und klick auf den Button FIXMBR.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!

Anschließend Windows neu starten und ein neues Log mit aswMBR machen.

MBR Fix erledigt - hier das Log:

Code:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-05-15 19:15:02

-----------------------------

19:15:02.672    OS Version: Windows x64 6.1.7601 Service Pack 1

19:15:02.672    Number of processors: 4 586 0x503

19:15:02.672    ComputerName: STAND-PC  UserName: admin

19:15:05.214    Initialize success

19:16:41.966    AVAST engine defs: 12051500

19:16:47.613    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000005b

19:16:47.613    Disk 0 Vendor: ST315005 CC34 Size: 1430799MB BusType: 11

19:16:47.629    Disk 0 MBR read successfully

19:16:47.629    Disk 0 MBR scan

19:16:47.645    Disk 0 unknown MBR code

19:16:47.660    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048

19:16:47.660    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS      1398953 MB offset 206848

19:16:47.707    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS        30720 MB offset 2865262592

19:16:47.738    Disk 0 Partition 4 00     12  Compaq diag NTFS         1024 MB offset 2928177152

19:16:47.785    Disk 0 scanning C:\Windows\system32\drivers

19:17:00.015    Service scanning

19:17:21.387    Modules scanning

19:17:21.450    Disk 0 trace - called modules:

19:17:21.465    ntoskrnl.exe CLASSPNP.SYS disk.sys amd_xata.sys storport.sys hal.dll amd_sata.sys 

19:17:21.465    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004974790]

19:17:21.481    3 CLASSPNP.SYS[fffff880019c943f] -> nt!IofCallDriver -> [0xfffffa80039f7040]

19:17:21.481    5 amd_xata.sys[fffff880010cc7a8] -> nt!IofCallDriver -> \Device\0000005b[0xfffffa800489e9c0]

19:17:23.587    AVAST engine scan C:\Windows

19:17:34.055    AVAST engine scan C:\Windows\system32

19:21:17.119    AVAST engine scan C:\Windows\system32\drivers

19:21:31.659    AVAST engine scan C:\Users\admin

19:22:01.626    AVAST engine scan C:\ProgramData

19:23:05.446    Scan finished successfully

19:39:00.604    Disk 0 MBR has been saved successfully to "C:\Users\admin\Desktop\MBR.dat"

19:39:00.620    The log file has been saved successfully to "C:\Users\admin\Desktop\aswMBR.txt"
 
 

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-05-16 19:05:46

-----------------------------

19:05:46.884    OS Version: Windows x64 6.1.7601 Service Pack 1

19:05:46.884    Number of processors: 4 586 0x503

19:05:46.884    ComputerName: STAND-PC  UserName: admin

19:05:49.520    Initialize success

19:05:54.684    AVAST engine defs: 12051500

19:06:06.976    The log file has been saved successfully to "C:\Users\admin\Desktop\aswMBR.txt"

Du solltest auch ein komplett neues Log mit aswMBR machen

OK, nächster Versuch ...

Code:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-05-15 19:15:02

-----------------------------

19:15:02.672    OS Version: Windows x64 6.1.7601 Service Pack 1

19:15:02.672    Number of processors: 4 586 0x503

19:15:02.672    ComputerName: STAND-PC  UserName: admin

19:15:05.214    Initialize success

19:16:41.966    AVAST engine defs: 12051500

19:16:47.613    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000005b

19:16:47.613    Disk 0 Vendor: ST315005 CC34 Size: 1430799MB BusType: 11

19:16:47.629    Disk 0 MBR read successfully

19:16:47.629    Disk 0 MBR scan

19:16:47.645    Disk 0 unknown MBR code

19:16:47.660    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048

19:16:47.660    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS      1398953 MB offset 206848

19:16:47.707    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS        30720 MB offset 2865262592

19:16:47.738    Disk 0 Partition 4 00     12  Compaq diag NTFS         1024 MB offset 2928177152

19:16:47.785    Disk 0 scanning C:\Windows\system32\drivers

19:17:00.015    Service scanning

19:17:21.387    Modules scanning

19:17:21.450    Disk 0 trace - called modules:

19:17:21.465    ntoskrnl.exe CLASSPNP.SYS disk.sys amd_xata.sys storport.sys hal.dll amd_sata.sys 

19:17:21.465    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004974790]

19:17:21.481    3 CLASSPNP.SYS[fffff880019c943f] -> nt!IofCallDriver -> [0xfffffa80039f7040]

19:17:21.481    5 amd_xata.sys[fffff880010cc7a8] -> nt!IofCallDriver -> \Device\0000005b[0xfffffa800489e9c0]

19:17:23.587    AVAST engine scan C:\Windows

19:17:34.055    AVAST engine scan C:\Windows\system32

19:21:17.119    AVAST engine scan C:\Windows\system32\drivers

19:21:31.659    AVAST engine scan C:\Users\admin

19:22:01.626    AVAST engine scan C:\ProgramData

19:23:05.446    Scan finished successfully

19:39:00.604    Disk 0 MBR has been saved successfully to "C:\Users\admin\Desktop\MBR.dat"

19:39:00.620    The log file has been saved successfully to "C:\Users\admin\Desktop\aswMBR.txt"
 
 

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-05-16 19:05:46

-----------------------------

19:05:46.884    OS Version: Windows x64 6.1.7601 Service Pack 1

19:05:46.884    Number of processors: 4 586 0x503

19:05:46.884    ComputerName: STAND-PC  UserName: admin

19:05:49.520    Initialize success

19:05:54.684    AVAST engine defs: 12051500

19:06:06.976    The log file has been saved successfully to "C:\Users\admin\Desktop\aswMBR.txt"
 
 

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-05-17 08:57:58

-----------------------------

08:57:58.449    OS Version: Windows x64 6.1.7601 Service Pack 1

08:57:58.449    Number of processors: 4 586 0x503

08:57:58.449    ComputerName: STAND-PC  UserName: admin

08:58:00.446    Initialize success

08:59:39.491    AVAST engine defs: 12051601

09:00:09.006    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000005b

09:00:09.006    Disk 0 Vendor: ST315005 CC34 Size: 1430799MB BusType: 11

09:00:09.022    Disk 0 MBR read successfully

09:00:09.022    Disk 0 MBR scan

09:00:09.037    Disk 0 Windows 7 default MBR code

09:00:09.053    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048

09:00:09.069    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS      1398953 MB offset 206848

09:00:09.100    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS        30720 MB offset 2865262592

09:00:09.131    Disk 0 Partition 4 00     12  Compaq diag NTFS         1024 MB offset 2928177152

09:00:09.178    Disk 0 scanning C:\Windows\system32\drivers

09:00:19.942    Service scanning

09:00:40.237    Modules scanning

09:00:40.253    Disk 0 trace - called modules:

09:00:40.284    ntoskrnl.exe CLASSPNP.SYS disk.sys amd_xata.sys storport.sys hal.dll amd_sata.sys 

09:00:40.284    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80046bd790]

09:00:40.284    3 CLASSPNP.SYS[fffff88001bbc43f] -> nt!IofCallDriver -> [0xfffffa80039f7040]

09:00:40.300    5 amd_xata.sys[fffff880010b77a8] -> nt!IofCallDriver -> \Device\0000005b[0xfffffa80044ac9c0]

09:00:42.687    AVAST engine scan C:\Windows

09:00:45.947    AVAST engine scan C:\Windows\system32

09:04:19.293    AVAST engine scan C:\Windows\system32\drivers

09:04:46.796    AVAST engine scan C:\Users\admin

09:05:11.428    AVAST engine scan C:\ProgramData

09:05:55.920    Scan finished successfully

09:57:00.561    Disk 0 MBR has been saved successfully to "C:\Users\admin\Desktop\MBR.dat"

09:57:00.576    The log file has been saved successfully to "C:\Users\admin\Desktop\aswMBR.txt"

Zitat:

09:00:09.037 Disk 0 Windows 7 default MBR code

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Malwarebytes meldet 1 Fund ... ich habe nichts bereinigen lassen!

Hier das Log:

Code:

Malwarebytes Anti-Malware 1.61.0.1400

www.malwarebytes.org
 

Datenbank Version: v2012.05.17.06
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

admin :: STAND-PC [Administrator]
 

17.05.2012 21:52:33

mbam-log-2012-05-17 (23-03-52).txt
 

Art des Suchlaufs: Vollständiger Suchlauf

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 423041

Laufzeit: 41 Minute(n), 7 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 1

C:\Windows\winsxs\amd64_microsoft-windows-d..ostic-user-resolver_31bf3856ad364e35_6.1.7600.16385_none_2129f6bd1f6002ae\DFDWiz.exe (Trojan.FakeAlert) -> Keine Aktion durchgeführt.
 

(Ende)

Und AntiSpyware meldet auch 1 Fund ... auch da habe ich nichts bereinigen lassen!

Das Log:

Code:

SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 05/19/2012 at 07:44 PM
 

Application Version : 5.0.1148
 

Core Rules Database Version : 8623

Trace Rules Database Version: 6435
 

Scan type       : Complete Scan

Total Scan Time : 01:07:05
 

Operating System Information

Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)

UAC On - Administrator
 

Memory items scanned      : 813

Memory threats detected   : 0

Registry items scanned    : 66702

Registry threats detected : 0

File items scanned        : 131336

File threats detected     : 1
 

Trojan.Agent/Gen-Yoddos

        C:\PROGRAM FILES\WINRAR\DEFAULT.SFX

Zitat:

C:\Windows\winsxs\amd64_microsoft-windows-d..ostic-user-resolver_31bf3856ad364e35_6.1.7600.16385_none_2129f6bd1f6002ae\DFDWiz.exe (Trojan.FakeAlert

Bin mir nicht sicher ob das nicht doch ein Fehlalarm ist. Der von SASW ist aber auf jeden Fall ein Fehlalarm.
Werte die von Malwarebytes gefundene Datei bitte mal hier aus => http://www.virustotal.com und poste die Ergebnisse bzw. am besten den Ergebnislink

Hier der Link:

https://www.virustotal.com/file/42761cbb8d72595c61fb6e52699fe3fb609509582b7055490ffb8fd31d09c996/analysis/

Scheint ein Fehlalarm zu sein!

Werte die Datei bitte aus für den Fall der Fälle, also eine neue Auswertung bei VT starten

Ähh das hatte ich ja gemacht und dir eben den Link gepostet ...

Hier nochmal der Link vom reScan:

https://www.virustotal.com/file/42761cbb8d72595c61fb6e52699fe3fb609509582b7055490ffb8fd31d09c996/analysis/1337635343/

Und hier ein Versuch einer Hardcopy:

Code:


 

SHA256:
 

42761cbb8d72595c61fb6e52699fe3fb609509582b7055490ffb8fd31d09c996
 
 
 

SHA1:
 

1d090f4c9c7234aeaf52e13cdec075164ff3d0fa
 
 
 

MD5:
 

4a3bd2bb1b55c39ab71ef4c9b9dce815
 
 
 

File size:
 

77.5 KB ( 79360 bytes ) 
 
 
 

File name:
 

C:\Windows\winsxs\amd64_microsoft-windows-d..ostic-user-resolver_31bf3856ad364e35_6.1.7600.16385_none_2129f6bd1f6002ae\DFDWiz.exe
 
 
 

File type:
 

unknown
 
 
 

Detection ratio:
 

0 / 42
 
 
 

Analysis date:
 

 2012-05-21 21:22:23 UTC ( 0 Minuten ago ) 
 
 
 
 
 
 
 

1
 
 
 

0
 

 

More details
 
 
 
 
 

Antivirus
 

Result
 

Update
 
 
 
 

AhnLab-V3
 

-
 

20120521
 
 
 

AntiVir
 

-
 

20120521
 
 
 

Antiy-AVL
 

-
 

20120521
 
 
 

Avast
 

-
 

20120521
 
 
 

AVG
 

-
 

20120521
 
 
 

BitDefender
 

-
 

20120521
 
 
 

ByteHero
 

-
 

20120521
 
 
 

CAT-QuickHeal
 

-
 

20120521
 
 
 

ClamAV
 

-
 

20120521
 
 
 

Commtouch
 

-
 

20120521
 
 
 

Comodo
 

-
 

20120521
 
 
 

DrWeb
 

-
 

20120521
 
 
 

Emsisoft
 

-
 

20120521
 
 
 

eSafe
 

-
 

20120520
 
 
 

F-Prot
 

-
 

20120521
 
 
 

F-Secure
 

-
 

20120521
 
 
 

Fortinet
 

-
 

20120521
 
 
 

GData
 

-
 

20120521
 
 
 

Ikarus
 

-
 

20120521
 
 
 

Jiangmin
 

-
 

20120521
 
 
 

K7AntiVirus
 

-
 

20120521
 
 
 

Kaspersky
 

-
 

20120521
 
 
 

McAfee
 

-
 

20120521
 
 
 

McAfee-GW-Edition
 

-
 

20120521
 
 
 

Microsoft
 

-
 

20120521
 
 
 

NOD32
 

-
 

20120521
 
 
 

Norman
 

-
 

20120520
 
 
 

nProtect
 

-
 

20120521
 
 
 

Panda
 

-
 

20120521
 
 
 

PCTools
 

-
 

20120521
 
 
 

Rising
 

-
 

20120521
 
 
 

Sophos
 

-
 

20120521
 
 
 

SUPERAntiSpyware
 

-
 

20120519
 
 
 

Symantec
 

-
 

20120521
 
 
 

TheHacker
 

-
 

20120521
 
 
 

TotalDefense
 

-
 

20120521
 
 
 

TrendMicro
 

-
 

20120521
 
 
 

TrendMicro-HouseCall
 

-
 

20120521
 
 
 

VBA32
 

-
 

20120521
 
 
 

VIPRE
 

-
 

20120521
 
 
 

ViRobot
 

-
 

20120521
 
 
 

VirusBuster
 

-
 

20120521
 

 Comments

Votes

Additional information
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

ssdeep

 1536:4/vdl2M92lfJUD4JOSE0effXxT830AQIR+kd73MlX:4v3282laKE0ae30ArAkdA 
 
 
 

TrID

 Win64 Executable Generic (95.5%)

 Generic Win/DOS Executable (2.2%)

 DOS Executable Generic (2.2%)

 Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)

 
 
 
 

ExifTool

UninitializedDataSize....: 0

InitializedDataSize......: 11776

ImageVersion.............: 6.1

ProductName..............: Microsoft   Windows   Operating System

FileVersionNumber........: 6.1.7600.16385

LanguageCode.............: English (U.S.)

FileFlagsMask............: 0x003f

FileDescription..........: Windows Disk Diagnostic User Resolver

CharacterSet.............: Unicode

LinkerVersion............: 9.0

FileOS...................: Windows NT 32-bit

MIMEType.................: application/octet-stream

Subsystem................: Windows GUI

FileVersion..............: 6.1.7600.16385 (win7_rtm.090713-1255)

TimeStamp................: 2009:07:14 01:32:01+02:00

FileType.................: Win64 EXE

PEType...................: PE32+

InternalName.............: DFDWiz.exe

ProductVersion...........: 6.1.7600.16385

SubsystemVersion.........: 6.1

OSVersion................: 6.1

OriginalFilename.........: DFDWiz.exe

LegalCopyright...........: Microsoft Corporation. All rights reserved.

MachineType..............: AMD AMD64

CompanyName..............: Microsoft Corporation

CodeSize.................: 68096

FileSubtype..............: 0

ProductVersionNumber.....: 6.1.7600.16385

EntryPoint...............: 0xf2e4

ObjectFileType...........: Executable application

 
 
 
 

Sigcheck

publisher................: Microsoft Corporation

product..................: Microsoft_ Windows_ Operating System

internal name............: DFDWiz.exe

copyright................: (c) Microsoft Corporation. All rights reserved.

original name............: DFDWiz.exe

signing date.............: 9:32 PM 11/20/2010

signers..................: Microsoft Windows

               Microsoft Windows Verification PCA

               Microsoft Root Certificate Authority

file version.............: 6.1.7600.16385 (win7_rtm.090713-1255)

description..............: Windows Disk Diagnostic User Resolver

 
 
 
 

Portable Executable structural information

Compilation timedatestamp.....: 2009-07-13 23:32:01

Target machine................: 0x8664 (x64)

Entry point address...........: 0x0000F2E4
 

PE Sections...................:
 

Name        Virtual Address  Virtual Size  Raw Size  Entropy  MD5

.text                  4096         67796     68096     6.27  1c7bdc5775f28516be193bb83c55bf95

.data                 73728          2008       512     0.61  6a0660ec5c968bdadafbea098622807c

.pdata                77824          1812      2048     4.25  30a0d6187e44f1b2d96f60b56cc400a7

.rsrc                 81920          7152      7168     4.30  0fa6204cdaf076caeb1a2a64940f55a2

.reloc                90112           240       512     0.54  e2989db22741117fddf9674837b35511
 

PE Imports....................:
 

GDI32.dll

        SelectObject, DeleteObject, AbortDoc, EndDoc, EndPage, StartPage, StartDocW, CreateFontIndirectW, GetDeviceCaps, SetMapMode, SetAbortProc, DeleteDC
 

KERNEL32.dll

        GetCurrentThreadId, GlobalFree, MulDiv, HeapAlloc, GetCurrentProcess, CreateFileW, WriteFile, HeapFree, OpenMutexW, CreateMutexW, GetProcAddress, GetVersionExW, FormatMessageW, GetProcessHeap, HeapSetInformation, RegisterApplicationRestart, GetSystemTime, SystemTimeToFileTime, CloseHandle, CreateEventW, OutputDebugStringA, QueryActCtxW, GetModuleHandleExW, SetLastError, GetModuleFileNameW, CreateActCtxW, FindActCtxSectionStringW, LoadLibraryW, ActivateActCtx, GetLastError, LocalFree, Sleep, GetStartupInfoW, SetUnhandledExceptionFilter, GetModuleHandleW, QueryPerformanceCounter, DeactivateActCtx, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, UnhandledExceptionFilter, DeviceIoControl, FindFirstVolumeW, FindNextVolumeW, FindVolumeClose, GetVolumePathNamesForVolumeNameW
 

msvcrt.dll

        memset, memcmp, wcsstr, _wcsupr, __CxxFrameHandler3, __2@YAPEAX_K@Z, _vsnwprintf, __3@YAXPEAX@Z, __getmainargs, __C_specific_handler, _wcslwr, _amsg_exit, _XcptFilter, _terminate@@YAXXZ, __set_app_type, _fmode, _commode, __setusermatherr, memcpy, _initterm, _acmdln, exit, _cexit, _wcsicmp, _ismbblead, _exit
 

OLEAUT32.dll

        -, -, -, -
 

ADVAPI32.dll

        TraceMessage, OpenProcessToken, RegOpenKeyExW, EventWrite, RegQueryInfoKeyW, RegCloseKey, RegEnumKeyExW, RegDeleteKeyW, ConvertStringSecurityDescriptorToSecurityDescriptorW, LookupPrivilegeValueW, AdjustTokenPrivileges, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, InitiateShutdownW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, GetTraceLoggerHandle, GetTraceEnableLevel, GetTraceEnableFlags, RegisterTraceGuidsW, UnregisterTraceGuids, EventRegister, EventUnregister, RegEnumValueW
 

ntdll.dll

        RtlVirtualUnwind, RtlCaptureContext, RtlLookupFunctionEntry, WinSqmStartSession, WinSqmEndSession, WinSqmAddToStream, WinSqmSetDWORD, NtQuerySystemTime
 

ole32.dll

        CoCreateGuid, CoInitializeEx, StringFromGUID2, CoInitialize, CoCreateInstance, CoUninitialize
 

SETUPAPI.dll

        SetupDiGetDeviceInterfaceDetailW, SetupDiEnumDeviceInterfaces, SetupDiDestroyDeviceInfoList, SetupDiGetDeviceRegistryPropertyW, SetupDiGetClassDevsW
 

USER32.dll

        SetDlgItemTextW, DialogBoxParamW, LoadStringW, MessageBoxW, SetFocus, TranslateMessage, IsDialogMessageW, DrawTextW, ShowWindow, CreateDialogParamW, EnableWindow, SetCursor, EndDialog, GetDlgItem, PostMessageW, GetParent, DefWindowProcW, EnumThreadWindows, SetWindowPos, SendMessageW, LoadIconW, DestroyWindow, MsgWaitForMultipleObjects, PeekMessageW, SetWindowLongPtrW, GetWindowLongPtrW, CreateWindowExW, LoadCursorW, DispatchMessageW
 

USERENV.dll

        GetUserProfileDirectoryW
 
 

PE Exports....................: 
 
 
 

Symantec Reputation

Suspicious.Insight 
 
 
 

First seen by VirusTotal

 2010-01-26 12:51:28 UTC ( 2 Jahre, 3 Monate ago ) 
 
 
 

Last seen by VirusTotal

 2012-05-21 21:22:23 UTC ( 1 Minute ago ) 
 
 
 

File names (max. 25)

1. file-3945503_exe 

2. DFDWiz.exe 

3. smona130911664940069802407 

4. smona130911651608768022116 

5. C:\Windows\winsxs\amd64_microsoft-windows-d..ostic-user-resolver_31bf3856ad364e35_6.1.7600.16385_none_2129f6bd1f6002ae\DFDWiz.exe 

6. tmp\DFDWiz.exe 

7. 1d090f4c9c7234aeaf52e13cdec075164ff3d0fa 

8. dfdwiz.exe 
 
 
 

Blog | Twitter | contact@virustotal.com | Google groups | TOS & Privacy Policy

Ja das ist ein Fehlalarm :)

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

OK, dann mal ein grosses DANKE für deine Hilfe!!! System läuft, mir wär sonst nichts aufgefallen.

MVPS werd ich mir ansehen!

Ich muss leider den Internet Explorer verwenden, da meine Kids auch surfen und ich den Family Safety Filter sehr gut finde. Hatte früher auch lieber den Firefox, nur habe ich dort nichts gefunden womit ich meine Kids "schützen" kann.

Jedenfalls werde ich beim Browser schliessen immer alles löschen lassen.

Als Virenschutz nutze ich AVIRA ... taugt der was? Firewall hab ich blos die von Windows aktiviert. Gibts da von dir Tipps oder Programme? Gratis sollten sie halt schon sein ...

lg, Mike