|
Wie entferne ich Virus "System Security" ohne Internetverbindung? Hallo Zusammen, bin neu hier und hoffe, nach tagelanger Suche und Herumprobieren von verschiedenen Möglichkeiten hier HILFE zu bekommen:confused:: Seit Tagen legt "System Security" meinen Laptop lahm, habe bereits -allerdings nur im abgesicherten Modus, da ansonsten gar nichts geht! - den Spy-Doctor drüber laufen lassen, der hat jedoch nichts gefunden! Regedit.exe finde ich zwar beim Suchen der Datei unter C:\windows, allerdings lässt auch diese sich nicht öffnen! Da ich meinen Internet-Zugang nicht mehr aktivieren kann, ist auch Hijackthis nicht möglich! Welche Möglichkeiten seht ihr, wie ich diesen Virus endlich zum Schweigen bringe, ohne alles zu löschen und neu aufzuspielen? Wer weiß noch eine Möglichkeit, da ich mit meinen - eher nur "USer-Kenntnissen" am Ende bin? :heulen: Vielen Dank!!! Lischa |
Hallo Lischa und :hallo: Internetzugang wäre schon wichtig, denn ohne Logs und einigen Programmen, ist es komplizierter Malware zu entfernen. Hast du einen USB-Stick oder eine andere Möglichkeit, Programme von den Rechner, von dem aus du schreibst, Daten zu kopieren? Geht denn das Internet an deinem Laptop garnicht nicht mehr? mfg, Kaos |
Hallo Kaos, wir haben einen zweiten PC, von dem aus ich schreiben kann und auch ggf. Sachen herunterladen und auf den verseuchten Laptop aufspielen... Auf meinem lässt dieser mich überhaupt nicht mehr ins Netz, habe W-Lan und im abgesicherten Modus funktioniert nix mehr...im normalen Modus hält der Virus alles gesperrt...wie gesagt, so supertoll kenn ich mich nicht aus, wäre also gut, wenn ich eine Hilfe bekäme, wie vielleicht Internet auch im abgesicherten Modus zu verwenden wäre. Selbst bei dem Versuch, eine neue WLAN-Verbindung aufzubauen kapituliert der abgesicherte Modus und es kommt keine zustande. Bin jetzt dann ca. 3 Stunden offline...danach bin ich wieder da für Fragen und Hilfe Euererseits! Danke nochmals...und bis später! Gruß Lischa |
Hallo Zusammen, bin jetzt mit viel Glück wieder im Netz und versuchte über meinen PC Hijackthis laufen zu lassen...doch es kommt keinerlei Reaktion, d.h keine Auswertung der Log-Files etc....einfach gar nichts passierte! Was kann ich sonst noch machen? Vielen Dank für die -hoffentlich- schnelle Hilfe! Lischa |
Öffnet dich denn HijackThis nicht? Falls nicht, dann könntest du versuchen die HijackThis.exe in Htj.com umzubenennen, vielleicht klappt das ja. (Also die exe in dem Ordner, in dem es installiert wurde). Kannst du denn nicht in den abgesicherten Modus oder geht da nur Internet nicht? Schließe vorerst keine USB-Sticks oder andere externe Laufwerke an den infizierten PC, es könnte sein, das sonst auch der Saubere bald infiziert ist, wenn du diese Laufwerke dann wieder an den anschließt. mfg, Kaos |
kurz einspring Immer beim Anstecken des USB Sticks an alle beiden Rechner SHIFT gedrückt halten, sicher ist sicher, dass keine Malware sich auf dem Stick und somit auf dem anderen PC absetzen kann. ;) rausspring |
Hallo Zusammen, haben gestern nacht noch über den USB-Stick MALWARE aufgespielt, dann im abgesicherten Modus installiert und laufen lassen (auf allen Laufwerken!), hat einige böse Viren entdeckt und zerstört, dann konnte ich sogar im "normalen Modus" wieder ins Internet und habe dann noch den SPYDoktor drüber laufen lassen..., anschließend noch System Security in den Software-Programmen gelöscht...nach dem Neustart hat sich "System Security" nicht mehr gemeldet, allerdings bekomme ich ständig Meldungen von SPYDoctor: "Behavior Guard hat in BN25.TMP eine verdächtige Aktivität erkannt..." Dabei sind immer wieder unterschiedliche BN...TMP genannt, auch mal eine andere Datei "14407184"...Was hat nun das zu bedeuten? Muss ich befürchten, dass da noch was nicht passt? Danke für eure bisherige Hilfe! Lischa |
Es wäre sehr hilfreich, wenn du den Report von Malwarebytes hier reinstellen würdest. Falls deine anderer Rechner jetzt auch befallen ist, müssen wir erstmal einen nach dem anderen bereinigen. mfg, Kaos |
Hallo Kaos, wie gewünscht, hier der Report: Malwarebytes' Anti-Malware 1.38 Datenbank Version: 2369 Windows 5.1.2600 Service Pack 3 03.07.2009 21:01:25 mbam-log-2009-07-03 (21-01-25).txt Scan-Methode: Quick-Scan Durchsuchte Objekte: 90607 Laufzeit: 4 minute(s), 25 second(s) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 110 Infizierte Registrierungswerte: 1 Infizierte Dateiobjekte der Registrierung: 4 Infizierte Verzeichnisse: 1 Infizierte Dateien: 25 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ati64si (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\ati64si (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ati64si (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\i386si (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\i386si (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i386si (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ksi32sk (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\ksi32sk (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ksi32sk (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\nicsk32 (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\nicsk32 (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nicsk32 (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\port135sik (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\port135sik (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\port135sik (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\securentm (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\securentm (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\securentm (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVCONSOL.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP32.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapsvc.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapw32.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVNT.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navw32.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVWNT.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCAN32.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZONEALARM.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\filemon.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outpost.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regmon.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zapro.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgrssvc.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvMonitor.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.com (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASMain.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KASTask.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVDX.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32X.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPF.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OllyDBG.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regtool.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\niu.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\A2SERVICE.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGNT.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGUARD.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVSCAN.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdAgent.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CASecurityCENTER.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EKRN.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FAMEH32.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FPAVSERVER.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FPWIN.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FSAV32.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FSGK32ST.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FSMA32.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsserv.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\drwadins.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\drwebupw.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GFRing3.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ArcaCheck.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\arcavir.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashDisp.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashEnhcd.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashServ.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashUpd.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswUpdSv.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avadmin.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcls.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconfig.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avz.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avz4.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avz_se.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdinit.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\caav.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\caavguiscan.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccupdate.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfp.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfpupdat.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdAgent.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DRWEB32.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fpscan.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardgui.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardxservice.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardxup.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navigator.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVSTUB.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvcc.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\preupd.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pskdr.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SfFnUp.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Vba32arkit.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vba32ldr.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zanda.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zoneband.dll (Security.Hijack) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\acpi32 (Rootkit.Spamtool) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ws2_32sik (Rootkit.Agent) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\14190004 (Rogue.Multiple.H) -> Quarantined and deleted successfully. Infizierte Dateiobjekte der Registrierung: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders (Trojan.Dropper) -> Data: digiwet.dll -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Infizierte Verzeichnisse: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\14190004 (Rogue.Multiple.H) -> Quarantined and deleted successfully. Infizierte Dateien: c:\dokumente und einstellungen\all users\anwendungsdaten\14190004\14190004 (Rogue.Multiple.H) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\all users\anwendungsdaten\14190004\14190004.exe (Rogue.Multiple.H) -> Quarantined and deleted successfully. c:\WINDOWS\system32\actxprxy(2)v.exe (Trojan.Agent) -> Quarantined and deleted successfully. c:\WINDOWS\system32\drivers\ati64si.sys (Rootkit.Agent) -> Quarantined and deleted successfully. c:\WINDOWS\system32\drivers\i386si.sys (Rootkit.Agent) -> Quarantined and deleted successfully. c:\WINDOWS\system32\drivers\ksi32sk.sys (Rootkit.Agent) -> Quarantined and deleted successfully. c:\WINDOWS\system32\drivers\nicsk32.sys (Rootkit.Agent) -> Quarantined and deleted successfully. c:\WINDOWS\system32\drivers\port135sik.sys (Rootkit.Agent) -> Quarantined and deleted successfully. c:\WINDOWS\system32\drivers\securentm.sys (Rootkit.Agent) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\....\lokale einstellungen\Temp\BN2.tmp (Trojan.Rabbit) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\....\lokale einstellungen\Temp\pdfupd.exe (Trojan.Dropper) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\....\Lokale Einstellungen\Temp\BN3.tmp (Trojan.Agent) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\....\Lokale Einstellungen\Temp\BN4.tmp (Trojan.Agent) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\....\Lokale Einstellungen\Temp\BN5.tmp (Trojan.Agent) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\....\Lokale Einstellungen\Temp\BN6.tmp (Trojan.Agent) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\Lisa\Lokale Einstellungen\Temp\BN7.tmp (Trojan.Agent) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\....\Lokale Einstellungen\Temp\BN8.tmp (Trojan.Agent) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\....\lokale einstellungen\Temp\BN28.tmp (Trojan.Agent) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\....\lokale einstellungen\Temp\BNBA.tmp (Trojan.Agent) -> Quarantined and deleted successfully. c:\WINDOWS\Temp\BN1C.tmp (Trojan.Agent) -> Quarantined and deleted successfully. c:\WINDOWS\Temp\BN2A.tmp (Trojan.Agent) -> Quarantined and deleted successfully. c:\WINDOWS\Temp\BN2C.tmp (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\digiwet.dll (Trojan.Dropper) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\....\oashdihasidhasuidhiasdhiashdiuasdhasd (Trace.Pandex) -> Quarantined and deleted successfully. c:\dokumente und einstellungen\LocalService\oashdihasidhasuidhiasdhiashdiuasdhasd (Trace.Pandex) -> Quarantined and deleted successfully. Derzeit sieht es zwar nicht so aus, als wären die anderen Rechner befallen, nur ist mein Internet immer noch extrem langsam und einige Funktionen (wie antivir und Incredimail) funktionieren noch nicht bzw. nicht einwandfrei! Antivir ist leider nicht zu aktivieren und auch nicht neu zu installieren...selbst das Löschen des alten Programmes ist nicht möglich... :heulen: So long Lischa |
Eine Bereinigung wäre hier sicher recht langwierig. Ich würde dir eine Neuinstallation empfehlen, das würde wohl schneller gehen und wäre sicherer. Hast du die anderen Rechner auch schon geprüft? mfg, Kaos |
Also der andere Rechner ist nicht befallen, haben wir gleich mit scannen lassen, auch die externe Festplatte scheint clean zu sein. Nur eben ein paar "kleine Schwierigkeiten", wie bereits erwähnt, zeigen, dass noch nicht alles o.k. ist. Meinst du, dass es gehen würde, wenn ich die Windows Repair-Funktion mal testen könnte...alles neu zu installieren ist echt fast unmöglich, da ich sooo viele Dateien und auch Programme, Treiber etc. drauf habe, die ich unbedingt brauche und wenn ich da was übersehe, wäre das echt übel! Oder gibts über "regedit" oder ähnliches noch die Möglichkeit, das ganze zu reparieren. Auch wenn es langwierig ist, würde ich diese Möglichkeit nutzen, weil, wie gesagt, löschen und neu aufspielen ist echt absolut übel und nicht vorstellbar... Dank' dir schon mal für deine Hilfe... Viele Grüße Lischa |
Vorab: Ändere bitte von einem sauberen Rechner aus alle deine Passwörter, die du online verwendest. Okay, ich denke, dass es dort noch einiges zu tun gibt. Wenn das Internet nun bei dem infizierten PC wieder funktioniert solltest du erstmal nur mit dem arbeiten. 1. Rootkitsuche mit Gmer:
mfg, Kaos |
Hallo Kaos, habe nun den Schritt 1 nach deinen Anweisungen gemacht, lediglich übersehen, Gmer auf dem Desktop zu speichern (speicherte ihn unter Download...) und die Ergebnisse sind leider viel zu groß, um sie heir zu posten. Wie kann ich diese übermitteln? Habe sie mir mal sicherheitshalber in Word gespeichert! Gruß Lischa |
...und nun die Daten von RSIT...leider sind auch diese nicht ganz so wie gewünscht! Logfile of random's system information tool 1.06 (written by random/random) Run by Lisa at 2009-07-06 20:16:27 Microsoft Windows XP Home Edition Service Pack 3 System drive C: has 115 GB (81%) free of 143 GB Total RAM: 1791 MB (50% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:16:35, on 06.07.2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16827) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\svchost.exe C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe C:\Programme\Bonjour\mDNSResponder.exe C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EPSON\EPW!3 SSRP\E_S40RP7.EXE C:\Programme\Java\jre6\bin\jqs.exe C:\WINDOWS\System32\msdtc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\locator.exe C:\Programme\Spyware Doctor\pctsAuxs.exe C:\Programme\Spyware Doctor\pctsSvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\LAUNCH~1\LManager.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\RTHDCPL.EXE C:\Programme\Gemeinsame Dateien\Lexware\Update Manager\LxUpdateManager.exe C:\Programme\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe C:\Programme\Gemeinsame Dateien\Ulead Systems\AutoDetector\monitor.exe C:\Programme\Java\jre6\bin\jusched.exe C:\Programme\iTunes\iTunesHelper.exe C:\Programme\Spyware Doctor\pctsTray.exe C:\Programme\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\Messenger\msmsgs.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIE.EXE C:\Programme\EPSON\EPSON SMART PANEL for Scanner\ESPmain.exe C:\Programme\WinZip\WZQKPICK.EXE C:\DOKUME~1\....\LOKALE~1\Temp\RtkBtMnt.exe C:\Programme\IncrediMail\bin\IncMail.exe C:\WINDOWS\System32\wbem\wmiapsrv.exe C:\Programme\IncrediMail\bin\IMApp.exe C:\Programme\iPod\bin\iPodService.exe C:\Programme\Spyware Doctor\TFEngine\TFService.exe C:\WINDOWS\System32\alg.exe C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe C:\WINDOWS\system32\wscntfy.exe C:\Programme\IncrediMail\bin\IncMail.exe C:\Programme\Internet Explorer\IEXPLORE.EXE C:\Programme\IncrediMail\bin\ImNotfy.exe C:\DOKUME~1\Lisa\LOKALE~1\Temp\Google Toolbar\gtb4F.tmp.exe C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Dokumente und Einstellungen\Lisa\Desktop\RSIT.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Programme\trend micro\Lisa.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: Shareware.Pro-DE Toolbar - {378486bf-e1b5-4474-9feb-ad51105d0fae} - C:\Programme\Shareware.Pro-DE\tbSha1.dll O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: Shareware.Pro-DE Toolbar - {378486bf-e1b5-4474-9feb-ad51105d0fae} - C:\Programme\Shareware.Pro-DE\tbSha1.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Shareware.Pro-DE Toolbar - {378486bf-e1b5-4474-9feb-ad51105d0fae} - C:\Programme\Shareware.Pro-DE\tbSha1.dll O3 - Toolbar: (no name) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - (no file) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll O4 - HKLM\..\Run: [Apoint] C:\Programme\Apoint2K\Apoint.exe O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [LexwareInfoService] C:\Programme\Gemeinsame Dateien\Lexware\Update Manager\LxUpdateManager.exe /autostart O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programme\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Programme\Gemeinsame Dateien\Ulead Systems\AutoDetector\monitor.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [ISTray] "C:\Programme\Spyware Doctor\pctsTray.exe" O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Google Desktop Search] "C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Automatisch R220 auf WALTER1] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIE.EXE /FU "C:\WINDOWS\TEMP\E_S22D.tmp" /EF "HKCU" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Programme\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: EPSON SMART PANEL for Scanner.lnk = C:\Programme\EPSON\EPSON SMART PANEL for Scanner\ESPmain.exe O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O12 - Plugin for .UVR: C:\Programme\Internet Explorer\Plugins\NPUPano.dll O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1206522479432 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1206522555646 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://www.lokalisten.de/iup/ImageUploader4.cab O18 - Protocol: haufereader - (no CLSID) - (no file) O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Unknown owner - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe (file missing) O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Unknown owner - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe (file missing) O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Intelligenter Hintergrundübertragungsdienst (BITS) - Unknown owner - C:\WINDOWS\ O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EPSON\EPW!3 SSRP\E_S40RP7.EXE O23 - Service: GoogleDesktopManager - Google - C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Sitzungs-Manager für Remotedesktophilfe RDSessMgrHTTPFilter (RDSessMgrHTTPFilter) - Unknown owner - C:\WINDOWS\system32\actxprxy(2)v.exe (file missing) O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Programme\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Programme\Spyware Doctor\pctsSvc.exe O23 - Service: ThreatFire - PC Tools - C:\Programme\Spyware Doctor\TFEngine\TFService.exe O23 - Service: Automatische Updates (wuauserv) - Unknown owner - C:\WINDOWS\ -- End of file - 11136 bytes ======Scheduled tasks folder====== C:\WINDOWS\tasks\AppleSoftwareUpdate.job C:\WINDOWS\tasks\Google Software Updater.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] Adobe PDF Reader - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23 62080] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}] RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2008-08-09 308856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{378486bf-e1b5-4474-9feb-ad51105d0fae}] Shareware.Pro-DE Toolbar - C:\Programme\Shareware.Pro-DE\tbSha1.dll [2009-05-21 2094616] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}] Google Toolbar Helper - c:\programme\google\googletoolbar1.dll [2009-07-06 2403392] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}] Google Toolbar Notifier BHO - C:\Programme\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-03-25 668656] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java(tm) Plug-In 2 SSV Helper - C:\Programme\Java\jre6\bin\jp2ssv.dll [2009-03-09 35840] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] JQSIEStartDetectorImpl Class - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-03-09 73728] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {378486bf-e1b5-4474-9feb-ad51105d0fae} - Shareware.Pro-DE Toolbar - C:\Programme\Shareware.Pro-DE\tbSha1.dll [2009-05-21 2094616] {3041d03e-fd4b-44e0-b742-2d9b88305f98} {2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\programme\google\googletoolbar1.dll [2009-07-06 2403392] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "Apoint"=C:\Programme\Apoint2K\Apoint.exe [2007-07-24 159744] "LManager"=C:\PROGRA~1\LAUNCH~1\LManager.exe [2007-07-24 752136] "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2007-07-24 8433664] "nwiz"=nwiz.exe /install [] "NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2007-07-24 81920] "RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2007-07-05 16380416] "Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632] "LexwareInfoService"=C:\Programme\Gemeinsame Dateien\Lexware\Update Manager\LxUpdateManager.exe [2008-09-11 339240] "Adobe Photo Downloader"=C:\Programme\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe [2007-03-16 63712] "TkBellExe"=C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe [2008-08-09 185896] "Ulead AutoDetector v2"=C:\Programme\Gemeinsame Dateien\Ulead Systems\AutoDetector\monitor.exe [2004-08-27 90112] "SunJavaUpdateSched"=C:\Programme\Java\jre6\bin\jusched.exe [2009-03-09 148888] "QuickTime Task"=C:\Programme\QuickTime\qttask.exe [2009-01-05 413696] "iTunesHelper"=C:\Programme\iTunes\iTunesHelper.exe [2009-04-02 342312] "ISTray"=C:\Programme\Spyware Doctor\pctsTray.exe [2008-12-08 1173384] "SynTPEnh"=C:\Programme\Synaptics\SynTP\SynTPEnh.exe [2007-07-24 827392] "Google Desktop Search"=C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe [2009-07-06 1862144] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360] "MSMSGS"=C:\Programme\Messenger\msmsgs.exe [2008-04-14 1695232] "Automatisch R220 auf WALTER1"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIE.EXE [2006-12-25 177664] C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart Adobe Reader - Schnellstart.lnk - C:\Programme\Adobe\Reader 8.0\Reader\reader_sl.exe Adobe Reader Synchronizer.lnk - C:\Programme\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe EPSON SMART PANEL for Scanner.lnk - C:\Programme\EPSON\EPSON SMART PANEL for Scanner\ESPmain.exe Microsoft Office.lnk - C:\Programme\Microsoft Office\Office10\OSA.EXE WinZip Quick Pick.lnk - C:\Programme\WinZip\WZQKPICK.EXE [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLS"="C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdauxservice] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdcoreservice] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vsmon] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "HonorAutoRunSetting"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\Programme\IncrediMail\bin\IncMail.exe"="C:\Programme\IncrediMail\bin\IncMail.exe:*:Enabled:IncrediMail" "C:\Programme\IncrediMail\bin\ImApp.exe"="C:\Programme\IncrediMail\bin\ImApp.exe:*:Enabled:IncrediMail" "C:\Programme\IncrediMail\bin\ImpCnt.exe"="C:\Programme\IncrediMail\bin\ImpCnt.exe:*:Enabled:IncrediMail" "C:\Programme\Mozilla Firefox\firefox.exe"="C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox" "C:\Program Files\Real\RealPlayer\realplay.exe"="C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer" "C:\Programme\LimeWire\LimeWire.exe"="C:\Programme\LimeWire\LimeWire.exe:*:Enabled:LimeWire" "C:\Programme\Bonjour\mDNSResponder.exe"="C:\Programme\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour" "C:\Programme\iTunes\iTunes.exe"="C:\Programme\iTunes\iTunes.exe:*:Enabled:iTunes" "C:\Programme\Gemeinsame Dateien\Ulead Systems\AutoDetector\Monitor.exe"="C:\Programme\Gemeinsame Dateien\Ulead Systems\AutoDetector\Monitor.exe:*:Enabled:ENABLE" "C:\Programme\Synaptics\SynTP\SynTPEnh.exe"="C:\Programme\Synaptics\SynTP\SynTPEnh.exe:*:Enabled:ENABLE" "C:\Programme\Launch Manager\LManager.exe"="C:\Programme\Launch Manager\LManager.exe:*:Enabled:ENABLE" "C:\WINDOWS\system32\RUNDLL32.EXE"="C:\WINDOWS\system32\RUNDLL32.EXE:*:Enabled:ENABLE" "C:\WINDOWS\RTHDCPL.EXE"="C:\WINDOWS\RTHDCPL.EXE:*:Enabled:ENABLE" "C:\Programme\Gemeinsame Dateien\Lexware\Update Manager\LxUpdateManager.exe"="C:\Programme\Gemeinsame Dateien\Lexware\Update Manager\LxUpdateManager.exe:*:Enabled:ENABLE" "C:\Programme\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"="C:\Programme\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe:*:Enabled:ENABLE" "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe"="C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe:*:Enabled:ENABLE" "C:\WINDOWS\system32\userinit.exe"="C:\WINDOWS\system32\userinit.exe:*:Enabled:ENABLE" "C:\WINDOWS\Explorer.EXE"="C:\WINDOWS\Explorer.EXE:*:Enabled:ENABLE" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" Teil II folgt in der nächsten Antwort aufgrund der Größe der Datei leider zwangsweise geteilt! "rsit" finde ich nur ohne nähere Bezeichnung (also die zwei genannten Logfiles kann ich nicht entdecken!)...würde gerne mehr helfen, weiß aber nicht wie! Danke schonmal vorab für deine Antwort! Gruß Lischa |
...Teil II ======List of files/folders created in the last 3 months====== 2009-07-06 20:16:28 ----D---- C:\Programme\trend micro 2009-07-06 20:16:27 ----D---- C:\rsit 2009-07-06 17:38:19 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Google 2009-07-04 14:35:43 ----D---- C:\Programme\Wise Registry Cleaner 2009-07-04 14:33:53 ----D---- C:\Programme\VS Revo Group 2009-07-04 13:18:56 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MailFrontier 2009-07-04 13:17:02 ----D---- C:\WINDOWS\Internet Logs 2009-07-04 09:41:08 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\17840004 2009-07-04 09:35:25 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\14407184 2009-07-04 09:31:37 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\12134374 2009-07-04 09:29:43 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\10994844 2009-07-03 20:55:12 ----D---- C:\Dokumente und Einstellungen\Lisa\Anwendungsdaten\Malwarebytes 2009-07-03 20:55:07 ----D---- C:\Programme\Malwarebytes' Anti-Malware 2009-07-03 20:55:07 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes 2009-07-01 19:20:33 ----AD---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP 2009-07-01 19:19:45 ----D---- C:\Dokumente und Einstellungen\...\Anwendungsdaten\PC Tools 2009-07-01 19:19:45 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Tools 2009-07-01 18:53:42 ----D---- C:\Programme\Avira 2009-07-01 18:53:42 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira 2009-07-01 18:53:40 ----D---- C:\THINK_X 2009-07-01 18:35:51 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\13439374 2009-07-01 18:26:15 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira(2) 2009-07-01 17:16:08 ----D---- C:\Programme\Gemeinsame Dateien\PC Tools 2009-07-01 17:15:43 ----D---- C:\Programme\Spyware Doctor 2009-06-30 20:56:05 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\12465314 2009-06-30 20:01:05 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\12419844 2009-06-30 19:53:11 ----A---- C:\WINDOWS\ntbtlog.txt 2009-06-30 19:48:11 ----D---- C:\WINDOWS\pss 2009-06-01 13:29:41 ----A---- C:\WINDOWS\system32\GEARAspi.dll 2009-06-01 13:29:16 ----D---- C:\Programme\iPod 2009-06-01 13:29:11 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} 2009-06-01 13:29:10 ----D---- C:\Programme\iTunes 2009-06-01 13:28:53 ----D---- C:\Programme\Bonjour 2009-06-01 13:28:04 ----D---- C:\Programme\QuickTime 2009-06-01 13:28:02 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Apple Computer 2009-06-01 13:27:01 ----D---- C:\Programme\Apple Software Update 2009-06-01 13:26:28 ----D---- C:\Programme\Gemeinsame Dateien\Apple 2009-06-01 13:08:33 ----D---- C:\Dokumente und Einstellungen\...\Anwendungsdaten\vlc 2009-06-01 13:07:49 ----D---- C:\Programme\VideoLAN 2009-06-01 13:06:37 ----A---- C:\WINDOWS\system32\dspund3d.dll 2009-06-01 13:06:10 ----N---- C:\WINDOWS\system32\spmsg.dll 2009-06-01 13:04:31 ----D---- C:\1fa9a7c25e9e616bae0fd10af05c9bd1 2009-05-20 12:56:38 ----A---- C:\WINDOWS\system32\javaws.exe 2009-05-20 12:56:38 ----A---- C:\WINDOWS\system32\javaw.exe 2009-05-20 12:56:38 ----A---- C:\WINDOWS\system32\java.exe 2009-05-18 17:55:49 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\LIDL Fotoservice 2009-05-16 16:27:49 ----A---- C:\WINDOWS\cdplayer.ini 2009-05-11 19:43:09 ----D---- C:\Programme\Shareware.Pro-DE 2009-05-11 19:43:09 ----D---- C:\Programme\Conduit 2009-05-11 19:36:37 ----D---- C:\Dokumente und Einstellungen\Lisa\Anwendungsdaten\LimeWire 2009-04-15 21:28:12 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$ 2009-04-15 21:28:05 ----HDC---- C:\WINDOWS\$NtUninstallKB961373$ 2009-04-15 21:26:01 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$ 2009-04-15 21:25:32 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$ 2009-04-15 21:25:12 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$ 2009-04-15 21:25:03 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$ ======List of files/folders modified in the last 3 months====== 2009-07-06 20:16:28 ----RD---- C:\Programme 2009-07-06 20:16:20 ----D---- C:\WINDOWS\Prefetch 2009-07-06 20:15:07 ----D---- C:\WINDOWS\Temp 2009-07-06 19:59:37 ----SD---- C:\WINDOWS\Tasks 2009-07-06 19:59:33 ----D---- C:\Programme\Google 2009-07-06 17:39:29 ----D---- C:\WINDOWS 2009-07-06 17:38:21 ----SHD---- C:\WINDOWS\Installer 2009-07-06 17:38:21 ----D---- C:\Config.Msi 2009-07-06 17:38:18 ----D---- C:\WINDOWS\system32\CatRoot2 2009-07-06 17:29:34 ----D---- C:\WINDOWS\system32\drivers 2009-07-06 17:29:12 ----D---- C:\WINDOWS\system32\ias 2009-07-05 21:49:25 ----A---- C:\WINDOWS\SchedLgU.Txt 2009-07-05 21:40:22 ----D---- C:\Programme\Mozilla Firefox 2009-07-05 21:18:00 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Google Updater 2009-07-05 21:17:36 ----D---- C:\WINDOWS\system32 2009-07-04 13:40:21 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI 2009-07-04 13:18:20 ----HD---- C:\WINDOWS\inf 2009-07-04 11:39:39 ----D---- C:\WINDOWS\WinSxS 2009-07-03 22:07:39 ----SHD---- C:\System Volume Information 2009-07-03 22:07:39 ----D---- C:\WINDOWS\system32\Restore 2009-07-03 18:11:23 ----D---- C:\WINDOWS\Minidump 2009-07-01 18:55:34 ----D---- C:\WINDOWS\system32\config 2009-07-01 18:55:18 ----D---- C:\WINDOWS\system32\wbem 2009-07-01 18:55:18 ----D---- C:\WINDOWS\Registration 2009-07-01 18:55:03 ----D---- C:\WINDOWS\CRYSTAL 2009-07-01 18:55:03 ----D---- C:\Programme\LoesMich 2009-07-01 18:54:41 ----RSHDC---- C:\WINDOWS\system32\dllcache 2009-07-01 18:54:13 ----D---- C:\Programme\Gemeinsame Dateien\Adobe 2009-07-01 17:16:08 ----D---- C:\Programme\Gemeinsame Dateien 2009-06-30 20:04:07 ----A---- C:\WINDOWS\win.ini 2009-06-30 20:04:07 ----A---- C:\WINDOWS\system.ini 2009-06-30 19:53:24 ----D---- C:\Dokumente und Einstellungen 2009-06-29 12:51:30 ----D---- C:\Dokumente und Einstellungen\Lisa\Anwendungsdaten\WordToPDF 2009-06-28 15:41:39 ----D---- C:\Programme\Adobe 2009-06-12 18:12:44 ----SD---- C:\WINDOWS\Downloaded Program Files 2009-06-02 21:23:06 ----D---- C:\Dokumente und Einstellungen\Lisa\Anwendungsdaten\gtk-2.0 2009-06-02 19:37:27 ----D---- C:\Programme\OXXOGames 2009-06-01 13:44:45 ----D---- C:\WINDOWS\uninstall 2009-06-01 13:42:59 ----D---- C:\Programme\JoWooD 2009-06-01 13:41:09 ----D---- C:\WINDOWS\system32\MAGIX 2009-06-01 13:29:41 ----DC---- C:\WINDOWS\system32\DRVSTORE 2009-06-01 13:06:11 ----D---- C:\WINDOWS\system32\CatRoot 2009-06-01 13:05:55 ----D---- C:\Programme\Windows Media Player 2009-06-01 13:05:52 ----D---- C:\WINDOWS\Help 2009-05-20 12:56:37 ----D---- C:\Programme\Java 2009-05-16 17:27:30 ----A---- C:\WINDOWS\Pex.INI 2009-05-16 13:13:16 ----D---- C:\Programme\Launch Manager 2009-05-11 19:37:04 ----D---- C:\Dokumente und Einstellungen\Lisa\Anwendungsdaten\Mozilla 2009-05-07 09:16:29 ----A---- C:\WINDOWS\system32\MRT.exe 2009-04-24 19:15:49 ----HD---- C:\Programme\InstallShield Installation Information 2009-04-17 21:14:20 ----D---- C:\WINDOWS\AppPatch 2009-04-15 21:28:09 ----A---- C:\WINDOWS\imsins.BAK 2009-04-15 21:27:52 ----D---- C:\WINDOWS\system32\de-de 2009-04-15 21:27:51 ----D---- C:\Programme\Internet Explorer 2009-04-15 21:25:57 ----HD---- C:\WINDOWS\$hf_mig$ ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2008-11-11 75072] R1 DritekPortIO;Dritek General Port I/O; \??\C:\PROGRA~1\LAUNCH~1\DPortIO.sys [] R1 pctgntdi;pctgntdi; \??\C:\WINDOWS\system32\drivers\pctgntdi.sys [] R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2008-04-19 21248] R1 WmiAcpi;Microsoft Windows-Verwaltungsschnittstelle für ACPI; C:\WINDOWS\System32\DRIVERS\wmiacpi.sys [2008-04-13 8832] R1 WS2IFSL;Windows Socket 2.0 Non-IFS-Dienstanbieter-Unterstützungsumgebung; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2002-08-29 12032] R2 mdmxsdk;mdmxsdk; C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys [2007-07-24 12672] R2 rimmptsk;rimmptsk; C:\WINDOWS\System32\DRIVERS\rimmptsk.sys [2007-02-24 39936] R2 rimsptsk;rimsptsk; C:\WINDOWS\System32\DRIVERS\rimsptsk.sys [2007-01-23 42496] R2 rismxdp;Ricoh xD-Picture Card Driver; C:\WINDOWS\System32\DRIVERS\rixdptsk.sys [2007-03-21 37376] R3 AR5211;Atheros Wireless Network Adapter Service; C:\WINDOWS\System32\DRIVERS\ar5211.sys [2007-07-26 547904] R3 Arp1394;1394-ARP-Clientprotokoll; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2008-04-13 60800] R3 CmBatt;Treiber für Microsoft-ACPI-Kontrollmethodenkompatible Batterie; C:\WINDOWS\System32\DRIVERS\CmBatt.sys [2008-04-13 13952] R3 DKbFltr;Dritek Keyboard Filter Driver; C:\WINDOWS\System32\DRIVERS\DKbFltr.sys [2007-07-24 16896] R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-03-19 23400] R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\System32\DRIVERS\HDAudBus.sys [2005-01-07 138752] R3 hidusb;Microsoft HID Class-Treiber; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2008-04-13 10368] R3 HSF_DPV;HSF_DPV; C:\WINDOWS\System32\DRIVERS\HSF_DPV.sys [2007-07-24 988800] R3 HSFHWAZL;HSFHWAZL; C:\WINDOWS\System32\DRIVERS\HSFHWAZL.sys [2007-07-24 209664] R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-07-18 4547584] R3 mouhid;Maus-HID-Treiber; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2002-08-29 12288] R3 NIC1394;1394-Netzwerktreiber; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2008-04-13 61824] R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2007-07-24 6365984] R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\System32\DRIVERS\NVENETFD.sys [2007-07-24 46720] R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\System32\DRIVERS\nvnetbus.sys [2007-07-24 19968] R3 nvsmu;nvsmu; C:\WINDOWS\System32\DRIVERS\nvsmu.sys [2007-07-24 12032] R3 pctplsg;pctplsg; \??\C:\WINDOWS\system32\drivers\pctplsg.sys [] R3 sdbus;sdbus; C:\WINDOWS\System32\DRIVERS\sdbus.sys [2008-04-13 79232] R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\System32\DRIVERS\SynTP.sys [2007-07-24 201856] R3 TfNetMon;TfNetMon; \??\C:\WINDOWS\system32\drivers\TfNetMon.sys [] R3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128] R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2008-04-13 30208] R3 usbhub;USB2-aktivierter Hub; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520] R3 usbohci;Miniporttreiber für Microsoft USB Open Host-Controller; C:\WINDOWS\System32\DRIVERS\usbohci.sys [2008-04-13 17152] R3 usbvideo;USB-Videogerät (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-13 121984] R3 winachsf;winachsf; C:\WINDOWS\System32\DRIVERS\HSF_CNXT.sys [2007-07-24 730112] S1 70ddafe7;70ddafe7; C:\WINDOWS\System32\drivers\70ddafe7.sys [] S1 avgio;avgio; \??\C:\Programme\Avira\AntiVir PersonalEdition Classic\avgio.sys [] S2 securentm;securentm; \??\C:\WINDOWS\system32\drivers\securentm.sys [] S3 ApfiltrService;Alps Pointing-device Filter Driver; C:\WINDOWS\System32\DRIVERS\Apfiltr.sys [2007-07-24 154624] S3 aujasnkj;aujasnkj; \??\C:\DOKUME~1\Lisa\LOKALE~1\Temp\aujasnkj.sys [] S3 avgntflt;avgntflt; \??\C:\Programme\Avira\AntiVir PersonalEdition Classic\avgntflt.sys [] S3 btaudio;Bluetooth-Audiogerät; C:\WINDOWS\system32\drivers\btaudio.sys [] S3 BTDriver;Virtueller Bluetooth-Kommunikationstreiber; C:\WINDOWS\System32\DRIVERS\btport.sys [] S3 BTWDNDIS;Bluetooth-LAN-Zugangsserver; C:\WINDOWS\System32\DRIVERS\btwdndis.sys [] S3 btwhid;btwhid; C:\WINDOWS\System32\DRIVERS\btwhid.sys [] S3 CCDECODE;Untertiteldecoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024] S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504] S3 NABTSFEC;NABTS/FEC VBI-Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248] S3 NdisIP;Microsoft TV-/Videoverbindung; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880] S3 sffdisk;SFF-Speicherklassentreiber; C:\WINDOWS\system32\DRIVERS\sffdisk.sys [2008-04-13 11904] S3 sffp_sd;SFF-Speicherprotokolltreiber für SDBus; C:\WINDOWS\system32\DRIVERS\sffp_sd.sys [2008-04-13 11008] S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136] S3 streamip;BDA-IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232] S3 UIUSys;Conexant Setup API; C:\WINDOWS\System32\DRIVERS\UIUSYS.SYS [2007-07-24 6909] S3 usbprint;Microsoft USB-Druckerklasse; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856] S3 usbscan;USB-Scannertreiber; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104] S3 USBSTOR;USB-Massenspeichertreiber; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368] S3 Wdf01000;Wdf01000; C:\WINDOWS\System32\DRIVERS\Wdf01000.sys [2006-11-02 492000] S3 WSTCODEC;World Standard Teletext-Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200] S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568] S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944] S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 Apple Mobile Device;Apple Mobile Device; C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-03-26 132424] R2 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800] R2 Bonjour Service;Bonjour-Dienst; C:\Programme\Bonjour\mDNSResponder.exe [2008-12-12 238888] R2 EPSON_PM_RPCV4_01;EPSON V3 Service4(01); C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EPSON\EPW!3 SSRP\E_S40RP7.EXE [2006-12-15 113664] R2 JavaQuickStarterService;Java Quick Starter; C:\Programme\Java\jre6\bin\jqs.exe [2009-03-09 152984] R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2007-07-24 163908] R2 sdAuxService;PC Tools Auxiliary Service; C:\Programme\Spyware Doctor\pctsAuxs.exe [2009-01-07 348752] R2 sdCoreService;PC Tools Security Service; C:\Programme\Spyware Doctor\pctsSvc.exe [2009-01-21 1095560] R3 iPod Service;iPod-Dienst; C:\Programme\iPod\bin\iPodService.exe [2009-04-02 656168] R3 ThreatFire;ThreatFire; C:\Programme\Spyware Doctor\TFEngine\TFService.exe [2009-03-31 70944] S2 AntiVirScheduler;AntiVir PersonalEdition Classic Planer; C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe [] S2 AntiVirService;AntiVir PersonalEdition Classic Guard; C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe [] S2 gusvc;Google Software Updater; C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-25 183280] S2 RDSessMgrHTTPFilter;Sitzungs-Manager für Remotedesktophilfe RDSessMgrHTTPFilter; C:\WINDOWS\system32\actxprxy(2)v.exe srv [] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144] S3 GoogleDesktopManager;GoogleDesktopManager; C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe [2009-07-06 1862144] S3 IDriverT;InstallDriver Table Manager; C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728] S3 WMPNetworkSvc;Windows Media Player-Netzwerkfreigabedienst; C:\Programme\Windows Media Player\WMPNetwk.exe [2006-11-03 920576] S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336] -----------------EOF----------------- Freu mich auf Antwort! Herzliche Grüße Lischa |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 03:17 Uhr. |
Copyright ©2000-2024, Trojaner-Board