Trojaner-Board
Seite 3 von 3 12 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Registrierungsreparatur nach Trojanerbefall (https://www.trojaner-board.de/115578-registrierungsreparatur-trojanerbefall.html)

ThimoS. 25.05.2012 11:17
Combofix:

[code]
Combofix Logfile:
Code:
ComboFix 12-05-25.02 - --- 25/05/2012  11:28:06.5.1 - x86
Running from: c:\users\---\Desktop\ComboFix.exe
Command switches used :: c:\users\---\Desktop\CFScript.txt
 * Created a new restore point
.
.
(((((((((((((((((((((((((((((((((((((((  Other Deletions  )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
--------------- FCopy ---------------
.
c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe --> c:\windows\explorer.exe
.
(((((((((((((((((((((((((  Files Created from 2012-04-25 to 2012-05-25  )))))))))))))))))))))))))))))))
.
.
2012-05-25 09:57 . 2012-05-25 09:57        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-05-25 08:45 . 2012-05-25 08:45        56200        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{B925106A-176E-4833-9007-DA752802C034}\offreg.dll
2012-05-24 06:32 . 2012-05-24 20:11        --------        d-----w-        C:\FRST
2012-05-24 02:34 . 2012-05-24 20:10        --------        d-----w-        C:\Boot
2012-05-23 20:48 . 2012-05-25 09:57        --------        d-----w-        c:\users\---\AppData\Local\Temp
2012-05-23 13:54 . 2012-05-23 13:55        --------        d-----w-        c:\program files\SUPERAntiSpyware
2012-05-23 13:54 . 2012-05-23 13:54        --------        d-----w-        c:\program files\Common Files\Wise Installation Wizard
2012-05-22 13:12 . 2012-05-22 13:12        --------        d-----w-        c:\users\---\AppData\Roaming\GlarySoft
2012-05-22 13:04 . 2012-05-22 13:04        --------        d-----w-        c:\program files\Uniblue
2012-05-22 12:21 . 2012-05-22 12:21        --------        d-----w-        c:\program files\Glarysoft
2012-05-21 10:12 . 2012-05-21 10:12        --------        d-----w-        c:\program files\Passcape
2012-05-18 11:58 . 2012-05-18 12:03        --------        d-----w-        c:\users\---\AppData\Roaming\Profiles
2012-05-18 11:58 . 2012-05-18 11:58        --------        d-----w-        c:\users\---\AppData\Roaming\Skins
2012-05-18 11:58 . 2012-05-18 11:58        --------        d-----w-        c:\users\---\AppData\Roaming\Settings
2012-05-18 11:58 . 2012-05-18 11:58        --------        d-----w-        c:\users\---\AppData\Roaming\Language
2012-05-10 20:37 . 2012-03-30 10:23        1291632        ----a-w-        c:\windows\system32\drivers\tcpip.sys
2012-05-10 20:37 . 2012-03-31 04:29        936960        ----a-w-        c:\program files\Common Files\Microsoft Shared\Ink\journal.dll
2012-05-10 20:37 . 2012-03-31 04:30        1221632        ----a-w-        c:\program files\Windows Journal\NBDoc.DLL
2012-05-10 20:37 . 2012-03-31 04:29        989184        ----a-w-        c:\program files\Windows Journal\JNTFiltr.dll
2012-05-10 20:37 . 2012-03-31 04:29        969216        ----a-w-        c:\program files\Windows Journal\JNWDRV.dll
2012-05-10 20:37 . 2012-03-31 04:39        3968368        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2012-05-10 20:37 . 2012-03-31 04:39        3913072        ----a-w-        c:\windows\system32\ntoskrnl.exe
2012-05-10 20:37 . 2012-03-31 02:36        2343424        ----a-w-        c:\windows\system32\win32k.sys
2012-05-10 20:36 . 2012-03-17 07:27        56176        ----a-w-        c:\windows\system32\drivers\partmgr.sys
2012-05-10 20:36 . 2012-03-03 05:31        1077248        ----a-w-        c:\windows\system32\DWrite.dll
2012-05-02 18:50 . 2012-05-02 18:50        --------        d-sh--w-        c:\program files\KGB
2012-04-30 21:37 . 2012-04-30 21:37        --------        d-----w-        c:\programdata\NVIDIA Corporation
2012-04-30 21:36 . 2012-02-29 23:59        881984        ----a-w-        c:\windows\system32\nvgenco32.dll
2012-04-30 21:36 . 2012-02-29 23:59        19444544        ----a-w-        c:\windows\system32\nvoglv32.dll
2012-04-30 21:36 . 2012-02-29 23:59        1000256        ----a-w-        c:\windows\system32\nvdispco32.dll
2012-04-28 17:09 . 2012-04-28 17:09        --------        d-----w-        c:\users\---\AppData\Roaming\HD Tune Pro
2012-04-28 17:06 . 2012-04-28 17:09        --------        d-----w-        c:\program files\HDTune
2012-04-28 16:44 . 2012-04-28 16:44        --------        d-----w-        c:\users\---\AppData\Local\Western Digital
2012-04-28 16:36 . 2012-04-28 16:36        --------        d-----w-        c:\users\---\AppData\Roaming\BinarySense
2012-04-28 16:35 . 2012-04-28 16:35        --------        d-----w-        c:\program files\HdLife
2012-04-28 16:35 . 2012-04-28 16:35        --------        d-----w-        c:\program files\Common Files\BinarySense
2012-04-28 15:41 . 2001-08-29 19:00        59904        ----a-w-        c:\windows\system32\wbemdisp.tlb
2012-04-28 15:41 . 1998-07-21 22:00        102160        ----a-w-        c:\windows\system32\VB6KO.DLL
2012-04-28 15:41 . 2012-04-28 15:47        --------        d-----w-        c:\program files\lg_fwupdate
2012-04-28 15:41 . 2012-04-28 15:43        16384        ----a-w-        c:\windows\system32\lgfwunis.exe
2012-04-28 15:41 . 1998-06-23 22:00        115016        ----a-w-        c:\windows\system32\MSINET.OCX
2012-04-28 15:41 . 2001-09-05 01:18        77824        ----a-w-        c:\program files\Common Files\InstallShield\Engine\6\Intel 32\ctor.dll
2012-04-28 15:41 . 2001-09-05 01:18        225280        ------w-        c:\program files\Common Files\InstallShield\IScript\iscript.dll
2012-04-28 15:41 . 2001-09-05 01:14        176128        ------w-        c:\program files\Common Files\InstallShield\Engine\6\Intel 32\iuser.dll
2012-04-28 15:41 . 2001-09-05 01:13        32768        ------w-        c:\program files\Common Files\InstallShield\Engine\6\Intel 32\objectps.dll
2012-04-28 15:41 . 2006-01-10 21:35        614532        ----a-w-        c:\program files\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
2012-04-28 15:32 . 2012-04-28 15:32        --------        d-----w-        c:\program files\DVD Genie
.
.
.
((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-22 13:26 . 2009-07-13 23:40        249856        ----a-w-        c:\windows\system32\uxtheme.dll
2012-05-22 13:26 . 2011-10-29 15:48        2755072        ----a-w-        c:\windows\system32\themeui.dll
2012-05-22 13:26 . 2009-07-13 23:39        37376        ----a-w-        c:\windows\system32\themeservice.dll
2012-05-10 06:54 . 2012-04-17 16:54        419488        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2012-05-10 06:54 . 2011-10-29 18:01        70304        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-04-08 16:35 . 2012-03-24 11:40        60416        ----a-w-        c:\windows\ALCFDRTM.VER
2012-04-04 13:56 . 2011-10-29 20:31        22344        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-03-27 12:54 . 2012-02-06 14:09        637848        ----a-w-        c:\windows\system32\npdeployJava1.dll
2012-03-27 12:54 . 2012-02-06 14:09        567696        ----a-w-        c:\windows\system32\deployJava1.dll
2012-03-24 11:40 . 2012-03-24 11:40        60416        ----a-w-        c:\windows\ALCFDRTM.EXE
2012-03-07 20:40 . 2012-03-07 20:40        1010720        --s---r-        c:\windows\system32\MSCHRT20.OCX
2012-03-01 05:46 . 2012-04-12 14:39        19824        ----a-w-        c:\windows\system32\drivers\fs_rec.sys
2012-03-01 05:37 . 2012-04-12 14:39        172544        ----a-w-        c:\windows\system32\wintrust.dll
2012-03-01 05:33 . 2012-04-12 14:39        159232        ----a-w-        c:\windows\system32\imagehlp.dll
2012-03-01 05:29 . 2012-04-12 14:39        5120        ----a-w-        c:\windows\system32\wmi.dll
2012-02-29 23:59 . 2011-11-26 23:10        61248        ----a-w-        c:\windows\system32\OpenCL.dll
2012-02-29 23:59 . 2011-11-26 23:10        5892928        ----a-w-        c:\windows\system32\nvcuda.dll
2012-02-29 23:59 . 2011-11-26 23:10        2517312        ----a-w-        c:\windows\system32\nvcuvid.dll
2012-02-29 23:59 . 2011-11-26 23:10        2437440        ----a-w-        c:\windows\system32\nvcuvenc.dll
2012-02-29 23:59 . 2011-11-26 23:10        2301248        ----a-w-        c:\windows\system32\nvapi.dll
2012-02-29 23:59 . 2011-11-26 23:10        17543488        ----a-w-        c:\windows\system32\nvcompiler.dll
2012-02-29 23:59 . 2011-11-26 23:10        10819392        ----a-w-        c:\windows\system32\drivers\nvlddmkm.sys
2012-02-29 23:59 . 2009-06-10 21:19        15009600        ----a-w-        c:\windows\system32\nvd3dum.dll
2012-02-29 20:56 . 2011-11-26 23:10        3881792        ----a-w-        c:\windows\system32\nvcpl.dll
2012-02-29 20:55 . 2011-11-26 23:10        2719040        ----a-w-        c:\windows\system32\nvsvc.dll
2012-02-29 20:53 . 2011-11-26 23:10        108352        ----a-w-        c:\windows\system32\nvmctray.dll
2012-02-29 20:53 . 2011-11-26 23:10        645440        ----a-w-        c:\windows\system32\nvvsvc.exe
2012-02-29 20:53 . 2011-11-26 23:10        62272        ----a-w-        c:\windows\system32\nvshext.dll
2012-02-28 01:18 . 2012-04-12 14:42        1799168        ----a-w-        c:\windows\system32\jscript9.dll
2012-02-28 01:11 . 2012-04-12 14:42        1427456        ----a-w-        c:\windows\system32\inetcpl.cpl
2012-02-28 01:11 . 2012-04-12 14:42        1127424        ----a-w-        c:\windows\system32\wininet.dll
2012-02-28 01:03 . 2012-04-12 14:42        2382848        ----a-w-        c:\windows\system32\mshtml.tlb
.
.
(((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\snxPluginsShell]
@="{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}"
[HKEY_CLASSES_ROOT\CLSID\{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}]
2010-09-07 15:14        152160        ----a-w-        c:\program files\Alwil Software\Avast5\snxPlugins.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AvastUI.exe"="c:\program files\Alwil Software\Avast5\AvastUI.exe" [2010-09-07 2838912]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoFileAssociate"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 12:21        548352        ----a-w-        c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute        REG_MULTI_SZ          PDBoot.exe\0autocheck autochk *\0ROBoot \??\c:\windows\system32\ASOROSet.bin
.
R2 avast! Firewall;avast! Firewall;c:\program files\Alwil Software\Avast5\afwServ.exe [2010-09-07 119200]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 aswArKrn;aswArKrn;c:\users\---\AppData\Local\Temp\aswArKrn.sys [x]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2010-06-14 36608]
R3 HH10Help.sys;HH10Help.sys;c:\windows\system32\drivers\HH10Help.sys [2008-11-06 18432]
R3 KMWDFILTERx86;HIDServiceDesc;c:\windows\system32\DRIVERS\KMWDFILTER.sys [2009-04-29 25088]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-04-04 22344]
R3 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]
R3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2011-11-01 137600]
R3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2011-11-01 8576]
R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-06-25 35088]
R3 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-02-29 2348352]
R3 PAC7311;Trust Webcam 14839;c:\windows\system32\DRIVERS\PA707UCM.SYS [2005-10-18 154752]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-11-11 7408]
R3 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [2012-02-06 3027840]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe [2010-10-27 1483072]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys [2010-10-07 10064]
R3 VC10SecS;Virtual CD v10 Management Service;c:\program files\Virtual CD v10\System\VC10SecS.exe [2010-02-24 144712]
R4 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2010-07-04 238952]
S0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\DRIVERS\aswNdis.sys [2010-09-07 12112]
S0 aswNdis2;avast! Firewall Core Firewall Service; [x]
S1 aswFW;avast! TDI Firewall driver; [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2009-11-11 9968]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2009-11-11 74480]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768]
S3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\system32\DRIVERS\teamviewervpn.sys [2011-12-16 25088]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-09-28 315392]
.
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
.
------- Supplementary Scan -------
.
IE: Download with FileServe Manager - c:\program files\FileServe Manager\GetUrl.htm
IE: E&xport to Microsoft Excel - c:\progra~1\Microsoft Office\Office12\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: Interfaces\{177994D8-96D5-4F24-AA0A-66B749006129}: NameServer = 208.67.222.222,208.67.220.220
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-05-25  12:03:18
ComboFix-quarantined-files.txt  2012-05-25 10:03
.
Pre-Run: 38,443,749,376 bytes free
Post-Run: 38,367,154,176 bytes free
.
- - End Of File - - 58942FF680F7EB4799245B3A4F4D31D7
--- --- ---


Otl:

http://i.imgur.com/blMyt.jpg

nach dem combofix war der windows startbutton unten links wieder auf standardfarbe, ich hatte mit dem tool "reshack" die farbe geandert gehabt, falls die info was hilft.

Psychotic 27.05.2012 10:01
OK, warte bitte - ich muss mal Rücksprache halten!

ThimoS. 27.05.2012 11:13
in ordnung

Psychotic 28.05.2012 11:35
Klicke Start-->schreibe cmd-->das System wird danach suchen und dir den Eintrag anzeigen. Rechtsklick drauf-->Als Administrator ausführen.

Gib dort einmal folgendes ein:


Code:
net start winmgmt
Danach:

Lösche die vorhandene Combofix, lade eine neue auf den Desktop herunter und führe sie nach Anleitung aus.


Berichte!

ThimoS. 28.05.2012 11:50
Code:
The requested service has already been started.
combofix folgt...

Zitat:
Zitat von PsYcHoTiC (Beitrag 835030)
Lösche die vorhandene Combofix, lade eine neue auf den Desktop herunter und führe sie nach Anleitung aus.
[code]
Combofix Logfile:
Code:
ComboFix 12-05-28.01 - --- 28/05/2012  13:24:53.6.1 - x86
Running from: c:\users\---\Desktop\ComboFix.exe
 * Created a new restore point
.
.
(((((((((((((((((((((((((  Files Created from 2012-04-28 to 2012-05-28  )))))))))))))))))))))))))))))))
.
.
2012-05-28 11:50 . 2012-05-28 11:50        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-05-28 11:14 . 2012-05-28 11:14        56200        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{B925106A-176E-4833-9007-DA752802C034}\offreg.dll
2012-05-27 10:20 . 2010-09-07 14:52        165584        ----a-w-        c:\windows\system32\drivers\aswSP.sys
2012-05-27 10:20 . 2010-09-07 14:47        17744        ----a-w-        c:\windows\system32\drivers\aswFsBlk.sys
2012-05-27 10:20 . 2010-09-07 14:53        340048        ----a-w-        c:\windows\system32\drivers\aswSnx.sys
2012-05-27 10:20 . 2010-09-07 14:54        99792        ----a-w-        c:\windows\system32\drivers\aswFW.sys
2012-05-27 10:20 . 2010-09-07 14:53        190416        ----a-w-        c:\windows\system32\drivers\aswNdis2.sys
2012-05-27 10:20 . 2010-09-07 14:47        23376        ----a-w-        c:\windows\system32\drivers\aswRdr.sys
2012-05-27 10:20 . 2010-09-07 14:52        46672        ----a-w-        c:\windows\system32\drivers\aswTdi.sys
2012-05-27 10:20 . 2010-09-07 14:47        50768        ----a-w-        c:\windows\system32\drivers\aswMonFlt.sys
2012-05-27 10:19 . 2010-09-07 15:12        38848        ----a-w-        c:\windows\avastSS.scr
2012-05-27 10:19 . 2010-09-07 15:11        167592        ----a-w-        c:\windows\system32\aswBoot.exe
2012-05-27 10:19 . 2010-09-07 14:24        12112        ----a-w-        c:\windows\system32\drivers\aswNdis.sys
2012-05-27 10:19 . 2012-05-27 10:19        --------        d-----w-        c:\programdata\Alwil Software
2012-05-27 10:19 . 2012-05-27 10:19        --------        d-----w-        c:\program files\Alwil Software
2012-05-27 10:02 . 2012-05-27 10:02        --------        d-----w-        c:\users\---\AppData\Local\Chromium
2012-05-27 10:02 . 2012-05-27 10:02        --------        d-----w-        c:\program files\SRWare Iron
2012-05-26 23:45 . 2012-05-26 23:45        --------        d-----w-        C:\Boot
2012-05-26 23:28 . 2012-05-26 23:28        335504        ----a-w-        c:\windows\system32\drivers\TrufosAlt.sys
2012-05-25 23:17 . 2012-05-25 23:22        --------        d-----w-        c:\program files\GetFLV
2012-05-25 16:23 . 2012-05-25 16:23        --------        d-----w-        c:\program files\Common Files\logishrd
2012-05-23 20:48 . 2012-05-28 11:50        --------        d-----w-        c:\users\---\AppData\Local\Temp
2012-05-23 13:54 . 2012-05-23 13:55        --------        d-----w-        c:\program files\SUPERAntiSpyware
2012-05-23 13:54 . 2012-05-23 13:54        --------        d-----w-        c:\program files\Common Files\Wise Installation Wizard
2012-05-22 13:12 . 2012-05-22 13:12        --------        d-----w-        c:\users\---\AppData\Roaming\GlarySoft
2012-05-22 13:04 . 2012-05-22 13:04        --------        d-----w-        c:\program files\Uniblue
2012-05-22 12:21 . 2012-05-22 12:21        --------        d-----w-        c:\program files\Glarysoft
2012-05-21 10:12 . 2012-05-21 10:12        --------        d-----w-        c:\program files\Passcape
2012-05-18 11:58 . 2012-05-18 12:03        --------        d-----w-        c:\users\---\AppData\Roaming\Profiles
2012-05-18 11:58 . 2012-05-18 11:58        --------        d-----w-        c:\users\---\AppData\Roaming\Skins
2012-05-18 11:58 . 2012-05-18 11:58        --------        d-----w-        c:\users\---\AppData\Roaming\Settings
2012-05-18 11:58 . 2012-05-18 11:58        --------        d-----w-        c:\users\---\AppData\Roaming\Language
2012-05-10 20:37 . 2012-03-30 10:23        1291632        ----a-w-        c:\windows\system32\drivers\tcpip.sys
2012-05-10 20:37 . 2012-03-31 04:29        936960        ----a-w-        c:\program files\Common Files\Microsoft Shared\Ink\journal.dll
2012-05-10 20:37 . 2012-03-31 04:30        1221632        ----a-w-        c:\program files\Windows Journal\NBDoc.DLL
2012-05-10 20:37 . 2012-03-31 04:29        989184        ----a-w-        c:\program files\Windows Journal\JNTFiltr.dll
2012-05-10 20:37 . 2012-03-31 04:29        969216        ----a-w-        c:\program files\Windows Journal\JNWDRV.dll
2012-05-10 20:37 . 2012-03-31 04:39        3968368        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2012-05-10 20:37 . 2012-03-31 04:39        3913072        ----a-w-        c:\windows\system32\ntoskrnl.exe
2012-05-10 20:37 . 2012-03-31 02:36        2343424        ----a-w-        c:\windows\system32\win32k.sys
2012-05-10 20:36 . 2012-03-17 07:27        56176        ----a-w-        c:\windows\system32\drivers\partmgr.sys
2012-05-10 20:36 . 2012-03-03 05:31        1077248        ----a-w-        c:\windows\system32\DWrite.dll
2012-05-02 18:50 . 2012-05-02 18:50        --------        d-sh--w-        c:\program files\KGB
2012-04-30 21:37 . 2012-04-30 21:37        --------        d-----w-        c:\programdata\NVIDIA Corporation
2012-04-30 21:36 . 2012-02-29 23:59        881984        ----a-w-        c:\windows\system32\nvgenco32.dll
2012-04-30 21:36 . 2012-02-29 23:59        19444544        ----a-w-        c:\windows\system32\nvoglv32.dll
2012-04-30 21:36 . 2012-02-29 23:59        1000256        ----a-w-        c:\windows\system32\nvdispco32.dll
2012-04-28 17:09 . 2012-04-28 17:09        --------        d-----w-        c:\users\---\AppData\Roaming\HD Tune Pro
2012-04-28 17:06 . 2012-04-28 17:09        --------        d-----w-        c:\program files\HDTune
2012-04-28 16:44 . 2012-04-28 16:44        --------        d-----w-        c:\users\---\AppData\Local\Western Digital
2012-04-28 16:36 . 2012-04-28 16:36        --------        d-----w-        c:\users\---\AppData\Roaming\BinarySense
2012-04-28 16:35 . 2012-04-28 16:35        --------        d-----w-        c:\program files\HdLife
2012-04-28 16:35 . 2012-04-28 16:35        --------        d-----w-        c:\program files\Common Files\BinarySense
2012-04-28 15:41 . 2001-08-29 19:00        59904        ----a-w-        c:\windows\system32\wbemdisp.tlb
2012-04-28 15:41 . 1998-07-21 22:00        102160        ----a-w-        c:\windows\system32\VB6KO.DLL
2012-04-28 15:41 . 2012-04-28 15:47        --------        d-----w-        c:\program files\lg_fwupdate
2012-04-28 15:41 . 2012-04-28 15:43        16384        ----a-w-        c:\windows\system32\lgfwunis.exe
2012-04-28 15:41 . 1998-06-23 22:00        115016        ----a-w-        c:\windows\system32\MSINET.OCX
2012-04-28 15:41 . 2001-09-05 01:18        77824        ----a-w-        c:\program files\Common Files\InstallShield\Engine\6\Intel 32\ctor.dll
2012-04-28 15:41 . 2001-09-05 01:18        225280        ------w-        c:\program files\Common Files\InstallShield\IScript\iscript.dll
2012-04-28 15:41 . 2001-09-05 01:14        176128        ------w-        c:\program files\Common Files\InstallShield\Engine\6\Intel 32\iuser.dll
2012-04-28 15:41 . 2001-09-05 01:13        32768        ------w-        c:\program files\Common Files\InstallShield\Engine\6\Intel 32\objectps.dll
2012-04-28 15:41 . 2006-01-10 21:35        614532        ----a-w-        c:\program files\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
2012-04-28 15:32 . 2012-04-28 15:32        --------        d-----w-        c:\program files\DVD Genie
.
.
.
((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-27 10:16 . 2009-07-13 23:40        249856        ----a-w-        c:\windows\system32\uxtheme.dll
2012-05-27 10:16 . 2011-10-29 15:48        2755072        ----a-w-        c:\windows\system32\themeui.dll
2012-05-27 10:16 . 2009-07-13 23:39        37376        ----a-w-        c:\windows\system32\themeservice.dll
2012-05-10 06:54 . 2012-04-17 16:54        419488        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2012-05-10 06:54 . 2011-10-29 18:01        70304        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-04-08 16:35 . 2012-03-24 11:40        60416        ----a-w-        c:\windows\ALCFDRTM.VER
2012-04-04 13:56 . 2011-10-29 20:31        22344        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-03-27 12:54 . 2012-02-06 14:09        637848        ----a-w-        c:\windows\system32\npdeployJava1.dll
2012-03-27 12:54 . 2012-02-06 14:09        567696        ----a-w-        c:\windows\system32\deployJava1.dll
2012-03-24 11:40 . 2012-03-24 11:40        60416        ----a-w-        c:\windows\ALCFDRTM.EXE
2012-03-07 20:40 . 2012-03-07 20:40        1010720        --s---r-        c:\windows\system32\MSCHRT20.OCX
2012-03-01 05:46 . 2012-04-12 14:39        19824        ----a-w-        c:\windows\system32\drivers\fs_rec.sys
2012-03-01 05:37 . 2012-04-12 14:39        172544        ----a-w-        c:\windows\system32\wintrust.dll
2012-03-01 05:33 . 2012-04-12 14:39        159232        ----a-w-        c:\windows\system32\imagehlp.dll
2012-03-01 05:29 . 2012-04-12 14:39        5120        ----a-w-        c:\windows\system32\wmi.dll
2012-02-29 23:59 . 2011-11-26 23:10        61248        ----a-w-        c:\windows\system32\OpenCL.dll
2012-02-29 23:59 . 2011-11-26 23:10        5892928        ----a-w-        c:\windows\system32\nvcuda.dll
2012-02-29 23:59 . 2011-11-26 23:10        2517312        ----a-w-        c:\windows\system32\nvcuvid.dll
2012-02-29 23:59 . 2011-11-26 23:10        2437440        ----a-w-        c:\windows\system32\nvcuvenc.dll
2012-02-29 23:59 . 2011-11-26 23:10        2301248        ----a-w-        c:\windows\system32\nvapi.dll
2012-02-29 23:59 . 2011-11-26 23:10        17543488        ----a-w-        c:\windows\system32\nvcompiler.dll
2012-02-29 23:59 . 2011-11-26 23:10        10819392        ----a-w-        c:\windows\system32\drivers\nvlddmkm.sys
2012-02-29 23:59 . 2009-06-10 21:19        15009600        ----a-w-        c:\windows\system32\nvd3dum.dll
2012-02-29 20:56 . 2011-11-26 23:10        3881792        ----a-w-        c:\windows\system32\nvcpl.dll
2012-02-29 20:55 . 2011-11-26 23:10        2719040        ----a-w-        c:\windows\system32\nvsvc.dll
2012-02-29 20:53 . 2011-11-26 23:10        108352        ----a-w-        c:\windows\system32\nvmctray.dll
2012-02-29 20:53 . 2011-11-26 23:10        645440        ----a-w-        c:\windows\system32\nvvsvc.exe
2012-02-29 20:53 . 2011-11-26 23:10        62272        ----a-w-        c:\windows\system32\nvshext.dll
.
.
(((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\snxPluginsShell]
@="{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}"
[HKEY_CLASSES_ROOT\CLSID\{F4B3B0AA-13D1-4a36-BDA2-2055B0F3D5DE}]
2010-09-07 15:14        152160        ----a-w-        c:\program files\Alwil Software\Avast5\snxPlugins.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoFileAssociate"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 12:21        548352        ----a-w-        c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute        REG_MULTI_SZ          PDBoot.exe\0autocheck autochk *\0ROBoot \??\c:\windows\system32\ASOROSet.bin
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 aswArKrn;aswArKrn;c:\users\---\AppData\Local\Temp\aswArKrn.sys [x]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2010-06-14 36608]
R3 HH10Help.sys;HH10Help.sys;c:\windows\system32\drivers\HH10Help.sys [2008-11-06 18432]
R3 KMWDFILTERx86;HIDServiceDesc;c:\windows\system32\DRIVERS\KMWDFILTER.sys [2009-04-29 25088]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-04-04 22344]
R3 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]
R3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2011-11-01 137600]
R3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2011-11-01 8576]
R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-06-25 35088]
R3 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-02-29 2348352]
R3 PAC7311;Trust Webcam 14839;c:\windows\system32\DRIVERS\PA707UCM.SYS [2005-10-18 154752]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-11-11 7408]
R3 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [2012-02-06 3027840]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe [2010-10-27 1483072]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys [2010-10-07 10064]
R3 VC10SecS;Virtual CD v10 Management Service;c:\program files\Virtual CD v10\System\VC10SecS.exe [2010-02-24 144712]
R4 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2010-07-04 238952]
S0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\DRIVERS\aswNdis.sys [2010-09-07 12112]
S0 aswNdis2;avast! Firewall Core Firewall Service; [x]
S1 aswFW;avast! TDI Firewall driver; [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2009-11-11 9968]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2009-11-11 74480]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-09-07 50768]
S2 avast! Firewall;avast! Firewall;c:\program files\Alwil Software\Avast5\afwServ.exe [2010-09-07 119200]
S3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\system32\DRIVERS\teamviewervpn.sys [2011-12-16 25088]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-09-28 315392]
.
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
.
------- Supplementary Scan -------
.
IE: Download with FileServe Manager - c:\program files\FileServe Manager\GetUrl.htm
IE: E&xport to Microsoft Excel - c:\progra~1\Microsoft Office\Office12\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: Interfaces\{177994D8-96D5-4F24-AA0A-66B749006129}: NameServer = 208.67.222.222,208.67.220.220
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-05-28  13:55:42
ComboFix-quarantined-files.txt  2012-05-28 11:55
.
Pre-Run: 38,494,691,328 bytes free
Post-Run: 38,433,304,576 bytes free
.
- - End Of File - - E3CE2AE28E8C3657B782F9A3F7C88B04
--- --- ---



vielen lieben dank fuer deine hilfe, waere eine neuinstallation nicht doch besser?

Psychotic 29.05.2012 07:25
Wir gehen der Sache gerade auf den Grund...wenn es dir aber lieber ist, das System neu aufzusetzen, damit es schneller geht, teile mir das bitte mit! ;)

Psychotic 29.05.2012 07:41
FSS


Downloade dir bitte Farbar's Service Scanner
  • Starte das Tool mit Doppelklick auf die FSS.exe
  • Gehe sicher, dass folgende Optionen angehakt sind.
    • Internet Services
    • Windows Firewall
    • System Restore
  • Klicke auf Scan.
  • Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.
Poste bitte den Inhalt hier.

ThimoS. 29.05.2012 12:40
in ordnung, ne ich komm klar mit dem system vorerst, werde die ratschlaege hier befolgen, fss log:


Code:
Farbar Service Scanner Version: 27-05-2012
Ran by --- (administrator) on 29-05-2012 at 13:57:19
Running from "C:\Users\---\Desktop"
Windows 7 Enterprise Service Pack 1 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Yahoo IP is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcore.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys => MD5 is legit
C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll => MD5 is legit
C:\Windows\system32\bfe.dll => MD5 is legit
C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll => MD5 is legit
C:\Windows\system32\vssvc.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit


**** End of log ****

Psychotic 30.05.2012 12:56
Systemwiederherstellung


Du musst das System nun in die System Reparatur Option booten. Über den Boot Manager

Starte den Rechner neu auf.
Während dem Hochfahren drücke mehrmals die F8 Taste
Wähle nun Computer reparieren.
Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".

Mit Windows CD/DVD

Lege die Windows CD in dein Laufwerk.
Starte den Rechner neu auf und starte von der CD
Wähle die Spracheinstellungen und klicke "Weiter".
Klicke auf Computerreparaturoptionen !!
Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".


Klicke Systemwiederherstellung-->zu einem früheren Zeitpunkt-->du siehst mehrere Systemwiederherstellungspunkte - Ist der früheste davon aus der Zeit vor der Infektion? Wenn ja, setze das System auf diesen Punkt zurück.

Wenn nein oder beim Auftreten von Problemen: Berichte!

ThimoS. 30.05.2012 14:56
sytemwiederherstellung ist deaktiviert, es existiert kein wiederherstellungspunkt.

Psychotic 30.05.2012 15:18
Dann starte von der Windows-DVD und führe eine Reparaturinstallation aus. Melde dich, wenn du damit fertig bist.

Psychotic 06.06.2012 07:04
Hallo, benötigst Du noch weiterhin Hilfe ? Sollte ich innerhalb der nächsten 24 Stunden keine Antwort von dir erhalten, werde ich dein Thema aus meinen Abos nehmen und bekomme dadurch keine Nachricht über neue Antworten. Das Verschwinden der Symptome bedeutet nicht, dass dein System schon sauber ist

Psychotic 10.06.2012 23:41
Fehlende Rückmeldung
Dieses Thema wurde aus den Abos gelöscht. Somit bekomm ich keine Benachrichtigung über neue Antworten.
PM an mich falls Du denoch weiter machen willst.

Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner schon sauber ist.

Jeder andere bitte hier klicken und einen eigenen Thread erstellen


Alle Zeitangaben in WEZ +1. Es ist jetzt 01:52 Uhr.
Seite 3 von 3 12 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131