Trojaner-Board - TR/TDss.adcr

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - TR/TDss.adcr (https://www.trojaner-board.de/73237-tr-tdss-adcr.html)

PDvaS

17.05.2009 19:48

TR/TDss.adcr

Hallo Leute,

ich hab mir vor zwei Tagen den Trojaner TR/TDss.adcr eingefangen.
AntiVir hat den Trojaner erkannt und gemeldet:

In der Datei 'D:\RECYCLER\S-8-5-80-100011524-100005441-100032622-1396.com'
wurde ein Virus oder unerwünschtes Programm 'TR/TDss.adcr' [trojan] gefunden.

In der Datei 'C:\ProgramData\Avira\AntiVir Desktop\TEMP\AVSCAN-20090517-190424-F20CF501\AVSCAN-20090517-190436-FC0E921A'
wurde ein Virus oder unerwünschtes Programm 'TR/TDss.adcr' [trojan] gefunden.

In der Datei 'C:\Users\PDvaS\AppData\Local\Temp\tmpB06C.tmp'
wurde ein Virus oder unerwünschtes Programm 'TR/Alureon.BH.8' [trojan] gefunden.

Ich hab die Trojaner sofort in die Quarantäne gepackt und dachte das Problem sei damit gelöst, aber nun bekomm ich ständig neue Warnmeldungen von AntiVir.

Malwarebytes-Anti-Malware hat nichts gefunden.

HiJackThis Log

Code:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 20:00:34, on 17.05.2009

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18226)

Boot mode: Normal
 

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Explorer.EXE

C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe

C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe

C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\McAfee.com\Agent\mcagent.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Program Files\HiJackThis\HijackThis.exe
 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p:\\www.samsungcomputer.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.jappy.de/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p:\\www.samsungcomputer.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 

O1 - Hosts: ::1 localhost

O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll

O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files\Hotspot Shield\hssie\HssIE.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')

O4 - Global Startup: BTTray.lnk = ?

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O13 - Gopher Prefix: 

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - h**p://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - h**p://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{139E993A-1EC2-464B-82F1-A70231E80AEF}: NameServer = 85.255.112.100,85.255.112.197

O17 - HKLM\System\CCS\Services\Tcpip\..\{AC96074A-9C8B-4AA4-A03A-132C75B97FAF}: NameServer = 85.255.112.100,85.255.112.197

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.100,85.255.112.197

O17 - HKLM\System\CS1\Services\Tcpip\..\{139E993A-1EC2-464B-82F1-A70231E80AEF}: NameServer = 85.255.112.100,85.255.112.197

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.100,85.255.112.197

O17 - HKLM\System\CS2\Services\Tcpip\..\{139E993A-1EC2-464B-82F1-A70231E80AEF}: NameServer = 85.255.112.100,85.255.112.197

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.100,85.255.112.197

O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe

O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\openvpnas.exe

O23 - Service: Hotspot Shield Helper Service (HssSrv) - AnchorFree Inc. - C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe

O23 - Service: Hotspot Shield Tray Service (HssTrayService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\HssTrayService.EXE

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe

O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe

O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

O23 - Service: Samsung Update Plus - Unknown owner - C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exe

O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe

O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe
 

--

End of file - 7696 bytes

Installierte Programme

Code:

2007 Microsoft Office system

Activation Assistant for the 2007 Microsoft Office suites

Adobe Flash Player 10 Plugin

Adobe Flash Player ActiveX

Adobe Reader 8.1.0 - Deutsch

Agere Systems HDA Modem

ALUpdate

AMD USB Audio Driver Filter

Atheros WLAN Client

ATI PCI Express (3GIO) Filter Driver

Avira AntiVir Personal - Free Antivirus

AVS Update Manager 1.0

Business Contact Manager für Outlook 2007

Business Contact Manager für Outlook 2007

Catalyst Control Center - Branding

CCleaner (remove only)

Choice Guard

CorelDRAW Graphics Suite 12

CyberLink DVD Suite

CyberLink Power2Go

DivX Web Player

Easy Battery Manager

Easy Display Manager

Easy Network Manager 4.0

Easy SpeedUp Manager

FIFA 09

Free FLV Converter V 6.23.0

GeoGebra

HijackThis 2.0.2

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Hotspot Shield 1.15

imagine digital freedom - Samsung

Java(TM) 6 Update 13

LabelPrint

LightScribe System Software  1.12.37.1

MAGIX Music Maker Hip Hop Edition 2 4.0.0.10 (D)

Malwarebytes' Anti-Malware

Marvell Miniport Driver

McAfee SecurityCenter

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 3.5 SP1

Microsoft Office 2003 Web Components

Microsoft Office 2007 Primary Interop Assemblies

Microsoft Office Access MUI (German) 2007

Microsoft Office Excel MUI (German) 2007

Microsoft Office Outlook MUI (German) 2007

Microsoft Office PowerPoint MUI (German) 2007

Microsoft Office Professional Hybrid 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (German) 2007

Microsoft Office Proof (Italian) 2007

Microsoft Office Proofing (German) 2007

Microsoft Office Publisher MUI (German) 2007

Microsoft Office Shared MUI (German) 2007

Microsoft Office Small Business Connectivity Components

Microsoft Office Word MUI (German) 2007

Microsoft Picture It! Foto Premium 10

Microsoft SOAP Toolkit 2.0 SP2

Microsoft SQL Server 2005

Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)

Microsoft SQL Server Native Client

Microsoft SQL Server VSS Writer

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

MoviesPlay

Mozilla Firefox (3.0.10)

MSVCRT

MSXML 4.0 SP2 (KB954430)

PlayCamera

PowerDirector

PowerDVD

PowerProducer

Realtek High Definition Audio Driver

Samsung Magic Doctor

Samsung Recovery Solution III

Samsung Update Plus

Steinberg Cubase LE 4

Synaptics Pointing Device Driver

Syncrosoft Lizenz Kontrolle

Techno4ever Player

Tsunami-Filter-Pack

TuneUp Utilities 2009

Ultra AVI Converter 4.4.0529

Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)

Update for Office 2007 (KB934528)

Update for Office System 2007 Setup (KB929722)

US-122L / US-144 driver

User Guide

VC80CRTRedist - 8.0.50727.762

Vimicro UVC Camera

Virtual DJ - Atomix Productions

Vista Codec Package

VLC media player 0.9.9

WIDCOMM Bluetooth Software 6.0.1.6300

Windows Live Anmelde-Assistent

Windows Live Call

Windows Live Communications Platform

Windows Live Essentials

Windows Live Essentials

Windows Live Messenger

Windows Live OneCare safety scanner

Windows Live OneCare safety scanner

Windows Live-Uploadtool

Windows Media Player Firefox Plugin

WinRAR

Zattoo 3.3.3 Beta

Ich hoffe ihr könnt mir helfen.
Schonmal Danke im vorraus, PDvaS

.keNNy#

18.05.2009 14:42

Hallo und:hallo:

Arbeite bitte Punkt 2a-d ab. Du findest ihn unter "Zuerst einmal" in meiner Signatur.

ABER: ACHTUNG DEIN KOMPLETTES INTERNET WIRD ÜBER DIE UKRAINE UMGELEITET
Generell ist das Neuaufsetzen zu empfehlen, da dieser Schritt einfach viel sicherer ist, führe trd bitte Punkt 2a-d durch.
Gib bitte keine wichtigen Passwörter wie von Onlinebanking etc mehr ein und ändere bitte alle deine Passwörter von einem SICHEREN
Rechner aus.
Das du umgeleitet wirst sieht man an den O17 Einträgen von HijackThis.

Zitat:

O17 - HKLM\System\CCS\Services\Tcpip\..\{139E993A-1EC2-464B-82F1-A70231E80AEF}: NameServer = 85.255.112.100,85.255.112.197
O17 - HKLM\System\CCS\Services\Tcpip\..\{AC96074A-9C8B-4AA4-A03A-132C75B97FAF}: NameServer = 85.255.112.100,85.255.112.197
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.100,85.255.112.197
O17 - HKLM\System\CS1\Services\Tcpip\..\{139E993A-1EC2-464B-82F1-A70231E80AEF}: NameServer = 85.255.112.100,85.255.112.197
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.100,85.255.112.197
O17 - HKLM\System\CS2\Services\Tcpip\..\{139E993A-1EC2-464B-82F1-A70231E80AEF}: NameServer = 85.255.112.100,85.255.112.197
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.100,85.255.112.197

Beschreibung zu der IP

Zitat:

85.255.112.100
org-name: UkrTeleGroup Ltd.
address: UkrTeleGroup Ltd.
address: Mechnikova 58/5 65029 Odessa

Kopfhoch:kloppen:

.keNNy#

PDvaS

18.05.2009 18:40

Danke für deine Antwort. Ich werde die Punkte durchführen.

Du sagtes, dass mein komplettes Internet umgeleitet wird. Bedeutet das, dass ich auf meinen anderen Rechner(virenfrei), der die gleiche Internetverbindung nutzt, auch kein online-banking dürchführen darf?

.keNNy#

18.05.2009 18:51

Ich bin mir nicht sicher. Ich würde es vlt vorsichtshalber von dem auch kein Banking machen.
Kannst auf dem "Sauberen" mal HijackThis laufen lassen und das log dann posten. Aber bitte dann dazu sagen das es von dem anderen ist.
Also Punkt 2a-d und HijackThis auf dem anderen Rechner.

.keNNy#

PDvaS

19.05.2009 11:04

So da bin ich wieder:)

Ich hab jetzt die Schritte 2 a) - d) wie beschrieben an meinen infizierten Rechner durchgeführt.

zu b)

Code:

Malwarebytes' Anti-Malware 1.36

Datenbank Version: 1945

Windows 6.0.6001 Service Pack 1
 

19.05.2009 11:31:29

mbam-log-2009-05-19 (11-31-29).txt
 

Scan-Methode: Vollständiger Scan (C:\|D:\|)

Durchsuchte Objekte: 197835

Laufzeit: 3 hour(s), 35 minute(s), 38 second(s)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 2

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 3

Infizierte Verzeichnisse: 2

Infizierte Dateien: 2
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

HKEY_CURRENT_USER\SOFTWARE\MoviesPlay (Trojan.DNSChanger) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MoviesPlay (Trojan.DNSChanger) -> Quarantined and deleted successfully.
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.100,85.255.112.197 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{139e993a-1ec2-464b-82f1-a70231e80aef}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.100,85.255.112.197 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{ac96074a-9c8b-4aa4-a03a-132c75b97faf}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.100,85.255.112.197 -> Quarantined and deleted successfully.
 

Infizierte Verzeichnisse:

C:\Users\PDvaS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MoviesPlay (Trojan.DNSChanger) -> Quarantined and deleted successfully.

C:\Program Files\MoviesPlay (Trojan.DNSChanger) -> Quarantined and deleted successfully.
 

Infizierte Dateien:

C:\Users\PDvaS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MoviesPlay\Uninstall.lnk (Trojan.DNSChanger) -> Quarantined and deleted successfully.

C:\Program Files\MoviesPlay\Uninstall.exe (Trojan.DNSChanger) -> Quarantined and deleted successfully.

zu c)

Code:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:46:31, on 19.05.2009

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18226)

Boot mode: Normal
 

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe

C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe

C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\McAfee.com\Agent\mcagent.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.jappy.de/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 

O1 - Hosts: ::1 localhost

O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll

O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files\Hotspot Shield\hssie\HssIE.dll

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - Global Startup: BTTray.lnk = ?

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O13 - Gopher Prefix: 

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - h**p://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - h**p://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - h**p://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe

O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\openvpnas.exe

O23 - Service: Hotspot Shield Helper Service (HssSrv) - AnchorFree Inc. - C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe

O23 - Service: Hotspot Shield Tray Service (HssTrayService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\HssTrayService.EXE

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe

O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe

O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

O23 - Service: Samsung Update Plus - Unknown owner - C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exe

O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe

O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe

O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe
 

--

End of file - 6821 bytes

zu d)

Code:

2007 Microsoft Office system

Activation Assistant for the 2007 Microsoft Office suites

Adobe Flash Player 10 Plugin

Adobe Flash Player ActiveX

Adobe Reader 8.1.0 - Deutsch

Agere Systems HDA Modem

ALUpdate

AMD USB Audio Driver Filter

Atheros WLAN Client

ATI PCI Express (3GIO) Filter Driver

Avira AntiVir Personal - Free Antivirus

AVS Update Manager 1.0

Business Contact Manager für Outlook 2007

Business Contact Manager für Outlook 2007

Catalyst Control Center - Branding

CCleaner (remove only)

Choice Guard

CorelDRAW Graphics Suite 12

CyberLink DVD Suite

CyberLink Power2Go

DivX Web Player

Easy Battery Manager

Easy Display Manager

Easy Network Manager 4.0

Easy SpeedUp Manager

FIFA 09

Free FLV Converter V 6.23.0

GeoGebra

HijackThis 2.0.2

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Hotspot Shield 1.15

imagine digital freedom - Samsung

Java(TM) 6 Update 13

LabelPrint

LightScribe System Software  1.12.37.1

MAGIX Music Maker Hip Hop Edition 2 4.0.0.10 (D)

Malwarebytes' Anti-Malware

Marvell Miniport Driver

McAfee SecurityCenter

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 3.5 SP1

Microsoft Office 2003 Web Components

Microsoft Office 2007 Primary Interop Assemblies

Microsoft Office Access MUI (German) 2007

Microsoft Office Excel MUI (German) 2007

Microsoft Office Outlook MUI (German) 2007

Microsoft Office PowerPoint MUI (German) 2007

Microsoft Office Professional Hybrid 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (German) 2007

Microsoft Office Proof (Italian) 2007

Microsoft Office Proofing (German) 2007

Microsoft Office Publisher MUI (German) 2007

Microsoft Office Shared MUI (German) 2007

Microsoft Office Small Business Connectivity Components

Microsoft Office Word MUI (German) 2007

Microsoft Picture It! Foto Premium 10

Microsoft SOAP Toolkit 2.0 SP2

Microsoft SQL Server 2005

Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)

Microsoft SQL Server Native Client

Microsoft SQL Server VSS Writer

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Mozilla Firefox (3.0.10)

MSVCRT

MSXML 4.0 SP2 (KB954430)

PlayCamera

PowerDirector

PowerDVD

PowerProducer

Realtek High Definition Audio Driver

Samsung Magic Doctor

Samsung Recovery Solution III

Samsung Update Plus

Spybot - Search & Destroy

Steinberg Cubase LE 4

Synaptics Pointing Device Driver

Syncrosoft Lizenz Kontrolle

Techno4ever Player

Tsunami-Filter-Pack

TuneUp Utilities 2009

Ultra AVI Converter 4.4.0529

Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)

Update for Office 2007 (KB934528)

Update for Office System 2007 Setup (KB929722)

US-122L / US-144 driver

User Guide

VC80CRTRedist - 8.0.50727.762

Vimicro UVC Camera

Virtual DJ - Atomix Productions

Vista Codec Package

VLC media player 0.9.9

WIDCOMM Bluetooth Software 6.0.1.6300

Windows Live Anmelde-Assistent

Windows Live Call

Windows Live Communications Platform

Windows Live Essentials

Windows Live Essentials

Windows Live Messenger

Windows Live OneCare safety scanner

Windows Live OneCare safety scanner

Windows Live-Uploadtool

Windows Media Player Firefox Plugin

WinRAR

Zattoo 3.3.3 Beta

Bei meinen anderen Rechner bin ich noch nicht dazu gekommen, diese 4 schritte durchzuführen, um zu testen ob er eventuell auch gefährdet ist. Ich werde es aber demnächst hier rein posten.

PDvaS

19.05.2009 11:52

So ich habe jetzt die Schritte auf meinen anderen Rechner durchgeführt, der eigentlich sauber sein sollte.

zu b)

Code:

Malwarebytes' Anti-Malware 1.36

Datenbank Version: 2147

Windows 5.1.2600 Service Pack 3
 

19.05.2009 12:42:16

mbam-log-2009-05-19 (12-42-16).txt
 

Scan-Methode: Vollständiger Scan (C:\|E:\|F:\|G:\|H:\|J:\|)

Durchsuchte Objekte: 152309

Laufzeit: 41 minute(s), 40 second(s)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 0
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

(Keine bösartigen Objekte gefunden)

zu c)

Code:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:44:23, on 19.05.2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Programme\Java\jre6\bin\jqs.exe

C:\Programme\Kodak\printer\center\KodakSvc.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\nvsvc32.exe

C:\Programme\Olivetti\ANY_WAY\olMntrService.exe

C:\WINDOWS\System32\svchost.exe

C:\Programme\TeamViewer\TeamViewer.exe

C:\Programme\DynGate\DynGate.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\System32\wbem\wmiapsrv.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe

C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Programme\Olivetti\ANY_WAY\olDvcStatus.exe

C:\Programme\Java\jre6\bin\jusched.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Programme\Java\jre6\bin\jucheck.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Programme\Mozilla Firefox\firefox.exe

C:\Programme\Trend Micro\HijackThis\HijackThis.exe
 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.google.de/

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Programme\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe"  -osboot

O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [TeamViewer] "C:\Programme\TeamViewer\TeamViewer.exe" -servicehelper

O4 - HKLM\..\Run: [OlStatusMon] "C:\Programme\Olivetti\ANY_WAY\olDvcStatus.exe" dvcStatusMinimize

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - h**p://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1229723148750

O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Programme\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll

O23 - Service: Avira AntiVir Personal - Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe

O23 - Service: Kodak AiO Device Service (KodakSvc) - Eastman Kodak Company - C:\Programme\Kodak\printer\center\KodakSvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: olMntrService - Olivetti - C:\Programme\Olivetti\ANY_WAY\olMntrService.exe

O23 - Service: TeamViewer Remote Control (TeamViewer) - TeamViewer GmbH - C:\Programme\TeamViewer\TeamViewer.exe
 

--

End of file - 6290 bytes

zu d)

Code:

Adobe Flash Player 10 ActiveX

Adobe Reader 7.0.7 - Deutsch

aiofw

aioocr

aioprnt

aioscnnr

Avira AntiVir Personal - Free Antivirus

AVS Update Manager 1.0

AVS Video Converter 6

AVS4YOU Software Navigator 1.3

Big Fish Games Client

CCleaner (remove only)

center

CorelDRAW Graphics Suite 12

CuteFTP 7 Professional

Die Sims™ 2 Haustiere

Driver Genius Professional Edition 2007

DynGate

Google Toolbar for Internet Explorer

Google Toolbar for Internet Explorer

Help_CTR

helptut

helpug

HijackThis 2.0.2

Hotfix für Windows XP (KB952287)

Jasc Paint Shop Photo Album 5

Java(TM) 6 Update 11

KODAK All-in-One-Druckersoftware

ksdip

Malwarebytes' Anti-Malware

Microsoft .NET Framework 2.0

Microsoft Office Professional Edition 2003

Microsoft Visual C++ 2005 Redistributable

Mozilla Firefox (3.0.10)

MSXML 4.0 SP2 (KB954430)

netbrdg

NVIDIA Drivers

RealPlayer

Realtek AC'97 Audio

REALTEK GbE & FE Ethernet PCI NIC Driver

Sandlot Games Client Services 1.2.2

SFR

Sicherheitsupdate für Windows Media Player (KB952069)

Sicherheitsupdate für Windows Media Player 8 (KB917734)

Sicherheitsupdate für Windows XP (KB923561)

Sicherheitsupdate für Windows XP (KB938464-v2)

Sicherheitsupdate für Windows XP (KB946648)

Sicherheitsupdate für Windows XP (KB950760)

Sicherheitsupdate für Windows XP (KB950762)

Sicherheitsupdate für Windows XP (KB950974)

Sicherheitsupdate für Windows XP (KB951066)

Sicherheitsupdate für Windows XP (KB951376-v2)

Sicherheitsupdate für Windows XP (KB951698)

Sicherheitsupdate für Windows XP (KB951748)

Sicherheitsupdate für Windows XP (KB952004)

Sicherheitsupdate für Windows XP (KB952954)

Sicherheitsupdate für Windows XP (KB954600)

Sicherheitsupdate für Windows XP (KB955069)

Sicherheitsupdate für Windows XP (KB956572)

Sicherheitsupdate für Windows XP (KB956802)

Sicherheitsupdate für Windows XP (KB956803)

Sicherheitsupdate für Windows XP (KB956841)

Sicherheitsupdate für Windows XP (KB957097)

Sicherheitsupdate für Windows XP (KB958215)

Sicherheitsupdate für Windows XP (KB958644)

Sicherheitsupdate für Windows XP (KB958687)

Sicherheitsupdate für Windows XP (KB958690)

Sicherheitsupdate für Windows XP (KB959426)

Sicherheitsupdate für Windows XP (KB960225)

Sicherheitsupdate für Windows XP (KB960714)

Sicherheitsupdate für Windows XP (KB960715)

Sicherheitsupdate für Windows XP (KB960803)

Sicherheitsupdate für Windows XP (KB961373)

Sicherheitsupdate für Windows XP (KB963027)

TeamViewer

The Sims 2

The Sims 2 University

Tinypic 3.14

Update für Windows XP (KB955839)

Update für Windows XP (KB967715)

VLC media player 0.9.7

Windows Imaging Component

Windows Live Messenger

Windows Media Format 11 runtime

Windows Media Format 11 runtime

Windows XP Service Pack 3

WinRAR

also wie gesagt, hierbei handelt es sich jetzt um dem "Sauberen" Rechner.

PDvaS

.keNNy#

19.05.2009 15:04

Ok
Scanne den anderen Rechner mit SUPERAntispyware. Den sauberen kannste weglassen.
Du hattest einen Trojaner der deine DNS geändert hat und deswegen wurde die Umleitung über die Ukraine ermöglicht sag ich mal. Kennst du dieses Programm?

Zitat:

MoviesPlay

Das sicherste wäre das Neuaufsetzen deines PC's.
Führe dieses Tool aus MBR.exe. Bei Vista Rechtsklick drauf und als Admin ausführen. Das Log bitte posten.
Neuaufsetzen bitte nach dieser Anleitung: Anleitung: Neuaufsetzen des Systems + Absicherung
Eine Bereinigung wäre sicherlich möglich aber es ist unsicherer.
Beachte bitte bei der Sicherung der Daten diesen Link. Dateiendungen
Die Dateien die dort aufgelistet sind bitte NICHT sichern.

.keNNy#

PDvaS

19.05.2009 19:40

Ich hab jetzt mein Rechner mit SUPERAntiSpyware gescannt, so wie es hier auf dem Board erklärt wird.

Hier das Log dazu:

Code:

SUPERAntiSpyware Scan Log

h**p://www.superantispyware.com
 

Generated 05/19/2009 at 06:12 PM
 

Application Version : 4.26.1002
 

Core Rules Database Version : 3900

Trace Rules Database Version: 1846
 

Scan type       : Complete Scan

Total Scan Time : 01:16:44
 

Memory items scanned      : 705

Memory threats detected   : 0

Registry items scanned    : 8433

Registry threats detected : 0

File items scanned        : 121483

File threats detected     : 6
 

Adware.Tracking Cookie

        C:\Users\PDvaS\AppData\Roaming\Microsoft\Windows\Cookies\pdvas@atdmt[1].txt
 

Adware.Vundo/Variant-MSFake

        C:\PROGRAM FILES\TSUNAMI-FILTER-PACK\GRAPHEDT.EXE

        C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\TSUNAMI-FILTER-PACK\FILTER GRAPH EDITOR 021204.LNK
 

Trojan.Downloader-Gen/Suspicious

        C:\USERS\PDVAS\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\WPNN7FZD.DEFAULT\CACHE\E4009E29D01

        C:\USERS\PDVAS\DESKTOP\MBR.EXE

        C:\Windows\Prefetch\MBR.EXE-5744DBFA.pf

Ist das Neuaufsetzen wirklich notwendig oder kann ich das auch iwie vermeiden?

Mfg PDvaS

.keNNy#

19.05.2009 20:24

Naja sagen wir mal so. Es ist einfach viel sicherer und wird oftmals geraten bei DNS-Changern.
Du kannst natürlich einen Kompetenzler per PN mal bitten sich das ganze anzugucken. Vielleicht kann er dein System wieder "flicken":uglyhammer:
Ich empfehle dir mal john.doe zu kontaktieren.
Frag ihn einfach mal ganz lieb ob er sich das mal angucken kann und vergiss das BITTE nicht;)

mfg .keNNy#

PDvaS

19.05.2009 22:52

hehe ok werd ich machen.

Also vielen dank, dass du deine zeit geopfert hast und mir bis hier hin geholfen hast.

Top:daumenhoc

Mfg PDvaS

john.doe

22.05.2009 19:53

Falls du noch irgendetwas hast, dass du mit dem Computer verbindest, wie Speicherkarten, USB-Sticks, externe Festplatten, ... dann stecke alles an.

ComboFix

Achtung: Die Anleitung ist veraltet. Den Teil mit der Systemwiederherstellungskonsole nicht ausführen. Die wird bei Internetverbindung automatisch installiert.

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir das Tool hier herunter auf den Desktop -> KLICK

Das Programm jedoch noch nicht starten sondern zuerst folgendes tun:

Schliesse alle Anwendungen und Programme, vor allem deine Antiviren-Software und andere Hintergrundwächter, sowie deinen Internetbrowser.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

Starte nun die combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen und lass dein System durchsuchen.

Sollte sich ComboFix nicht starten lassen, dann benenne es um in cofi.exe und versuche es nocheinmal.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte abkopieren und in deinen Beitrag einfügen. Das log findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Hinweis: Combofix verhindert die Autostart Funktion aller CD / DVD und USB - Laufwerken um so eine Verbeitung einzudämmen. Wenn es hierdurch zu Problemen kommt, diese im Thread posten.

ciao, andreas

PDvaS

23.05.2009 12:02

Hallo john.doe

erstmal danke, dass du dich gemeldet hast:)

Hier mein Combofix log:

Code:

ComboFix 09-05-22.07 - PDvaS 23.05.2009 12:40.2 - NTFSx86

Microsoft® Windows Vista™ Home Premium   6.0.6001.1.1252.49.1031.18.3294.2392 [GMT 2:00]

ausgeführt von:: c:\users\PDvaS\Desktop\ComboFix.exe

SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

 * Resident AV is active
 

.
 

(((((((((((((((((((((((   Dateien erstellt von 2009-04-23 bis 2009-05-23  ))))))))))))))))))))))))))))))

.
 

2009-05-23 10:44 . 2009-05-23 10:44        --------        d-----w        c:\users\PDvaS\AppData\Local\temp

2009-05-21 14:15 . 2009-05-06 09:06        4784464        ----a-w        c:\programdata\Microsoft\Windows Defender\Definition Updates\{AB279D11-682B-4925-9232-08CCAE23C2A4}\mpengine.dll

2009-05-20 18:12 . 2008-10-23 11:08        130424        ----a-w        c:\windows\system32\drivers\Mpfp.sys

2009-05-20 18:12 . 2009-05-20 18:12        --------        d-----w        c:\program files\Common Files\McAfee

2009-05-20 18:11 . 2009-05-20 18:12        --------        d-----w        c:\program files\McAfee.com

2009-05-20 18:11 . 2009-05-21 14:03        --------        d-----w        c:\program files\McAfee

2009-05-19 14:49 . 2009-05-23 09:59        117760        ----a-w        c:\users\PDvaS\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL

2009-05-19 14:47 . 2009-05-19 14:47        --------        d-----w        c:\programdata\SUPERAntiSpyware.com

2009-05-19 14:46 . 2009-05-19 14:46        --------        d-----w        c:\program files\SUPERAntiSpyware

2009-05-19 14:46 . 2009-05-19 14:46        --------        d-----w        c:\users\PDvaS\AppData\Roaming\SUPERAntiSpyware.com

2009-05-19 14:45 . 2009-05-19 14:45        --------        d-----w        c:\program files\Common Files\Wise Installation Wizard

2009-05-18 19:48 . 2009-05-20 18:34        --------        d-----w        c:\programdata\Spybot - Search & Destroy

2009-05-18 19:48 . 2009-05-20 18:33        --------        d-----w        c:\program files\Spybot - Search & Destroy

2009-05-18 19:48 . 2009-04-06 13:32        38496        ----a-w        c:\windows\system32\drivers\mbamswissarmy.sys

2009-05-18 19:47 . 2009-05-18 19:47        2967799        ----a-w        c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

2009-05-18 19:43 . 2009-05-18 19:44        --------        d-----w        C:\fixwareout

2009-05-18 10:49 . 2009-05-18 10:49        3176        ---ha-w        C:\aaw7boot.cmd

2009-05-18 02:00 . 2009-05-18 11:01        --------        d-----w        c:\programdata\Lavasoft

2009-05-17 11:51 . 2009-05-17 11:51        --------        d-----w        c:\users\PDvaS\AppData\Roaming\Malwarebytes

2009-05-17 11:51 . 2009-05-17 11:51        --------        d-----w        c:\programdata\Malwarebytes

2009-05-17 11:51 . 2009-04-06 13:32        15504        ----a-w        c:\windows\system32\drivers\mbam.sys

2009-05-17 11:51 . 2009-05-19 09:33        --------        d-----w        c:\program files\Malwarebytes' Anti-Malware

2009-05-17 11:21 . 2009-05-17 17:56        --------        d-----w        c:\program files\trend micro

2009-05-17 11:21 . 2009-05-17 11:21        --------        d-----w        C:\rsit

2009-05-15 19:35 . 2009-03-09 16:34        971776        ----a-w        c:\users\PDvaS\AppData\Roaming\Mozilla\Firefox\Profiles\wpnn7fzd.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000006.dll

2009-05-15 19:30 . 2009-05-15 19:32        --------        d-----w        c:\program files\Hotspot Shield

2009-05-05 11:42 . 2009-05-05 11:42        604416        ----a-w        c:\windows\system32\TUProgSt.exe

2009-05-05 11:42 . 2009-03-20 14:01        17152        ----a-w        c:\windows\system32\authuitu.dll

2009-05-05 11:42 . 2009-03-20 14:01        28416        ----a-w        c:\windows\system32\uxtuneup.dll

2009-05-05 11:42 . 2009-05-05 11:42        360704        ----a-w        c:\windows\system32\TuneUpDefragService.exe

2009-05-04 10:44 . 2009-05-04 10:44        --------        d-----w        c:\users\PDvaS\AppData\Roaming\vlc

2009-04-29 17:43 . 2009-04-29 17:43        680        ----a-w        c:\users\PDvaS\AppData\Local\d3d9caps.dat

2009-04-23 11:05 . 2009-04-23 11:05        --------        d-----w        c:\program files\VistaCodecPack

2009-04-23 11:04 . 2009-04-23 11:04        --------        d-----w        c:\programdata\VistaCodecs

2009-04-23 10:54 . 2009-04-23 10:54        --------        d-----w        c:\windows\system32\iosubsys

2009-04-23 10:54 . 1999-09-10 10:06        5600        ----a-w        c:\windows\system32\WINASPI.DLL

2009-04-23 10:54 . 1999-09-10 10:06        5600        ----a-w        c:\windows\system\WINASPI.DLL

2009-04-23 10:54 . 1999-09-10 10:06        4672        ----a-w        c:\windows\system\WOWPOST.EXE

2009-04-23 10:54 . 1999-09-10 10:06        45056        ----a-w        c:\windows\system32\WNASPI32.DLL

2009-04-23 10:54 . 1999-09-10 10:06        25244        ----a-w        c:\windows\system32\drivers\ASPI32.SYS

2009-04-23 10:54 . 2009-04-23 10:54        --------        d-----w        c:\program files\VirtualDub

2009-04-23 10:54 . 2009-04-23 10:54        --------        d-----w        c:\program files\Avisynth

2009-04-23 10:54 . 2002-07-31 07:28        239224        ----a-w        c:\windows\system32\unicows.dll

2009-04-23 10:54 . 2009-04-23 10:54        --------        d-----w        c:\windows\system32\languages

2009-04-23 10:54 . 1998-11-18 13:33        144384        ----a-w        c:\windows\system32\Iacenc.dll

2009-04-23 10:53 . 1993-11-17 22:00        77664        ----a-w        c:\windows\system32\IR21_R.DLL

2009-04-23 10:53 . 2002-05-17 18:44        1306624        ----a-w        c:\windows\system32\divx.dll

2009-04-23 10:53 . 2009-05-19 18:20        --------        d-----w        c:\program files\Tsunami-Filter-Pack
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-05-23 10:35 . 2008-09-01 07:57        675412        ----a-w        c:\windows\system32\perfh007.dat

2009-05-23 10:35 . 2008-09-01 07:57        146368        ----a-w        c:\windows\system32\perfc007.dat

2009-05-22 19:09 . 2008-09-02 03:43        12        ----a-w        c:\windows\bthservsdp.dat

2009-05-20 18:16 . 2008-09-01 12:28        --------        d-----w        c:\programdata\McAfee

2009-05-18 17:04 . 2009-02-26 14:47        --------        d-----w        c:\program files\CCleaner

2009-05-13 20:26 . 2006-11-02 11:18        --------        d-----w        c:\program files\Windows Mail

2009-05-05 11:42 . 2009-02-26 14:58        --------        d-----w        c:\program files\TuneUp Utilities 2009

2009-04-27 16:25 . 2009-03-19 11:44        96104        ----a-w        c:\windows\system32\drivers\avipbb.sys

2009-04-27 16:25 . 2009-03-19 11:44        55640        ----a-w        c:\windows\system32\drivers\avgntflt.sys

2009-04-23 10:53 . 2008-09-01 11:46        --------        d--h--w        c:\program files\InstallShield Installation Information

2009-04-17 11:27 . 2009-03-09 20:38        --------        d-----w        c:\program files\Common Files\AVSMedia

2009-04-17 11:27 . 2009-03-09 20:37        --------        d-----w        c:\program files\AVS4YOU

2009-04-06 01:18 . 2009-04-06 01:18        84480        ----a-w        c:\windows\system32\ff_vfw.dll

2009-04-04 08:44 . 2009-03-01 17:21        --------        d-----w        c:\program files\Free FLV Converter

2009-04-03 18:18 . 2009-04-03 18:18        33256        ----a-w        c:\windows\system32\drivers\HssDrv.sys

2009-03-30 17:27 . 2009-03-01 17:57        --------        d-----w        c:\program files\Java

2009-03-29 23:57 . 2009-03-29 23:57        62149        ----a-w        c:\windows\system32\pthreadGC2.dll

2009-03-28 10:17 . 2009-02-26 10:53        126312        ----a-w        c:\users\PDvaS\AppData\Local\GDIPFONTCACHEV1.DAT

2009-03-28 10:17 . 2009-03-28 10:17        --------        d-----w        c:\users\PDvaS\AppData\Roaming\Corel

2009-03-28 10:14 . 2009-03-28 10:14        --------        d-----w        c:\program files\Common Files\Corel

2009-03-28 10:14 . 2008-09-01 11:50        --------        d-----w        c:\program files\Common Files\InstallShield

2009-03-28 10:13 . 2009-03-28 10:13        --------        d-----w        c:\program files\Corel

2009-03-27 20:29 . 2009-03-27 20:28        --------        d-----w        c:\program files\Microsoft Picture It! 10

2009-03-27 18:36 . 2009-03-01 17:21        290816        ----a-w        c:\windows\system32\TubeFinder.exe

2009-03-25 11:57 . 2009-03-25 11:10        --------        d-----w        c:\program files\EA Sports

2009-03-25 11:20 . 2009-03-25 11:20        --------        d-----w        c:\users\PDvaS\AppData\Roaming\Leadertech

2009-03-25 09:06 . 2008-09-01 12:29        40552        ----a-w        c:\windows\system32\drivers\mfesmfk.sys

2009-03-25 09:06 . 2008-09-01 12:29        79880        ----a-w        c:\windows\system32\drivers\mfeavfk.sys

2009-03-25 09:06 . 2008-09-01 12:29        35272        ----a-w        c:\windows\system32\drivers\mfebopk.sys

2009-03-25 09:06 . 2008-09-01 12:29        214024        ----a-w        c:\windows\system32\drivers\mfehidk.sys

2009-03-25 09:05 . 2008-09-01 12:29        34216        ----a-w        c:\windows\system32\drivers\mferkdk.sys

2009-03-17 06:44 . 2009-03-15 09:09        343        ----a-w        c:\windows\system32\dmlg.dat

2009-03-17 03:38 . 2009-04-17 09:40        13824        ----a-w        c:\windows\system32\apilogen.dll

2009-03-17 03:38 . 2009-04-17 09:40        24064        ----a-w        c:\windows\system32\amxread.dll

2009-03-14 13:48 . 2009-03-14 13:48        2892        ----a-w        c:\windows\system32\audcon.sys

2009-03-12 21:51 . 2009-03-12 21:51        1080648        ----a-w        c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

2009-03-09 03:19 . 2009-03-01 17:57        410984        ----a-w        c:\windows\system32\deploytk.dll

2009-03-03 04:46 . 2009-04-17 09:41        3599328        ----a-w        c:\windows\system32\ntkrnlpa.exe

2009-03-03 04:46 . 2009-04-17 09:41        3547632        ----a-w        c:\windows\system32\ntoskrnl.exe

2009-03-03 04:40 . 2009-04-17 09:40        827392        ----a-w        c:\windows\system32\wininet.dll

2009-03-03 04:39 . 2009-04-17 09:41        183296        ----a-w        c:\windows\system32\sdohlp.dll

2009-03-03 04:39 . 2009-04-17 09:41        551424        ----a-w        c:\windows\system32\rpcss.dll

2009-03-03 04:39 . 2009-04-17 09:41        26112        ----a-w        c:\windows\system32\printfilterpipelineprxy.dll

2009-03-03 04:37 . 2009-04-17 09:40        78336        ----a-w        c:\windows\system32\ieencode.dll

2009-03-03 04:37 . 2009-04-17 09:41        98304        ----a-w        c:\windows\system32\iasrecst.dll

2009-03-03 04:37 . 2009-04-17 09:41        54784        ----a-w        c:\windows\system32\iasads.dll

2009-03-03 04:37 . 2009-04-17 09:41        44032        ----a-w        c:\windows\system32\iasdatastore.dll

2009-03-03 03:04 . 2009-04-17 09:41        666624        ----a-w        c:\windows\system32\printfilterpipelinesvc.exe

2009-03-03 02:38 . 2009-04-17 09:41        17408        ----a-w        c:\windows\system32\iashost.exe

2009-03-03 02:28 . 2009-04-17 09:40        26624        ----a-w        c:\windows\system32\ieUnatt.exe

2009-02-26 11:30 . 2009-02-26 11:30        0        ----a-w        c:\windows\nsreg.dat

2009-02-22 14:32 . 2009-02-22 14:32        1003520        ----a-w        c:\windows\system32\VSFilter.dll

.
 

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]

2009-05-15 19:31        218160        ----a-w        c:\program files\Hotspot Shield\hssie\HssIE.dll
 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]

"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-05-14 1830128]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-10-26 1029416]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-03-25 645328]

"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-07-08 6273568]
 

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-2-12 723496]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)
 

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2008-12-22 10:05        356352        ----a-w        c:\program files\SUPERAntiSpyware\SASWINLO.dll
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

@=""
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]

"DisableMonitoring"=dword:00000001
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]

"EnableFirewall"= 0 (0x0)
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{1633AF2B-9328-4160-8B66-6430B6F351D3}"= c:\program files\CyberLink\PowerDVD\PowerDVD.EXE:CyberLink PowerDVD

"{0A0F4E71-824D-498C-BE09-43EF25998BAB}"= c:\program files\CyberLink\PowerDirector\PDR.EXE:CyberLink PowerDirector

"{A8774147-24CC-4B83-A493-BD4DFF50E236}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook

"{52556ED8-B928-40F7-B76D-C68EA6A214AC}"= Profile=Private|Profile=Public|c:\program files\Common Files\Mcafee\MNA\McNaSvc.exe:McAfee Network Agent
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]

"EnableFirewall"= 0 (0x0)
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]

"EnableFirewall"= 0 (0x0)
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]

"c:\\Program Files\\FlashGet Network\\FlashGet universal\\FlashGet.exe"= c:\program files\FlashGet Network\FlashGet universal\FlashGet.exe:*:Enabled:Flashget2

"c:\\Program Files\\FlashGet Network\\FlashGet universal\\LiveUpdate.exe"= c:\program files\FlashGet Network\FlashGet universal\LiveUpdate.exe:*:Enabled:FGLiveUpdate

"c:\\Program Files\\FlashGet Network\\FlashGet universal\\LiveUpdateEx.exe"= c:\program files\FlashGet Network\FlashGet universal\LiveUpdateEx.exe:*:Enabled:FGLiveUpdateEx
 

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [14.05.2009 14:22 9968]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [14.05.2009 14:22 72944]

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [19.03.2009 13:44 108289]

R2 HssSrv;Hotspot Shield Helper Service;c:\program files\Hotspot Shield\HssWPR\hsssrv.exe [22.04.2009 03:12 328752]

R2 KMDFMEMIO;SAMSUNG Kernel Driver;c:\windows\System32\drivers\KMDFMEMIO.sys [01.09.2008 14:07 13312]

R2 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [14.04.2006 03:07 28933976]

R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\System32\TUProgSt.exe [05.05.2009 13:42 604416]

R3 HssDrv;Hotspot Shield Helper Miniport;c:\windows\System32\drivers\HssDrv.sys [03.04.2009 20:18 33256]

R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [14.05.2009 14:22 7408]

R3 usbfilter;AMD USB Filter Driver;c:\windows\System32\drivers\usbfilter.sys [01.09.2008 13:46 22072]

R3 VMC302;Vimicro Camera Service VMC302;c:\windows\System32\drivers\vmc302.sys [01.09.2008 13:57 241664]

S3 HssTrayService;Hotspot Shield Tray Service;c:\program files\Hotspot Shield\bin\HssTrayService.exe [22.04.2009 23:34 34352]

S3 SynasUSB;SynasUSB;c:\windows\System32\drivers\synasUSB.sys [14.03.2009 15:47 18432]

S3 TASCAM_US122144;TASCAM USB 2.0 Audio Device driver;c:\windows\System32\drivers\tascusb2.sys [14.03.2009 15:35 360448]

S3 TASCAM_US122L_MIDI;TASCAM US-122L WDM MIDI Device;c:\windows\System32\drivers\tscusb2m.sys [14.03.2009 15:35 18944]

S3 TASCAM_US122L_WDM;TASCAM US-122L WDM;c:\windows\System32\drivers\tscusb2a.sys [14.03.2009 15:35 33792]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bthsvcs        REG_MULTI_SZ           BthServ
 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs

UxTuneUp
 

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

"c:\program files\Common Files\LightScribe\LSRunOnce.exe"

.

Inhalt des "geplante Tasks" Ordners
 

2009-05-23 c:\windows\Tasks\1-Klick-Wartung.job

- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-03-20 14:17]
 

2009-05-21 c:\windows\Tasks\McDefragTask.job

- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-05-20 08:53]
 

2009-05-21 c:\windows\Tasks\McQcTask.job

- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-05-20 08:53]
 

2009-05-22 c:\windows\Tasks\User_Feed_Synchronization-{8B38A101-D0BE-48FB-8E37-07E5DBD9AED5}.job

- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -
 

SafeBoot-procexp90.Sys
 
 

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.jappy.de/

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

FF - ProfilePath - c:\users\PDvaS\AppData\Roaming\Mozilla\Firefox\Profiles\wpnn7fzd.default\

FF - prefs.js: browser.startup.homepage - www.google.de

FF - prefs.js: network.proxy.type - 2

FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

FF - plugin: c:\program files\VistaCodecPack\rm\browser\plugins\nppl3260.dll

FF - plugin: c:\program files\VistaCodecPack\rm\browser\plugins\nprpjplug.dll

FF - plugin: c:\users\PDvaS\AppData\Roaming\Mozilla\Firefox\Profiles\wpnn7fzd.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000006.dll
 

---- FIREFOX Richtlinien ----

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: nglayout.initialpaint.delay - 600

FF - user.js: content.notify.interval - 600000

FF - user.js: content.max.tokenizing.time - 1800000

FF - user.js: content.switch.threshold - 600000

.
 

**************************************************************************
 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-05-23 12:44

Windows 6.0.6001 Service Pack 1 NTFS
 

Scanne versteckte Prozesse... 
 

Scanne versteckte Autostarteinträge... 
 

Scanne versteckte Dateien... 
 

Scan erfolgreich abgeschlossen

versteckte Dateien: 0
 

**************************************************************************

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
 

- - - - - - - > 'Explorer.exe'(5560)

c:\windows\system32\btmmhook.dll

.

Zeit der Fertigstellung: 2009-05-23 12:45

ComboFix-quarantined-files.txt  2009-05-23 10:45
 

Vor Suchlauf: 20 Verzeichnis(se), 96.586.760.192 Bytes frei

Nach Suchlauf: 20 Verzeichnis(se), 96.501.440.512 Bytes frei
 

236        --- E O F ---        2009-05-21 14:10

Mfg PDvaS

john.doe

23.05.2009 14:22

Seit wann hast du Probleme (möglichst genau)?

Systemdetails mit RSIT prüfen

Lade Random's System Information Tool (RSIT) von random/random herunter,
speichere es auf Deinem Desktop.
Starte mit Doppelklick die RSIT.exe.
Klicke auf Continue, um die Nutzungsbedingungen zu akzeptieren.
Der Scan startet automatisch, RSIT checkt nun einige wichtige System-Bereiche und produziert Logfiles als Analyse-Grundlage.
Wenn der Scan beendet ist, werden zwei Logfiles erstellt und in Deinem Editor geöffnet.
Bitte poste den Inhalt von C:\rsit\log.txt und C:\rsit\info.txt (<= minimiert) hier in den Thread.

ciao, andreas

PDvaS

23.05.2009 17:20

Die Probleme habe ich eigentlich genau seit 8 Tagen

Code:

info.txt logfile of random's system information tool 1.06 2009-05-17 13:21:26
 

======Uninstall list======
 

2007 Microsoft Office system-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROHYBRIDR /dll OSETUP.DLL

Activation Assistant for the 2007 Microsoft Office suites-->"C:\ProgramData\{623D32E9-0C62-4453-AD44-98B31F52A5E1}\Microsoft Office Activation Assistant.exe" REMOVE=TRUE MODIFY=FALSE

Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe

Adobe Flash Player ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe

Adobe Reader 8.1.0 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A81000000003}

Agere Systems HDA Modem-->agrsmdel

ALUpdate-->"C:\Program Files\ESTsoft\ALUpdate\unins000.exe"

AMD USB Audio Driver Filter-->MsiExec.exe /X{A3AB35FA-943E-4799-99DC-46EFD59E998F}

Atheros WLAN Client-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{04983D37-2202-4295-94A2-8B547C66133F}\setup.exe" -l0x9 

ATI PCI Express (3GIO) Filter Driver-->C:\Program Files\InstallShield Installation Information\{E713653C-8312-4BC6-AFC9-ADE1F2F04AB9}\setup.exe -runfromtemp -l0x0009 -removeonly

Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir Desktop\setup.exe /REMOVE

AVS Update Manager 1.0-->"C:\Program Files\AVS4YOU\AVSUpdateManger\unins000.exe"

Business Contact Manager für Outlook 2007-->"C:\Program Files\Microsoft Small Business\Business Contact Manager\SetupBootstrap\Setup.exe" /remove {4cb9f93c-9edc-4be9-ae61-af128ddbecfa}

Business Contact Manager für Outlook 2007-->MsiExec.exe /X{4cb9f93c-9edc-4be9-ae61-af128ddbecfa}

Catalyst Control Center - Branding-->MsiExec.exe /I{2433BAD7-453F-473D-BE81-455E68940DEB}

CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"

Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}

CorelDRAW Graphics Suite 12-->MsiExec.exe /I{505AFDC0-5E72-4928-8368-5DEA385E3647}

CyberLink DVD Suite-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}\setup.exe"  -uninstall

CyberLink Power2Go-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{40BF1E83-20EB-11D8-97C5-0009C5020658}\setup.exe"  -uninstall

DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN

Easy Battery Manager-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6F730513-8688-4C3C-90A3-6B9792CE2EF3}\setup.exe" -l0x9 Remove

Easy Display Manager-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{17283B95-21A8-4996-97DA-547A48DB266F}\setup.exe" -l0x9  -removeonly

Easy Network Manager 4.0-->C:\Program Files\InstallShield Installation Information\{308BD058-411C-4AF2-8BF6-A6C7CFD0270D}\setup.exe -runfromtemp -l0x0407

Easy SpeedUp Manager-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EF367AA4-070B-493C-9575-85BE59D789C9}\setup.exe" -l0x9 Remove

FIFA 09-->MsiExec.exe /X{2315B23D-3E21-4920-837D-AE6460934ECB}

Free FLV Converter V 6.23.0-->"C:\Program Files\Free FLV Converter\unins000.exe"

GeoGebra-->"C:\Program Files\GeoGebra\UninstallerData\Uninstaller.exe"

HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""

Hotspot Shield 1.15-->C:\Program Files\Hotspot Shield\Uninstall.exe

imagine digital freedom - Samsung-->MsiExec.exe /X{00AF10C1-44BD-4862-9D7F-24E6BA3E87FD}

Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216012FF}

LabelPrint-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C59C179C-668D-49A9-B6EA-0121CCFC1243}\setup.exe"  -uninstall

LightScribe System Software  1.12.37.1-->MsiExec.exe /X{004C5DA2-2051-4D25-94BA-51CF810C91EB}

MAGIX Music Maker Hip Hop Edition 2 4.0.0.10 (D)-->C:\Program Files\MAGIX\MusicMakerHipHopEdition2\instslct.exe

Marvell Miniport Driver-->C:\Program Files\Marvell\Miniport Driver\Uninst.exe

McAfee SecurityCenter-->C:\Program Files\McAfee\MSC\mcuninst.exe

Microsoft .NET Framework 3.5 SP1-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe

Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}

Microsoft Office 2003 Web Components-->MsiExec.exe /I{90A40407-6000-11D3-8CFE-0150048383C9}

Microsoft Office 2007 Primary Interop Assemblies-->MsiExec.exe /X{50120000-1105-0000-0000-0000000FF1CE}

Microsoft Office Access MUI (German) 2007-->MsiExec.exe /X{90120000-0015-0407-0000-0000000FF1CE}

Microsoft Office Excel MUI (German) 2007-->MsiExec.exe /X{90120000-0016-0407-0000-0000000FF1CE}

Microsoft Office Outlook MUI (German) 2007-->MsiExec.exe /X{90120000-001A-0407-0000-0000000FF1CE}

Microsoft Office PowerPoint MUI (German) 2007-->MsiExec.exe /X{90120000-0018-0407-0000-0000000FF1CE}

Microsoft Office Professional Hybrid 2007-->MsiExec.exe /X{91120000-0031-0000-0000-0000000FF1CE}

Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}

Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}

Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}

Microsoft Office Proof (Italian) 2007-->MsiExec.exe /X{90120000-001F-0410-0000-0000000FF1CE}

Microsoft Office Proofing (German) 2007-->MsiExec.exe /X{90120000-002C-0407-0000-0000000FF1CE}

Microsoft Office Publisher MUI (German) 2007-->MsiExec.exe /X{90120000-0019-0407-0000-0000000FF1CE}

Microsoft Office Shared MUI (German) 2007-->MsiExec.exe /X{90120000-006E-0407-0000-0000000FF1CE}

Microsoft Office Small Business Connectivity Components-->MsiExec.exe /X{A939D341-5A04-4E0A-BB55-3E65B386432D}

Microsoft Office Word MUI (German) 2007-->MsiExec.exe /X{90120000-001B-0407-0000-0000000FF1CE}

Microsoft Picture It! Foto Premium 10-->"C:\Program Files\Common Files\Microsoft Shared\Picture It!\RmvSuite.exe" ADDREMOVE=1 SKU=PREM

Microsoft SOAP Toolkit 2.0 SP2-->MsiExec.exe /I{36BEAD11-8577-49AD-9250-E06A50AE87B0}

Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)-->MsiExec.exe /I{028ED9C4-25EE-4DEE-9CF4-91034BC89B18}

Microsoft SQL Server 2005-->"C:\Program Files\Microsoft SQL Server\90\Setup Bootstrap\ARPWrapper.exe" /Remove

Microsoft SQL Server Native Client-->MsiExec.exe /I{547DCEC7-DD2A-47E9-82C7-5CF1EAB526DA}

Microsoft SQL Server VSS Writer-->MsiExec.exe /I{2DFB5485-A3EF-4298-9280-4AF80C9F4BE9}

Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}

MoviesPlay-->"C:\Program Files\MoviesPlay\Uninstall.exe"

Mozilla Firefox (3.0.10)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe

MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}

MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}

PlayCamera-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{804F1285-8CBF-408D-8CDC-D4D40003B2E4}\setup.exe" -l0x7 

PowerDirector-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}\setup.exe"  -uninstall

PowerDVD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe"  -uninstall

PowerProducer-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B7A0CE06-068E-11D6-97FD-0050BACBF861}\Setup.exe"  -uninstall

Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\setup.exe"  -removeonly

Samsung Magic Doctor-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}\Setup.exe" -l0x9 Remove

Samsung Recovery Solution III-->"C:\Program Files\InstallShield Installation Information\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}\setup.exe" -runfromtemp -l0x0007 -removeonly

Samsung Update Plus-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\IDriver.exe /M{685707A4-911C-468D-BFC4-64A50E5E3A0C} /l1031 

Steinberg Cubase LE 4-->MsiExec.exe /I{AB3C4AC6-C401-4132-A8B5-265899A9C0E8}

Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall

Syncrosoft Lizenz Kontrolle-->C:\PROGRA~1\SYNCRO~1\UNWISE.EXE C:\PROGRA~1\SYNCRO~1\INSTALL.LOG

Techno4ever Player-->C:\Program Files\T4E\Player\T4E_Uninstaller.exe

Tsunami-Filter-Pack-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0700\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DCFF9230-22DC-40ED-BBCC-0F260B85734C}\setup.exe" -l0x9 

TuneUp Utilities 2009-->MsiExec.exe /I{55A29068-F2CE-456C-9148-C869879E2357}

Ultra AVI Converter 4.4.0529-->"C:\Program Files\Ultra AVI Converter\unins000.exe"

Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)-->MsiExec.exe /X{07629207-FAA0-4F1A-8092-BF5085BE511F}

Update for Office 2007 (KB934528)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {2B939677-2FFD-48F6-9075-7BF48CB87C80}

Update for Office System 2007 Setup (KB929722)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {D8E9BEBD-655F-467D-8176-CA9959C140A3}

US-122L / US-144 driver-->C:\Windows\usb-audio.deTascam\Setup.exe /l0

User Guide-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}\setup.exe" -l0x9 Remove

VC80CRTRedist - 8.0.50727.762-->MsiExec.exe /I{767CC44C-9BBC-438D-BAD3-FD4595DD148B}

Vimicro UVC Camera-->C:\Program Files\InstallShield Installation Information\{71A51B09-E7D3-11DB-A386-005056C00008}\setup.exe -runfromtemp -l0x0009 -removeonly

Virtual DJ - Atomix Productions-->C:\PROGRA~1\VIRTUA~1\UNWISE.EXE C:\PROGRA~1\VIRTUA~1\INSTALL.LOG

Vista Codec Package-->MsiExec.exe /I{F9FD80CE-0448-4D4F-8BCD-77FC514C3F99}

VLC media player 0.9.9-->C:\Program Files\VideoLAN\VLC\uninstall.exe

WIDCOMM Bluetooth Software 6.0.1.6300-->MsiExec.exe /X{03D1988F-469F-4843-8E6E-E5FE9D17889D}

Windows Live Anmelde-Assistent-->MsiExec.exe /I{52B97218-98CB-4B8B-9283-D213C85E1AA4}

Windows Live Call-->MsiExec.exe /I{5FC68772-6D56-41C6-9DF1-24E868198AE6}

Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}

Windows Live Essentials-->C:\Program Files\Windows Live\Installer\wlarp.exe

Windows Live Essentials-->MsiExec.exe /I{91E04CA7-0B13-4F8C-AA4D-2A573AC96D19}

Windows Live Messenger-->MsiExec.exe /X{837B6259-6FF5-4E66-87C1-A5A15ED36FF4}

Windows Live OneCare safety scanner-->"C:\Program Files\Windows Live Safety Center\UnInstall.exe"

Windows Live OneCare safety scanner-->MsiExec.exe /X{FE0646A7-19D0-41B4-A2BB-2C35D644270D}

Windows Live-Uploadtool-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}

Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}

WinRAR-->C:\Program Files\WinRAR\uninstall.exe

Zattoo 3.3.3 Beta-->C:\Program Files\Zattoo\uninst.exe
 

======Security center information======
 

AS: Windows Defender
 

======System event log======
 

Computer Name: PDvaS-PC

Event Code: 1

Message: Die Systemzeit wurde von 2009-05-17T10:45:42.910Z auf 2009-05-17T10:45:42.910Z geändert.

Record Number: 50970

Source Name: Microsoft-Windows-Kernel-General

Time Written: 20090517104542.910000-000

Event Type: Informationen

User: NT-AUTORITÄT\LOKALER DIENST
 

Computer Name: PDvaS-PC

Event Code: 6013

Message: Die aktive Systemzeit ist 65375 Sekunden.

Record Number: 50971

Source Name: EventLog

Time Written: 20090517104547.000000-000

Event Type: Informationen

User: 
 

Computer Name: PDvaS-PC

Event Code: 1003

Message: Der Computer konnte die Netzwerkadresse, die durch den DHCP-Server für die Netzwerkkarte mit der Netzwerkadresse 00FF1C6A0C01 zugeteilt wurde, nicht erneuern. Der folgende Fehler ist aufgetreten: 

Das Zeitlimit für die Semaphore wurde erreicht.. Es wird weiterhin im Hintergrund versucht, eine Adresse vom Netzwerkadressserver (DHCP) zu erhalten.

Record Number: 50972

Source Name: Microsoft-Windows-Dhcp-Client

Time Written: 20090517104556.000000-000

Event Type: Warnung

User: 
 

Computer Name: PDvaS-PC

Event Code: 20003

Message: Der Prozess zum Hinzufügen von Dienst tunnel für Geräteinstanz-ID ROOT\*ISATAP\0002 wurde mit folgendem Status beendet: 0.

Record Number: 50973

Source Name: Microsoft-Windows-User-PnP

Time Written: 20090517104558.322800-000

Event Type: Informationen

User: NT-AUTORITÄT\SYSTEM
 

Computer Name: PDvaS-PC

Event Code: 7036

Message: Dienst "WinHTTP-Web Proxy Auto-Discovery-Dienst" befindet sich jetzt im Status "Beendet".

Record Number: 50974

Source Name: Service Control Manager

Time Written: 20090517110240.000000-000

Event Type: Informationen

User: 
 

=====Application event log=====
 

Computer Name: PDvaS-PC

Event Code: 8224

Message: Der VSS-Dienst wird aufgrund eines Leerlaufzeitlimits heruntergefahren. 

Record Number: 14968

Source Name: VSS

Time Written: 20090516220302.000000-000

Event Type: Informationen

User: 
 

Computer Name: PDvaS-PC

Event Code: 17403

Message: Die Ausführung des Servers wurde nach einem Leerlauf von 52465 Sekunden fortgesetzt. Ursache: Zeitgeberereignis.

Record Number: 14969

Source Name: MSSQL$MSSMLBIZ

Time Written: 20090516230017.000000-000

Event Type: Informationen

User: 
 

Computer Name: PDvaS-PC

Event Code: 4113

Message: AntiVir erkannte in der Datei C:\Windows\System32\drivers\gxvxcbwpmppqdceoxcxqrddsrlpnoxiehsqve.sys verdächtigen Code mit der Bezeichnung 'RKIT/Agent.kqe'!

Record Number: 14970

Source Name: Avira AntiVir

Time Written: 20090517023105.000000-000

Event Type: Warnung

User: NT-AUTORITÄT\SYSTEM
 

Computer Name: PDvaS-PC

Event Code: 4113

Message: AntiVir erkannte in der Datei D:\RECYCLER\S-8-5-80-100011524-100005441-100032622-1396.com verdächtigen Code mit der Bezeichnung 'TR/TDss.adcr'!

Record Number: 14971

Source Name: Avira AntiVir

Time Written: 20090517111259.000000-000

Event Type: Warnung

User: NT-AUTORITÄT\SYSTEM
 

Computer Name: PDvaS-PC

Event Code: 5

Message: Unsupported service control request (see data below)

Record Number: 14972

Source Name: LightScribeService

Time Written: 20090517112124.000000-000

Event Type: Informationen

User: 
 

=====Security event log=====
 

Computer Name: PDvaS-PC

Event Code: 5038

Message: Die Codeintegrität hat festgestellt, dass der Abbildhash einer Datei nicht gültig ist. Die Datei wurde möglicherweise durch eine nicht autorisierte Änderung beschädigt. Dieses Problem kann auch auf einen potenziellen Fehler des Datenträgergeräts hinweisen.
 

Dateiname:        \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys        

Record Number: 10719

Source Name: Microsoft-Windows-Security-Auditing

Time Written: 20090517112120.403800-000

Event Type: Überwachung gescheitert

User: 
 

Computer Name: PDvaS-PC

Event Code: 5038

Message: Die Codeintegrität hat festgestellt, dass der Abbildhash einer Datei nicht gültig ist. Die Datei wurde möglicherweise durch eine nicht autorisierte Änderung beschädigt. Dieses Problem kann auch auf einen potenziellen Fehler des Datenträgergeräts hinweisen.
 

Dateiname:        \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys        

Record Number: 10720

Source Name: Microsoft-Windows-Security-Auditing

Time Written: 20090517112120.450600-000

Event Type: Überwachung gescheitert

User: 
 

Computer Name: PDvaS-PC

Event Code: 5038

Message: Die Codeintegrität hat festgestellt, dass der Abbildhash einer Datei nicht gültig ist. Die Datei wurde möglicherweise durch eine nicht autorisierte Änderung beschädigt. Dieses Problem kann auch auf einen potenziellen Fehler des Datenträgergeräts hinweisen.
 

Dateiname:        \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys        

Record Number: 10721

Source Name: Microsoft-Windows-Security-Auditing

Time Written: 20090517112120.481800-000

Event Type: Überwachung gescheitert

User: 
 

Computer Name: PDvaS-PC

Event Code: 5038

Message: Die Codeintegrität hat festgestellt, dass der Abbildhash einer Datei nicht gültig ist. Die Datei wurde möglicherweise durch eine nicht autorisierte Änderung beschädigt. Dieses Problem kann auch auf einen potenziellen Fehler des Datenträgergeräts hinweisen.
 

Dateiname:        \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys        

Record Number: 10722

Source Name: Microsoft-Windows-Security-Auditing

Time Written: 20090517112120.513000-000

Event Type: Überwachung gescheitert

User: 
 

Computer Name: PDvaS-PC

Event Code: 5038

Message: Die Codeintegrität hat festgestellt, dass der Abbildhash einer Datei nicht gültig ist. Die Datei wurde möglicherweise durch eine nicht autorisierte Änderung beschädigt. Dieses Problem kann auch auf einen potenziellen Fehler des Datenträgergeräts hinweisen.
 

Dateiname:        \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys        

Record Number: 10723

Source Name: Microsoft-Windows-Security-Auditing

Time Written: 20090517112120.575400-000

Event Type: Überwachung gescheitert

User: 
 

======Environment variables======
 

"ComSpec"=%SystemRoot%\system32\cmd.exe

"FP_NO_HOST_CHECK"=NO

"OS"=Windows_NT

"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files\Microsoft SQL Server\90\Tools\binn

"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC

"PROCESSOR_ARCHITECTURE"=x86

"TEMP"=%SystemRoot%\TEMP

"TMP"=%SystemRoot%\TEMP

"USERNAME"=SYSTEM

"windir"=%SystemRoot%

"PROCESSOR_LEVEL"=17

"PROCESSOR_IDENTIFIER"=x86 Family 17 Model 3 Stepping 1, AuthenticAMD

"PROCESSOR_REVISION"=0301

"NUMBER_OF_PROCESSORS"=2

"TRACE_FORMAT_SEARCH_PATH"=\\NTREL202.ntdev.corp.microsoft.com\4F18C3A5-CA09-4DBD-B6FC-219FDD4C6BE0\TraceFormat

"DFSTRACINGON"=FALSE
 

-----------------EOF-----------------

PDvaS

23.05.2009 17:22

Code:

Logfile of random's system information tool 1.06 (written by random/random)

Run by PDvaS at 2009-05-23 18:12:07

Microsoft® Windows Vista™ Home Premium  Service Pack 1

System drive C: has 93 GB (63%) free of 148 GB

Total RAM: 3294 MB (64% free)
 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 18:12:23, on 23.05.2009

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18226)

Boot mode: Normal
 

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Windows\system32\conime.exe

C:\Windows\Explorer.exe

c:\PROGRA~1\mcafee.com\agent\mcagent.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Windows Live\Contacts\wlcomm.exe

C:\Program Files\Windows Media Player\wmplayer.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Users\PDvaS\Desktop\RSIT.exe

C:\Program Files\Trend Micro\HijackThis\PDvaS.exe
 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.jappy.de/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 

O1 - Hosts: ::1 localhost

O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll

O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files\Hotspot Shield\hssie\HssIE.dll

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - Global Startup: BTTray.lnk = ?

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O13 - Gopher Prefix: 

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe

O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\openvpnas.exe

O23 - Service: Hotspot Shield Helper Service (HssSrv) - AnchorFree Inc. - C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe

O23 - Service: Hotspot Shield Tray Service (HssTrayService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\HssTrayService.EXE

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe

O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe

O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

O23 - Service: Samsung Update Plus - Unknown owner - C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exe

O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe

O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\Windows\System32\TUProgSt.exe
 

--

End of file - 6309 bytes
 

======Scheduled tasks folder======
 

C:\Windows\tasks\1-Klick-Wartung.job

C:\Windows\tasks\McDefragTask.job

C:\Windows\tasks\McQcTask.job

C:\Windows\tasks\User_Feed_Synchronization-{8B38A101-D0BE-48FB-8E37-07E5DBD9AED5}.job
 

======Registry dump======
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]

Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}]

scriptproxy - C:\Program Files\McAfee\VirusScan\scriptsn.dll [2009-03-25 62784]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

Windows Live Anmelde-Hilfsprogramm - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-09 35840]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]

Hotspot Shield Class - C:\Program Files\Hotspot Shield\hssie\HssIE.dll [2009-05-15 218160]
 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2008-07-08 6273568]

"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2007-10-26 1029416]

"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]

"mcagent_exe"=C:\Program Files\McAfee.com\Agent\mcagent.exe [2009-03-25 645328]
 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-21 125952]

"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2008-01-21 1233920]

"SUPERAntiSpyware"=C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [2009-05-14 1830128]
 

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\!SASWinLogon]

C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [2008-12-22 356352]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 77824]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mcmscsvc]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MpfService]
 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1

"EnableUIADesktopToggle"=0
 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDrives"=0
 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDrives"=
 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"C:\Program Files\FlashGet Network\FlashGet universal\FlashGet.exe"="C:\Program Files\FlashGet Network\FlashGet universal\FlashGet.exe:*:Enabled:Flashget2"

"C:\Program Files\FlashGet Network\FlashGet universal\LiveUpdate.exe"="C:\Program Files\FlashGet Network\FlashGet universal\LiveUpdate.exe:*:Enabled:FGLiveUpdate"

"C:\Program Files\FlashGet Network\FlashGet universal\LiveUpdateEx.exe"="C:\Program Files\FlashGet Network\FlashGet universal\LiveUpdateEx.exe:*:Enabled:FGLiveUpdateEx"
 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
 

======List of files/folders created in the last 1 months======
 

2009-05-23 12:46:01 ----D---- C:\Windows\temp

2009-05-23 12:45:59 ----A---- C:\ComboFix.txt

2009-05-23 12:44:57 ----SHD---- C:\$RECYCLE.BIN

2009-05-23 12:38:22 ----A---- C:\Windows\zip.exe

2009-05-23 12:38:22 ----A---- C:\Windows\SWXCACLS.exe

2009-05-23 12:38:22 ----A---- C:\Windows\SWSC.exe

2009-05-23 12:38:22 ----A---- C:\Windows\SWREG.exe

2009-05-23 12:38:22 ----A---- C:\Windows\sed.exe

2009-05-23 12:38:22 ----A---- C:\Windows\PEV.exe

2009-05-23 12:38:22 ----A---- C:\Windows\NIRCMD.exe

2009-05-23 12:38:22 ----A---- C:\Windows\grep.exe

2009-05-23 12:38:08 ----SD---- C:\ComboFix

2009-05-23 12:38:01 ----D---- C:\Qoobox

2009-05-20 20:12:01 ----D---- C:\Program Files\Common Files\McAfee

2009-05-20 20:11:56 ----D---- C:\Program Files\McAfee.com

2009-05-20 20:11:51 ----D---- C:\Program Files\McAfee

2009-05-19 16:47:52 ----D---- C:\ProgramData\SUPERAntiSpyware.com

2009-05-19 16:46:27 ----D---- C:\Users\PDvaS\AppData\Roaming\SUPERAntiSpyware.com

2009-05-19 16:46:27 ----D---- C:\Program Files\SUPERAntiSpyware

2009-05-19 16:45:40 ----D---- C:\Program Files\Common Files\Wise Installation Wizard

2009-05-18 21:48:46 ----D---- C:\ProgramData\Spybot - Search & Destroy

2009-05-18 21:48:46 ----D---- C:\Program Files\Spybot - Search & Destroy

2009-05-18 21:43:33 ----D---- C:\fixwareout

2009-05-18 12:49:48 ----AH---- C:\aaw7boot.cmd

2009-05-18 04:00:16 ----D---- C:\ProgramData\Lavasoft

2009-05-17 13:51:53 ----D---- C:\Users\PDvaS\AppData\Roaming\Malwarebytes

2009-05-17 13:51:45 ----D---- C:\ProgramData\Malwarebytes

2009-05-17 13:51:42 ----D---- C:\Program Files\Malwarebytes' Anti-Malware

2009-05-17 13:45:06 ----A---- C:\Windows\system32\MPFServiceFailureCount.txt

2009-05-17 13:45:03 ----D---- C:\Windows\ERDNT

2009-05-17 13:21:01 ----D---- C:\Program Files\trend micro

2009-05-17 13:21:00 ----D---- C:\rsit

2009-05-15 21:30:57 ----D---- C:\Program Files\Hotspot Shield

2009-05-05 13:42:25 ----A---- C:\Windows\system32\TUProgSt.exe

2009-05-05 13:42:21 ----A---- C:\Windows\system32\uxtuneup.dll

2009-05-05 13:42:21 ----A---- C:\Windows\system32\authuitu.dll

2009-05-05 13:42:17 ----A---- C:\Windows\system32\TuneUpDefragService.exe

2009-05-04 12:44:22 ----D---- C:\Users\PDvaS\AppData\Roaming\vlc
 

======List of files/folders modified in the last 1 months======
 

2009-05-23 18:12:18 ----D---- C:\Windows\Prefetch

2009-05-23 15:51:05 ----SHD---- C:\System Volume Information

2009-05-23 12:55:25 ----D---- C:\Windows\system32\drivers

2009-05-23 12:46:02 ----D---- C:\Windows\system32\de-DE

2009-05-23 12:46:02 ----D---- C:\Windows\System32

2009-05-23 12:46:01 ----D---- C:\Windows

2009-05-23 12:44:23 ----A---- C:\Windows\system.ini

2009-05-23 12:42:30 ----D---- C:\Windows\AppPatch

2009-05-23 12:42:30 ----D---- C:\Program Files\Common Files

2009-05-23 12:35:37 ----D---- C:\Windows\inf

2009-05-23 12:35:37 ----A---- C:\Windows\system32\PerfStringBackup.INI

2009-05-22 14:57:23 ----SHD---- C:\Windows\Installer

2009-05-22 14:48:27 ----SD---- C:\Users\PDvaS\AppData\Roaming\Microsoft

2009-05-20 20:16:00 ----D---- C:\ProgramData\McAfee

2009-05-20 20:14:08 ----D---- C:\Windows\system32\catroot

2009-05-20 20:12:15 ----D---- C:\Windows\Tasks

2009-05-20 20:12:15 ----D---- C:\Windows\system32\Tasks

2009-05-20 20:11:56 ----RD---- C:\Program Files

2009-05-19 20:20:47 ----D---- C:\Program Files\Tsunami-Filter-Pack

2009-05-19 16:47:52 ----HD---- C:\ProgramData

2009-05-18 19:04:24 ----D---- C:\Program Files\CCleaner

2009-05-18 13:00:56 ----DC---- C:\Windows\system32\DRVSTORE

2009-05-18 04:50:18 ----D---- C:\Windows\system32\LogFiles

2009-05-17 18:43:39 ----D---- C:\Windows\Debug

2009-05-16 01:52:15 ----D---- C:\Windows\system32\catroot2

2009-05-14 15:31:59 ----D---- C:\Windows\winsxs

2009-05-13 22:26:08 ----D---- C:\Program Files\Windows Mail

2009-05-09 21:07:52 ----D---- C:\Windows\system32\config

2009-05-09 21:07:48 ----D---- C:\Windows\VMC302

2009-05-09 21:07:48 ----D---- C:\Windows\system32\Msdtc

2009-05-09 21:07:47 ----D---- C:\Windows\system32\wbem

2009-05-09 21:07:47 ----D---- C:\Windows\registration

2009-05-07 09:16:29 ----A---- C:\Windows\system32\mrt.exe

2009-05-05 13:42:12 ----D---- C:\Program Files\TuneUp Utilities 2009

2009-05-02 10:21:49 ----D---- C:\Program Files\Mozilla Firefox

2009-05-02 08:32:15 ----D---- C:\Windows\system32\CodeIntegrity
 

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
 

R1 ASPI32;ASPI32; C:\Windows\system32\drivers\ASPI32.sys [1999-09-10 25244]

R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys [2009-02-13 11608]

R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2009-04-27 96104]

R1 mfehidk;McAfee Inc. mfehidk; C:\Windows\system32\drivers\mfehidk.sys [2009-03-25 214024]

R1 MPFP;MPFP; C:\Windows\System32\Drivers\Mpfp.sys [2008-10-23 130424]

R1 SASDIFSV;SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [2009-05-14 9968]

R1 SASKUTIL;SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys [2009-05-14 72944]

R1 ssmdrv;ssmdrv; C:\Windows\system32\DRIVERS\ssmdrv.sys [2009-02-13 28376]

R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2009-04-27 55640]

R2 KMDFMEMIO;SAMSUNG Kernel Driver; C:\Windows\system32\DRIVERS\kmdfmemio.sys [2008-09-01 13312]

R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2008-04-27 909824]

R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2008-08-08 3895808]

R3 CmBatt;Treiber für Microsoft-ACPI-Kontrollmethodenkompatible Batterie; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-21 14208]

R3 HdAudAddService;Microsoft 1.1 UAA-Funktionstreiber für High Definition Audio-Dienst; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]

R3 HssDrv;Hotspot Shield Helper Miniport; C:\Windows\system32\DRIVERS\HssDrv.sys [2009-04-03 33256]

R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-07-07 2152088]

R3 mfeavfk;McAfee Inc. mfeavfk; C:\Windows\system32\drivers\mfeavfk.sys [2009-03-25 79880]

R3 mfebopk;McAfee Inc. mfebopk; C:\Windows\system32\drivers\mfebopk.sys [2009-03-25 35272]

R3 mfesmfk;McAfee Inc. mfesmfk; C:\Windows\system32\drivers\mfesmfk.sys [2009-03-25 40552]

R3 SASENUM;SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS [2009-05-14 7408]

R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2007-10-26 193456]

R3 tapvpn;TAP VPN Adapter; C:\Windows\system32\DRIVERS\tapvpn.sys [2008-01-23 27136]

R3 usbfilter;AMD USB Filter Driver; C:\Windows\system32\DRIVERS\usbfilter.sys [2008-05-28 22072]

R3 VMC302;Vimicro Camera Service VMC302; C:\Windows\System32\Drivers\VMC302.sys [2008-08-28 241664]

R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller; C:\Windows\system32\DRIVERS\yk60x86.sys [2008-06-27 303616]

R4 catchme;catchme; \??\C:\Users\PDvaS\AppData\Local\Temp\catchme.sys []

S1 gxvxcserv.sys;gxvxcserv.sys; C:\Windows\system32\drivers\gxvxcserv.sys []

S3 AgereSoftModem;Agere Systems Soft Modem; C:\Windows\system32\DRIVERS\AGRSM.sys [2008-03-21 1203776]

S3 bcm4sbxp;Broadcom 440x 10/100 Integrated Controller XP Driver; C:\Windows\system32\DRIVERS\bcm4sbxp.sys [2006-11-02 45056]

S3 BthEnum;Bluetooth-Anforderungsblocktreiber; C:\Windows\system32\DRIVERS\BthEnum.sys [2008-01-21 19456]

S3 BthPan;Bluetooth-Gerät (PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2008-01-21 92160]

S3 BTHPORT;Bluetooth-Porttreiber; C:\Windows\System32\Drivers\BTHport.sys [2008-04-29 220160]

S3 BTHUSB;USB-Treiber für Bluetooth-Funkgerät; C:\Windows\System32\Drivers\BTHUSB.sys [2008-04-29 29184]

S3 btwaudio;Bluetooth-Audiogerät; C:\Windows\system32\drivers\btwaudio.sys [2008-02-14 80424]

S3 btwavdt;Bluetooth AVDT; C:\Windows\system32\drivers\btwavdt.sys [2007-07-16 80936]

S3 btwrchid;btwrchid; C:\Windows\system32\DRIVERS\btwrchid.sys [2007-07-16 16168]

S3 drmkaud;Microsoft Kernel-DRM-Audioentschlüsselung; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]

S3 ialm;ialm; C:\Windows\system32\DRIVERS\igdkmd32.sys [2006-10-19 1380864]

S3 mbr;mbr; \??\C:\Users\PDvaS\AppData\Local\Temp\mbr.sys []

S3 mferkdk;McAfee Inc. mferkdk; C:\Windows\system32\drivers\mferkdk.sys [2009-03-25 34216]

S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]

S3 MSPCLOCK;Microsoft Proxy für Streaming Clock; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]

S3 MSPQM;Microsoft Proxy für Streaming Quality Manager; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]

S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]

S3 NETw3v32;Intel(R) PRO/Wireless 3945ABG Adapter Driver for Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\NETw3v32.sys [2008-01-21 2225664]

S3 RFCOMM;Bluetooth-Gerät (RFCOMM-Protokoll-TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2008-02-21 50688]

S3 SynasUSB;SynasUSB; C:\Windows\system32\drivers\SynasUSB.sys [2006-11-23 18432]

S3 TASCAM_US122144;TASCAM USB 2.0 Audio Device driver; C:\Windows\System32\Drivers\tascusb2.sys [2007-12-18 360448]

S3 TASCAM_US122L_MIDI;TASCAM US-122L WDM MIDI Device; C:\Windows\system32\drivers\tscusb2m.sys [2007-12-18 18944]

S3 TASCAM_US122L_WDM;TASCAM US-122L WDM; C:\Windows\system32\drivers\tscusb2a.sys [2007-12-18 33792]

S3 usbvideo;USB-Videogerät (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-21 134016]

S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328]

S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]

S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]

S4 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2008-01-21 88576]

S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2008-01-21 11264]
 

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
 

R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-04-27 108289]

R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-03-02 185089]

R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2008-08-08 700416]

R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2008-01-21 21504]

R2 HotspotShieldService;Hotspot Shield Service; C:\Program Files\Hotspot Shield\bin\openvpnas.exe [2009-04-22 88624]

R2 HssSrv;Hotspot Shield Helper Service; C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe [2009-04-22 328752]

R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2008-03-17 73728]

R2 mcmscsvc;McAfee Services; C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe [2009-03-25 797864]

R2 McNASvc;McAfee Network Agent; c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe [2009-01-09 2482848]

R2 McShield;McAfee Real-time Scanner; C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe [2009-03-25 144704]

R2 MpfService;McAfee Personal Firewall Service; C:\Program Files\McAfee\MPF\MPFSrv.exe [2009-03-19 884360]

R2 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ); C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2006-04-14 28933976]

R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared Files\RichVideo.exe [2006-12-19 272024]

R2 TuneUp.ProgramStatisticsSvc;@%SystemRoot%\System32\TUProgSt.exe,-1; C:\Windows\System32\TUProgSt.exe [2009-05-05 604416]

R2 UxTuneUp;@%SystemRoot%\System32\uxtuneup.dll,-4096; C:\Windows\System32\svchost.exe [2008-01-21 21504]

R3 McSysmon;McAfee SystemGuards; C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe [2009-03-24 606736]

S2 McProxy;McAfee Proxy Service; c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe [2009-01-09 359952]

S2 Samsung Update Plus;Samsung Update Plus; C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exe [2008-05-13 77480]

S3 HssTrayService;Hotspot Shield Tray Service; C:\Program Files\Hotspot Shield\bin\HssTrayService.EXE [2009-04-22 34352]

S3 McODS;McAfee Scanner; C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe [2009-04-01 365072]

S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]

S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

S3 SQLWriter;SQL Server VSS Writer; C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2006-04-14 87840]

S3 TuneUp.Defrag;@%SystemRoot%\System32\TuneUpDefragService.exe,-1; C:\Windows\System32\TuneUpDefragService.exe [2009-05-05 360704]

S4 MSSQLServerADHelper;Hilfsdienst von SQL Server für Active Directory; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [2005-10-13 45272]

S4 SQLBrowser;SQL Server-Browser; C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2006-04-14 240416]
 

-----------------EOF-----------------

john.doe

23.05.2009 18:06

1.) Deinstalliere (falls möglich):

Fixwareout
Hotspot Shield 1.15
McAfee SecurityCenter (nie mehr als ein Antivirenprogramm einsetzen)
Spybot
SuperAntiSpyware

2.) How to uninstall or reinstall supported McAfee consumer products using the McAfee Consumer Products Removal tool (MCPR.exe)

3.) Scripten mit Combofix

Öffne den Editor (Start => Zubehör => Editor ) kopiere nun folgenden Text in das weiße Feld:

Code:

KILLALL::
 

Driver::

SASDIFSV

SASKUTIL

HssSrv

HssDrv

SASENUM

HssTrayService

mfehidk

MPFP

mfeavfk

mfebopk

mfesmfk

mbr

mferkdk

HotspotShieldService

mcmscsvc

McNASvc

McShield

MpfService

McSysmon

McProxy

HssTrayService

McODS
 

Registry::

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"mcagent_exe"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"=-

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=-

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MpfService]

[-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]

"EnableFirewall"=-

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{52556ED8-B928-40F7-B76D-C68EA6A214AC}"=-

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]

"EnableFirewall"=-

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]

"EnableFirewall"=-
 

Folder::

C:\ProgramData\Lavasoft

c:\programdata\SUPERAntiSpyware.com

c:\program files\SUPERAntiSpyware

c:\users\PDvaS\AppData\Roaming\SUPERAntiSpyware.com

c:\program files\Common Files\Wise Installation Wizard

c:\program files\Spybot - Search & Destroy

c:\programdata\Spybot - Search & Destroy

C:\fixwareout

C:\rsit

c:\program files\Hotspot Shield

c:\users\PDvaS\AppData\Roaming\Mozilla\Firefox\Profiles\wpnn7fzd.default\extensions\moveplayer@movenetworks.com

c:\program files\McAfee

c:\program files\McAfee.com

c:\program files\Common Files\McAfee

c:\programdata\McAfee
 

File::

c:\windows\Tasks\McQcTask.job

c:\windows\Tasks\McDefragTask.job

c:\windows\system32\perfc007.dat

c:\windows\system32\perfh007.dat

c:\windows\system32\drivers\Mpfp.sys

c:\users\PDvaS\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL

C:\aaw7boot.cmd

c:\users\PDvaS\AppData\Roaming\Mozilla\Firefox\Profiles\wpnn7fzd.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000006.dll
 

SysRst::

Speichere diese Datei nun auf dem Desktop unter -> cfscript.txt

Nun die Datei cfscript.txt mit der rechten Maustaste auf das Sysmbol von Combofix ziehen!

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

Danach das Combofix nochmal ausführen, das System neu starten und das Log von Combofix posten

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann.

ciao, andreas

PDvaS

23.05.2009 19:44

Code:

ComboFix 09-05-23.01 - PDvaS 23.05.2009 20:25.3 - NTFSx86

Microsoft® Windows Vista™ Home Premium   6.0.6001.1.1252.49.1031.18.3294.2298 [GMT 2:00]

ausgeführt von:: c:\users\PDvaS\Desktop\ComboFix.exe

Benutzte Befehlsschalter :: c:\users\PDvaS\Desktop\cfscript.txt

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
 

FILE ::

C:\aaw7boot.cmd

c:\users\PDvaS\AppData\Roaming\Mozilla\Firefox\Profiles\wpnn7fzd.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000006.dll

c:\users\PDvaS\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL

c:\windows\system32\drivers\Mpfp.sys

c:\windows\system32\perfc007.dat

c:\windows\system32\perfh007.dat

c:\windows\Tasks\McDefragTask.job

c:\windows\Tasks\McQcTask.job

.
 

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.
 

C:\aaw7boot.cmd

c:\programdata\Lavasoft

c:\programdata\Spybot - Search & Destroy

c:\programdata\Spybot - Search & Destroy\Configuration.ini

c:\programdata\Spybot - Search & Destroy\Logs\Checks.090518-2149.log

c:\programdata\Spybot - Search & Destroy\Logs\Checks.090518-2208.txt

c:\programdata\Spybot - Search & Destroy\Logs\Fixes.090519-0428.txt

c:\programdata\Spybot - Search & Destroy\Logs\Resident.log

c:\programdata\Spybot - Search & Destroy\ProcCache.sbc

c:\programdata\SUPERAntiSpyware.com

C:\rsit

c:\rsit\info.txt

c:\rsit\log.txt

c:\users\PDvaS\AppData\Roaming\Mozilla\Firefox\Profiles\wpnn7fzd.default\extensions\moveplayer@movenetworks.com

c:\users\PDvaS\AppData\Roaming\Mozilla\Firefox\Profiles\wpnn7fzd.default\extensions\moveplayer@movenetworks.com\chrome.manifest

c:\users\PDvaS\AppData\Roaming\Mozilla\Firefox\Profiles\wpnn7fzd.default\extensions\moveplayer@movenetworks.com\components\nsIMNQMP.xpt

c:\users\PDvaS\AppData\Roaming\Mozilla\Firefox\Profiles\wpnn7fzd.default\extensions\moveplayer@movenetworks.com\install.rdf

c:\users\PDvaS\AppData\Roaming\Mozilla\Firefox\Profiles\wpnn7fzd.default\extensions\moveplayer@movenetworks.com\META-INF\manifest.mf

c:\users\PDvaS\AppData\Roaming\Mozilla\Firefox\Profiles\wpnn7fzd.default\extensions\moveplayer@movenetworks.com\META-INF\zigbert.rsa

c:\users\PDvaS\AppData\Roaming\Mozilla\Firefox\Profiles\wpnn7fzd.default\extensions\moveplayer@movenetworks.com\META-INF\zigbert.sf

c:\users\PDvaS\AppData\Roaming\Mozilla\Firefox\Profiles\wpnn7fzd.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000006.dll

c:\users\PDvaS\AppData\Roaming\SUPERAntiSpyware.com

c:\windows\system32\perfc007.dat

c:\windows\system32\perfh007.dat
 

.

(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))

.
 

-------\Legacy_MBR

-------\Legacy_MPFP

-------\Legacy_SASDIFSV

-------\Legacy_SASENUM

-------\Legacy_SASKUTIL

-------\Service_HssTrayService

-------\Service_mbr
 
 

(((((((((((((((((((((((   Dateien erstellt von 2009-04-23 bis 2009-05-23  ))))))))))))))))))))))))))))))

.
 

2009-05-23 18:28 . 2009-05-23 18:30        --------        d-----w        c:\users\PDvaS\AppData\Local\temp

2009-05-21 14:15 . 2009-05-06 09:06        4784464        ----a-w        c:\programdata\Microsoft\Windows Defender\Definition Updates\{AB279D11-682B-4925-9232-08CCAE23C2A4}\mpengine.dll

2009-05-18 19:48 . 2009-04-06 13:32        38496        ----a-w        c:\windows\system32\drivers\mbamswissarmy.sys

2009-05-18 19:47 . 2009-05-18 19:47        2967799        ----a-w        c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

2009-05-17 11:51 . 2009-05-17 11:51        --------        d-----w        c:\users\PDvaS\AppData\Roaming\Malwarebytes

2009-05-17 11:51 . 2009-05-17 11:51        --------        d-----w        c:\programdata\Malwarebytes

2009-05-17 11:51 . 2009-04-06 13:32        15504        ----a-w        c:\windows\system32\drivers\mbam.sys

2009-05-17 11:51 . 2009-05-19 09:33        --------        d-----w        c:\program files\Malwarebytes' Anti-Malware

2009-05-17 11:21 . 2009-05-17 17:56        --------        d-----w        c:\program files\trend micro

2009-05-05 11:42 . 2009-05-05 11:42        604416        ----a-w        c:\windows\system32\TUProgSt.exe

2009-05-05 11:42 . 2009-03-20 14:01        17152        ----a-w        c:\windows\system32\authuitu.dll

2009-05-05 11:42 . 2009-03-20 14:01        28416        ----a-w        c:\windows\system32\uxtuneup.dll

2009-05-05 11:42 . 2009-05-05 11:42        360704        ----a-w        c:\windows\system32\TuneUpDefragService.exe

2009-05-04 10:44 . 2009-05-04 10:44        --------        d-----w        c:\users\PDvaS\AppData\Roaming\vlc

2009-04-29 17:43 . 2009-04-29 17:43        680        ----a-w        c:\users\PDvaS\AppData\Local\d3d9caps.dat
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-05-23 18:29 . 2008-09-02 03:43        12        ----a-w        c:\windows\bthservsdp.dat

2009-05-19 18:20 . 2009-04-23 10:53        --------        d-----w        c:\program files\Tsunami-Filter-Pack

2009-05-18 17:04 . 2009-02-26 14:47        --------        d-----w        c:\program files\CCleaner

2009-05-13 20:26 . 2006-11-02 11:18        --------        d-----w        c:\program files\Windows Mail

2009-05-05 11:42 . 2009-02-26 14:58        --------        d-----w        c:\program files\TuneUp Utilities 2009

2009-04-27 16:25 . 2009-03-19 11:44        96104        ----a-w        c:\windows\system32\drivers\avipbb.sys

2009-04-27 16:25 . 2009-03-19 11:44        55640        ----a-w        c:\windows\system32\drivers\avgntflt.sys

2009-04-23 11:05 . 2009-04-23 11:05        --------        d-----w        c:\program files\VistaCodecPack

2009-04-23 11:04 . 2009-04-23 11:04        --------        d-----w        c:\programdata\VistaCodecs

2009-04-23 10:54 . 2009-04-23 10:54        --------        d-----w        c:\program files\VirtualDub

2009-04-23 10:54 . 2009-04-23 10:54        --------        d-----w        c:\program files\Avisynth

2009-04-23 10:53 . 2008-09-01 11:46        --------        d--h--w        c:\program files\InstallShield Installation Information

2009-04-17 11:27 . 2009-03-09 20:38        --------        d-----w        c:\program files\Common Files\AVSMedia

2009-04-17 11:27 . 2009-03-09 20:37        --------        d-----w        c:\program files\AVS4YOU

2009-04-06 01:18 . 2009-04-06 01:18        84480        ----a-w        c:\windows\system32\ff_vfw.dll

2009-04-04 08:44 . 2009-03-01 17:21        --------        d-----w        c:\program files\Free FLV Converter

2009-03-30 17:27 . 2009-03-01 17:57        --------        d-----w        c:\program files\Java

2009-03-29 23:57 . 2009-03-29 23:57        62149        ----a-w        c:\windows\system32\pthreadGC2.dll

2009-03-28 10:17 . 2009-02-26 10:53        126312        ----a-w        c:\users\PDvaS\AppData\Local\GDIPFONTCACHEV1.DAT

2009-03-28 10:17 . 2009-03-28 10:17        --------        d-----w        c:\users\PDvaS\AppData\Roaming\Corel

2009-03-28 10:14 . 2009-03-28 10:14        --------        d-----w        c:\program files\Common Files\Corel

2009-03-28 10:14 . 2008-09-01 11:50        --------        d-----w        c:\program files\Common Files\InstallShield

2009-03-28 10:13 . 2009-03-28 10:13        --------        d-----w        c:\program files\Corel

2009-03-27 20:29 . 2009-03-27 20:28        --------        d-----w        c:\program files\Microsoft Picture It! 10

2009-03-27 18:36 . 2009-03-01 17:21        290816        ----a-w        c:\windows\system32\TubeFinder.exe

2009-03-25 11:57 . 2009-03-25 11:10        --------        d-----w        c:\program files\EA Sports

2009-03-25 11:20 . 2009-03-25 11:20        --------        d-----w        c:\users\PDvaS\AppData\Roaming\Leadertech

2009-03-17 06:44 . 2009-03-15 09:09        343        ----a-w        c:\windows\system32\dmlg.dat

2009-03-17 03:38 . 2009-04-17 09:40        13824        ----a-w        c:\windows\system32\apilogen.dll

2009-03-17 03:38 . 2009-04-17 09:40        24064        ----a-w        c:\windows\system32\amxread.dll

2009-03-14 13:48 . 2009-03-14 13:48        2892        ----a-w        c:\windows\system32\audcon.sys

2009-03-12 21:51 . 2009-03-12 21:51        1080648        ----a-w        c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

2009-03-09 03:19 . 2009-03-01 17:57        410984        ----a-w        c:\windows\system32\deploytk.dll

2009-03-03 04:46 . 2009-04-17 09:41        3599328        ----a-w        c:\windows\system32\ntkrnlpa.exe

2009-03-03 04:46 . 2009-04-17 09:41        3547632        ----a-w        c:\windows\system32\ntoskrnl.exe

2009-03-03 04:40 . 2009-04-17 09:40        827392        ----a-w        c:\windows\system32\wininet.dll

2009-03-03 04:39 . 2009-04-17 09:41        183296        ----a-w        c:\windows\system32\sdohlp.dll

2009-03-03 04:39 . 2009-04-17 09:41        551424        ----a-w        c:\windows\system32\rpcss.dll

2009-03-03 04:39 . 2009-04-17 09:41        26112        ----a-w        c:\windows\system32\printfilterpipelineprxy.dll

2009-03-03 04:37 . 2009-04-17 09:40        78336        ----a-w        c:\windows\system32\ieencode.dll

2009-03-03 04:37 . 2009-04-17 09:41        98304        ----a-w        c:\windows\system32\iasrecst.dll

2009-03-03 04:37 . 2009-04-17 09:41        54784        ----a-w        c:\windows\system32\iasads.dll

2009-03-03 04:37 . 2009-04-17 09:41        44032        ----a-w        c:\windows\system32\iasdatastore.dll

2009-03-03 03:04 . 2009-04-17 09:41        666624        ----a-w        c:\windows\system32\printfilterpipelinesvc.exe

2009-03-03 02:38 . 2009-04-17 09:41        17408        ----a-w        c:\windows\system32\iashost.exe

2009-03-03 02:28 . 2009-04-17 09:40        26624        ----a-w        c:\windows\system32\ieUnatt.exe

2009-02-26 11:30 . 2009-02-26 11:30        0        ----a-w        c:\windows\nsreg.dat

.
 

(((((((((((((((((((((((((((((   SnapShot@2009-05-23_10.44.23   )))))))))))))))))))))))))))))))))))))))))

.

+ 2008-01-21 01:58 . 2009-05-23 18:20        44258              c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin

+ 2006-11-02 13:05 . 2009-05-23 18:20        80512              c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin

+ 2009-02-26 10:52 . 2009-05-23 18:20        10774              c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3603111667-3364242315-3715489446-1003_UserData.bin

- 2009-02-26 10:48 . 2009-05-23 10:40        32768              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

+ 2009-02-26 10:48 . 2009-05-23 18:06        32768              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

- 2009-02-26 10:48 . 2009-05-23 10:40        49152              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

+ 2009-02-26 10:48 . 2009-05-23 18:06        49152              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

+ 2009-02-26 10:48 . 2009-05-23 18:06        32768              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

- 2009-02-26 10:48 . 2009-05-23 10:40        32768              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

- 2006-11-02 10:33 . 2009-05-23 10:35        633886              c:\windows\System32\perfh009.dat

+ 2006-11-02 10:33 . 2009-05-23 18:24        633886              c:\windows\System32\perfh009.dat

+ 2006-11-02 10:33 . 2009-05-23 18:24        118772              c:\windows\System32\perfc009.dat

- 2006-11-02 10:33 . 2009-05-23 10:35        118772              c:\windows\System32\perfc009.dat

+ 2009-05-23 18:15 . 2009-05-23 18:15        262144              c:\windows\System32\config\TxR\NTUSER.DAT

+ 2009-05-23 18:15 . 2009-05-23 18:15        262144              c:\windows\System32\config\RegBack\NTUSER.DAT

+ 2009-05-23 18:15 . 2009-05-23 18:15        262144              c:\windows\System32\config\Journal\NTUSER.DAT

.

(((((((((((((((((((((((((((((((((((((((   System Restore   )))))))))))))))))))))))))))))))))))))))))))))))))))

.
 

c:\windiag\CheckALS.exe

13.05.2008 02:57 135168 \RP70\A0072035.exe
 

c:\windiag\record.exe

21.07.2008 02:43 102400 \RP70\A0072026.exe

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-10-26 1029416]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-07-08 6273568]
 

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-2-12 723496]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]

"{1633AF2B-9328-4160-8B66-6430B6F351D3}"= c:\program files\CyberLink\PowerDVD\PowerDVD.EXE:CyberLink PowerDVD

"{0A0F4E71-824D-498C-BE09-43EF25998BAB}"= c:\program files\CyberLink\PowerDirector\PDR.EXE:CyberLink PowerDirector

"{A8774147-24CC-4B83-A493-BD4DFF50E236}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]

"c:\\Program Files\\FlashGet Network\\FlashGet universal\\FlashGet.exe"= c:\program files\FlashGet Network\FlashGet universal\FlashGet.exe:*:Enabled:Flashget2

"c:\\Program Files\\FlashGet Network\\FlashGet universal\\LiveUpdate.exe"= c:\program files\FlashGet Network\FlashGet universal\LiveUpdate.exe:*:Enabled:FGLiveUpdate

"c:\\Program Files\\FlashGet Network\\FlashGet universal\\LiveUpdateEx.exe"= c:\program files\FlashGet Network\FlashGet universal\LiveUpdateEx.exe:*:Enabled:FGLiveUpdateEx
 

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [19.03.2009 13:44 108289]

R2 KMDFMEMIO;SAMSUNG Kernel Driver;c:\windows\System32\drivers\KMDFMEMIO.sys [01.09.2008 14:07 13312]

R2 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [14.04.2006 03:07 28933976]

R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\System32\TUProgSt.exe [05.05.2009 13:42 604416]

R3 usbfilter;AMD USB Filter Driver;c:\windows\System32\drivers\usbfilter.sys [01.09.2008 13:46 22072]

R3 VMC302;Vimicro Camera Service VMC302;c:\windows\System32\drivers\vmc302.sys [01.09.2008 13:57 241664]

S3 SynasUSB;SynasUSB;c:\windows\System32\drivers\synasUSB.sys [14.03.2009 15:47 18432]

S3 TASCAM_US122144;TASCAM USB 2.0 Audio Device driver;c:\windows\System32\drivers\tascusb2.sys [14.03.2009 15:35 360448]

S3 TASCAM_US122L_MIDI;TASCAM US-122L WDM MIDI Device;c:\windows\System32\drivers\tscusb2m.sys [14.03.2009 15:35 18944]

S3 TASCAM_US122L_WDM;TASCAM US-122L WDM;c:\windows\System32\drivers\tscusb2a.sys [14.03.2009 15:35 33792]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bthsvcs        REG_MULTI_SZ           BthServ
 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs

UxTuneUp
 

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

"c:\program files\Common Files\LightScribe\LSRunOnce.exe"

.

Inhalt des "geplante Tasks" Ordners
 

2009-05-23 c:\windows\Tasks\1-Klick-Wartung.job

- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-03-20 14:17]
 

2009-05-23 c:\windows\Tasks\User_Feed_Synchronization-{8B38A101-D0BE-48FB-8E37-07E5DBD9AED5}.job

- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.jappy.de/

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

FF - ProfilePath - c:\users\PDvaS\AppData\Roaming\Mozilla\Firefox\Profiles\wpnn7fzd.default\

FF - prefs.js: browser.startup.homepage - w**.google.de

FF - prefs.js: network.proxy.type - 2

FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

FF - plugin: c:\program files\VistaCodecPack\rm\browser\plugins\nppl3260.dll

FF - plugin: c:\program files\VistaCodecPack\rm\browser\plugins\nprpjplug.dll
 

---- FIREFOX Richtlinien ----

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: nglayout.initialpaint.delay - 600

FF - user.js: content.notify.interval - 600000

FF - user.js: content.max.tokenizing.time - 1800000

FF - user.js: content.switch.threshold - 600000

.
 

**************************************************************************
 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-05-23 20:30

Windows 6.0.6001 Service Pack 1 NTFS
 

Scanne versteckte Prozesse... 
 

Scanne versteckte Autostarteinträge... 
 

Scanne versteckte Dateien... 
 

Scan erfolgreich abgeschlossen

versteckte Dateien: 0
 

**************************************************************************

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
 

- - - - - - - > 'Explorer.exe'(3380)

c:\windows\system32\btmmhook.dll

c:\windows\system32\btncopy.dll

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\windows\System32\Ati2evxx.exe

c:\windows\System32\audiodg.exe

c:\windows\System32\Ati2evxx.exe

c:\windows\System32\wlanext.exe

c:\program files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\program files\Common Files\LightScribe\LSSrvc.exe

c:\program files\CyberLink\Shared Files\RichVideo.exe

c:\windows\servicing\TrustedInstaller.exe

c:\windows\System32\conime.exe

c:\windows\ehome\ehmsas.exe

c:\program files\Synaptics\SynTP\SynTPHelper.exe

c:\windows\System32\wbem\WMIADAP.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2009-05-23 20:35 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2009-05-23 18:35

ComboFix2.txt  2009-05-23 10:45
 

Vor Suchlauf: 20 Verzeichnis(se), 96.765.689.856 Bytes frei

Nach Suchlauf: 19 Verzeichnis(se), 96.410.869.760 Bytes frei
 

249        --- E O F ---        2009-05-21 14:10

Ist es mir eigentlich gestattet, einige der Programme, die ich grade deinstalliert habe, wieder zu installieren? Weil ich SuperAntiSpyware für ziemlich nützlich empfunden habe.

Mfg PDvaS

john.doe

23.05.2009 20:11

Zitat:

Weil ich SuperAntiSpyware für ziemlich nützlich empfunden habe.

Kannst du natürlich machen, aber erst wenn wir fertig sind. Bei SuperAntiSpyware empfehle ich dir, den Wächter zu deaktivieren, der verursacht Probleme, ansonsten ist nichts gegen das Programm einzuwenden, ausser das es sämtliche Logs versaut.

1.) Start => Ausführen => combofix /u => OK

2.) GMER - Rootkit Detection

http://pic.leech.it/i/ab0bc/635985fgmer60.jpg

Lade Trallala von file-upload.net
Klick auf Download (rechts in der Mitte) und speichere es auf den Desktop
Doppelklick auf Trallala.exe
Drücke Scan, Der Vorgang kann je nach System 3 - 10min dauern
nach Beendigung des Scan, drücke "Copy"
nun kannst Du das Ergebnis hier einfügen. Sollte das Log zu lang sein, dann lade es bei einem Filehoster wie z.B. Materialordner hoch und poste den Link.
Sollte Gmer sagen "Gmer hasen´t found any System Modifikation", so hat Gmer keine Einträge gefunden.

3.) Kaspersky - Onlinescanner

Dieser Scanner entfernt die Funde nicht, gibt aber einen guten Überblick über die vorhandene Malware.

---> hier herunterladen => Kaspersky Lab: Anti-Virus, Internet Security, Mobile Security & Antiviren-Software und Services für Unternehmen
=> Hinweise zu älteren Versionen beachten!
=> Voraussetzung: Internet Explorer 6.0 oder höher
=> die nötigen ActiveX-Steuerelemente installieren => Update der Signaturen => Weiter
=> Scan-Einstellungen => Standard wählen => OK => Link "Arbeitsplatz" anklicken
=> Scan beginnt automatisch => Untersuchung wurde abgeschlossen => Protokoll speichern als
=> Dateityp auf .txt umstellen => auf dem Desktop als Kaspersky.txt speichern => Log hier posten
=> Deinstallation => Systemsteuerung => Software => Kaspersky Online Scanner entfernen

ciao, andreas

PDvaS

24.05.2009 00:03

Code:

GMER 1.0.15.14966 - h**p://www.gmer.net

Rootkit scan 2009-05-23 22:13:21

Windows 6.0.6001 Service Pack 1
 
 

---- System - GMER 1.0.15 ----
 

SSDT            9A8C2F7C                                                                                            ZwCreateThread

SSDT            9A8C2F68                                                                                            ZwOpenProcess

SSDT            9A8C2F6D                                                                                            ZwOpenThread

SSDT            9A8C2F77                                                                                            ZwTerminateProcess
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text           ntkrnlpa.exe!KeSetTimerEx + 454                                                                     81EF5A18 4 Bytes  [7C, 2F, 8C, 9A]

.text           ntkrnlpa.exe!KeSetTimerEx + 624                                                                     81EF5BE8 4 Bytes  [68, 2F, 8C, 9A]

.text           ntkrnlpa.exe!KeSetTimerEx + 640                                                                     81EF5C04 4 Bytes  [6D, 2F, 8C, 9A]

.text           ntkrnlpa.exe!KeSetTimerEx + 854                                                                     81EF5E18 4 Bytes  [77, 2F, 8C, 9A]
 

---- User IAT/EAT - GMER 1.0.15 ----
 

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown]                [74A77BA4] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage]                 [74AB98C5] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI]             [74A7D3C8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode]       [74A6F527] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup]                 [74A77599] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC]              [74A6E43D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM]  [74AAB33D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream]     [74A7D68A] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight]             [74A7012E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth]              [74A70095] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage]               [74A671F3] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM]       [74AFD802] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile]          [74A975E1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics]             [74A6DAE1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree]                       [74A6668F] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc]                      [74A666BA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[344] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode]         [74A71E45] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
 

---- Devices - GMER 1.0.15 ----
 

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                             Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                             Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
 

---- Registry - GMER 1.0.15 ----
 

Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\002119301b8d                         

Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\002119301b8e                         

Reg             HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\002119301b8d                             

Reg             HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\002119301b8e                             
 

---- Files - GMER 1.0.15 ----
 

File            C:\Windows\System32\LogFiles\HTTPERR\httperr1.log                                                   (size mismatch) 1324/993 bytes

File            C:\Windows\System32\spool\SpoolerETW.etl                                                            (size mismatch) 4096/0 bytes
 

---- EOF - GMER 1.0.15 ----

Kaspersky log:

Datei Upload, Bilder hochladen, Datei Hosting auf Materialordner.de

Mfg PDvaS

john.doe

24.05.2009 09:17

Wie geht es dem Rechner? Noch irgendwelche Auffälligkeiten?

ciao, andreas

PDvaS

24.05.2009 09:34

Den Rechner geht es eigentlich ziemlich gut. Auffäligkeiten gibt es auch nich mehr. War mit nur nich sicher ob das Problem auch wirklich komplett behoben ist und der Trojaner endgültig von meinem Rechner ist.

Mfg PDvaS

john.doe

24.05.2009 09:38

Dann bist du entlassen. :)

ciao, andreas

PDvaS

24.05.2009 09:40

:lach::lach::lach:na super das freut mich.

Dann nochmal ein großes Dankeschön, an alle dir mir geholfen haben.

:dankeschoen:

Alle Zeitangaben in WEZ +1. Es ist jetzt 23:25 Uhr.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131