|
Lade dir Lop S&D herunter. Führe Lop S&D.exe per Doppelklick aus. Wähle die Sprache deiner Wahl und anschließend die Option 1. Warte bis der Scanbericht erstellt wird und poste ihn hier (Du findest ihn unter C:\lopR.txt, sollte der Bericht nicht erscheinen). |
Zitat:
|
Könnt ihr bitte antworten? |
Warte bitte noch, die Helfer sind meistens nicht nur mit einem, sondern mit 4 oder 5 Problemfällen am abrackern, ausserdem machen sie das in ihrer Freizeit, neben ihrem Beruf.. Also hab doch mal gedult |
Nagut, dann mach mal bitte einen Durchlauf mit Combofix: ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
http://saved.im/mtm0nzyzmzd5/cofi.jpg
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat! |
habs runtergeladen finde es aber niergends |
ComboFix 09-11-04.05 - David 05.11.2009 17:12.1.2 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.41.1031.18.3066.1895 [GMT 1:00] ausgeführt von:: c:\users\David\Desktop\cofi.exe FW: Bluewin Security 7.02 *enabled* {D4747503-0346-49EB-9262-997542F79BF4} SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . c:\users\David\AppData\Roaming\.# c:\windows\Suyin.reg . ((((((((((((((((((((((( Dateien erstellt von 2009-10-05 bis 2009-11-05 )))))))))))))))))))))))))))))) . 2009-11-05 16:30 . 2009-11-05 16:30 -------- d-----w- c:\users\Default\AppData\Local\temp 2009-10-30 15:10 . 2009-10-30 15:17 8192 d-----w- C:\Lop SD 2009-10-28 10:10 . 2009-10-28 10:11 -------- d-----w- C:\rsit 2009-10-28 10:10 . 2009-10-28 10:11 -------- d-----w- c:\program files\trend micro 2009-10-27 18:11 . 2009-09-10 14:58 310784 ----a-w- c:\windows\system32\unregmp2.exe 2009-10-27 18:11 . 2009-09-10 14:59 8147456 ----a-w- c:\windows\system32\wmploc.DLL 2009-10-27 18:01 . 2009-08-07 02:24 44768 ----a-w- c:\windows\system32\wups2.dll 2009-10-27 18:01 . 2009-08-07 02:24 53472 ----a-w- c:\windows\system32\wuauclt.exe 2009-10-27 18:01 . 2009-08-07 01:45 2421760 ----a-w- c:\windows\system32\wucltux.dll 2009-10-27 18:01 . 2009-08-07 02:23 1929952 ----a-w- c:\windows\system32\wuaueng.dll 2009-10-27 18:00 . 2009-08-07 02:24 35552 ----a-w- c:\windows\system32\wups.dll 2009-10-27 18:00 . 2009-08-07 01:44 87552 ----a-w- c:\windows\system32\wudriver.dll 2009-10-27 18:00 . 2009-08-07 02:23 575704 ----a-w- c:\windows\system32\wuapi.dll 2009-10-27 17:59 . 2009-08-06 18:23 171608 ----a-w- c:\windows\system32\wuwebv.dll 2009-10-27 17:59 . 2009-08-06 17:44 33792 ----a-w- c:\windows\system32\wuapp.exe 2009-10-21 17:55 . 2009-10-21 17:55 -------- d-----w- c:\program files\CCleaner 2009-10-21 15:03 . 2009-10-21 15:03 -------- d-----w- c:\users\David\AppData\Roaming\DynaGeo 2009-10-20 18:33 . 2009-10-20 18:33 -------- d-----w- c:\users\David\AppData\Roaming\Malwarebytes 2009-10-20 18:32 . 2009-09-10 12:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-10-20 18:32 . 2009-10-20 18:32 -------- d-----w- c:\programdata\Malwarebytes 2009-10-20 18:32 . 2009-09-10 12:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-10-20 18:32 . 2009-10-20 18:33 4096 d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-10-18 12:07 . 2009-10-18 12:07 -------- d-----w- c:\users\David\AppData\Local\PunkBuster 2009-10-17 21:27 . 2009-10-28 17:13 4096 d-----w- c:\users\David\AppData\Local\WarRockDF 2009-10-16 18:33 . 2009-09-10 16:48 218624 ----a-w- c:\windows\system32\msv1_0.dll 2009-10-16 18:33 . 2009-08-04 12:34 3548216 ----a-w- c:\windows\system32\ntoskrnl.exe 2009-10-16 18:33 . 2009-08-04 12:34 3600456 ----a-w- c:\windows\system32\ntkrnlpa.exe 2009-10-16 18:30 . 2009-09-04 11:41 60928 ----a-w- c:\windows\system32\msasn1.dll 2009-10-16 18:30 . 2009-09-14 09:29 144896 ----a-w- c:\windows\system32\drivers\srv2.sys 2009-10-16 18:30 . 2009-05-08 12:53 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL 2009-10-15 18:53 . 2009-10-15 18:53 -------- d-----w- c:\programdata\Motive 2009-10-12 21:24 . 2009-10-12 21:24 -------- d-----w- c:\users\David\AppData\Roaming\BitTorrent 2009-10-11 20:11 . 2009-10-13 18:32 -------- d-----w- c:\program files\EA Sports 2009-10-11 19:50 . 2009-10-11 19:50 -------- d-----w- c:\program files\BitTorrent 2009-10-10 17:36 . 2009-10-10 17:36 -------- d--h--r- c:\users\David\AppData\Roaming\SecuROM 2009-10-10 17:14 . 2008-05-30 12:19 507400 ----a-w- c:\windows\system32\XAudio2_1.dll 2009-10-10 17:14 . 2008-05-30 12:17 65032 ----a-w- c:\windows\system32\XAPOFX1_0.dll 2009-10-10 17:14 . 2008-05-30 12:18 238088 ----a-w- c:\windows\system32\xactengine3_1.dll 2009-10-10 17:14 . 2008-05-30 12:17 25608 ----a-w- c:\windows\system32\X3DAudio1_4.dll 2009-10-10 17:14 . 2008-05-30 12:11 1491992 ----a-w- c:\windows\system32\D3DCompiler_38.dll 2009-10-10 17:14 . 2008-05-30 12:11 467984 ----a-w- c:\windows\system32\d3dx10_38.dll 2009-10-10 17:14 . 2008-05-30 12:11 3850760 ----a-w- c:\windows\system32\D3DX9_38.dll 2009-10-10 12:03 . 2009-10-10 15:48 -------- d-----w- C:\World of Warcraft 2009-10-10 09:08 . 2009-10-10 09:10 -------- d-----w- c:\windows\system32\ca-ES 2009-10-10 09:08 . 2009-10-10 09:10 -------- d-----w- c:\windows\system32\eu-ES 2009-10-10 09:08 . 2009-10-10 09:10 -------- d-----w- c:\windows\system32\vi-VN 2009-10-10 08:40 . 2009-10-10 08:40 4096 d-----w- c:\windows\system32\EventProviders 2009-10-10 08:35 . 2009-10-10 08:35 -------- d-----w- c:\programdata\Office Genuine Advantage 2009-10-10 08:25 . 2009-10-29 19:37 -------- d-----w- c:\users\David\AppData\Roaming\Intel 2009-10-10 08:25 . 2009-10-15 19:12 -------- d-----w- c:\users\Public\Roaming 2009-10-10 08:25 . 2009-10-15 19:12 -------- d-----w- c:\users\Default\Roaming 2009-10-10 08:25 . 2009-10-15 19:12 -------- d-----w- c:\users\David\Roaming 2009-10-10 08:25 . 2009-10-15 18:49 -------- d-----w- c:\programdata\Roaming 2009-10-10 08:23 . 2009-10-15 19:12 4096 d-----w- c:\program files\Cisco 2009-10-10 08:23 . 2009-10-15 19:12 -------- d-----w- c:\program files\Common Files\Intel 2009-10-10 08:23 . 2009-10-15 19:12 -------- d-----w- c:\programdata\Intel 2009-10-10 08:19 . 2009-06-15 14:53 270848 ----a-w- c:\windows\system32\schannel.dll 2009-10-10 08:19 . 2009-06-15 14:52 499712 ----a-w- c:\windows\system32\kerberos.dll 2009-10-10 08:19 . 2009-06-15 14:54 175104 ----a-w- c:\windows\system32\wdigest.dll 2009-10-10 08:19 . 2009-06-15 23:15 439864 ----a-w- c:\windows\system32\drivers\ksecdd.sys 2009-10-10 08:19 . 2009-06-15 14:53 72704 ----a-w- c:\windows\system32\secur32.dll 2009-10-10 08:19 . 2009-06-15 14:52 1259008 ----a-w- c:\windows\system32\lsasrv.dll 2009-10-10 08:19 . 2009-06-15 12:48 9728 ----a-w- c:\windows\system32\lsass.exe 2009-10-09 21:56 . 2009-10-18 12:07 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys 2009-10-09 21:56 . 2009-10-10 08:56 22328 ----a-w- c:\users\David\AppData\Roaming\PnkBstrK.sys 2009-10-09 21:56 . 2009-10-18 12:07 107832 ----a-w- c:\windows\system32\PnkBstrB.exe 2009-10-09 21:56 . 2009-10-09 21:56 66872 ----a-w- c:\windows\system32\PnkBstrA.exe 2009-10-09 21:56 . 2009-10-10 08:55 2506752 ----a-w- c:\windows\system32\pbsvc.exe 2009-10-09 08:09 . 2009-10-09 08:09 -------- d-----w- c:\windows\95FC26FB19FD4A96BBB1B1062E8648F5.TMP 2009-10-09 08:09 . 2009-10-09 08:09 -------- d-----w- c:\programdata\THQ 2009-10-08 16:09 . 2009-10-10 19:26 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment 2009-10-08 16:08 . 2009-10-08 16:08 -------- d-----w- c:\programdata\Blizzard . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-11-05 16:05 . 2009-06-20 17:35 4096 d-----w- c:\users\David\AppData\Roaming\Skype 2009-11-05 15:07 . 2009-06-20 17:37 4096 d-----w- c:\users\David\AppData\Roaming\skypePM 2009-11-05 14:38 . 2008-01-21 07:15 625132 ----a-w- c:\windows\system32\perfh007.dat 2009-11-05 14:38 . 2008-01-21 07:15 125826 ----a-w- c:\windows\system32\perfc007.dat 2009-11-05 14:33 . 2008-11-06 18:05 4096 d-----w- c:\programdata\Google Updater 2009-11-05 14:32 . 2008-10-01 16:52 56263 ----a-w- c:\programdata\nvModes.dat 2009-11-04 18:33 . 2008-12-06 21:42 12 ----a-w- c:\windows\bthservsdp.dat 2009-11-01 17:01 . 2009-02-15 09:09 8192 d-----w- c:\users\David\AppData\Roaming\teamspeak2 2009-10-28 14:38 . 2008-10-02 13:21 8192 d-----w- c:\program files\Bluewin Security 2009-10-28 14:36 . 2008-11-21 11:53 33920 ----a-w- c:\windows\system32\drivers\fsbts.sys 2009-10-28 14:26 . 2008-10-02 13:03 4096 d-----w- c:\programdata\fssg 2009-10-24 19:07 . 2008-04-18 09:18 8192 d-----w- c:\programdata\Microsoft Help 2009-10-21 12:59 . 2008-10-02 14:35 -------- d-----w- c:\users\David\AppData\Roaming\F-Secure 2009-10-17 20:46 . 2009-10-05 15:40 -------- d-----w- c:\program files\GamersFirst 2009-10-17 20:46 . 2008-04-18 08:42 12288 d--h--w- c:\program files\InstallShield Installation Information 2009-10-17 15:37 . 2006-11-02 11:18 4096 d-----w- c:\program files\Windows Mail 2009-10-17 15:22 . 2008-04-18 09:21 28672 d-----w- c:\program files\Microsoft Works 2009-10-15 19:12 . 2008-04-18 08:37 -------- d-----w- c:\program files\Intel 2009-10-10 16:10 . 2009-08-31 17:54 2828 --sha-w- c:\programdata\KGyGaAvL.sys 2009-10-10 16:10 . 2009-08-31 17:54 2828 --sha-w- c:\programdata\KGyGaAvL.sys 2009-10-10 16:10 . 2009-08-31 17:54 88 --sh--r- c:\programdata\569C7783BA.sys 2009-10-10 16:10 . 2009-08-31 17:54 88 --sh--r- c:\programdata\569C7783BA.sys 2009-10-10 09:22 . 2008-10-01 16:54 -------- d-----w- c:\programdata\NVIDIA 2009-10-10 09:11 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar 2009-10-10 09:11 . 2006-11-02 12:37 4096 d-----w- c:\program files\Windows Sidebar 2009-10-10 09:11 . 2006-11-02 12:37 4096 d-----w- c:\program files\Windows Journal 2009-10-10 09:11 . 2006-11-02 12:37 4096 d-----w- c:\program files\Windows Collaboration 2009-10-10 09:11 . 2006-11-02 12:37 4096 d-----w- c:\program files\Windows Photo Gallery 2009-10-10 09:11 . 2006-11-02 12:37 4096 d-----w- c:\program files\Windows Defender 2009-10-10 09:08 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat 2009-10-09 08:09 . 2009-03-14 16:50 4096 d-----w- c:\program files\Common Files\Wise Installation Wizard 2009-10-09 07:41 . 2008-10-04 13:51 -------- d-----w- c:\program files\THQ 2009-10-06 08:07 . 2009-04-09 19:55 -------- d-----w- c:\program files\Firefly Studios 2009-10-05 15:40 . 2009-10-05 15:40 -------- d-----w- c:\program files\DNA 2009-10-02 17:53 . 2008-10-02 15:32 4096 d-----w- c:\program files\Windows Live 2009-10-01 08:29 . 2009-10-02 16:13 195440 ------w- c:\windows\system32\MpSigStub.exe 2009-09-26 10:25 . 2009-06-01 08:34 -------- d-----w- c:\programdata\WinZip 2009-09-24 09:28 . 2008-10-12 08:36 4096 d-----w- c:\program files\Google 2009-09-22 10:27 . 2009-09-15 17:19 4096 d-----w- c:\users\David\AppData\Roaming\SecondLife 2009-09-15 17:19 . 2009-09-15 17:18 8192 d-----w- c:\program files\SecondLife 2009-09-11 10:06 . 2008-10-02 16:00 4096 d-----w- c:\program files\Microsoft Silverlight 2009-09-10 18:22 . 2009-09-10 18:23 471664 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtbB2FB.tmp.exe 2009-08-31 17:36 . 2009-08-31 17:35 2828 --sha-w- c:\windows\system32\KGyGaAvL.sys 2009-08-31 17:35 . 2009-08-31 17:35 8 --sh--r- c:\windows\system32\9CEE34EC87.sys 2009-08-29 00:27 . 2009-09-03 10:06 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll 2009-08-29 00:14 . 2009-09-03 10:06 28672 ----a-w- c:\windows\system32\Apphlpdm.dll 2009-08-27 05:22 . 2009-10-16 18:31 916480 ----a-w- c:\windows\system32\wininet.dll 2009-08-27 05:17 . 2009-10-16 18:31 71680 ----a-w- c:\windows\system32\iesetup.dll 2009-08-27 05:17 . 2009-10-16 18:31 109056 ----a-w- c:\windows\system32\iesysprep.dll 2009-08-27 03:42 . 2009-10-16 18:31 133632 ----a-w- c:\windows\system32\ieUnatt.exe 2009-08-17 21:33 . 2009-08-17 21:33 1193832 ----a-w- c:\windows\system32\FM20.DLL 2009-08-14 16:27 . 2009-09-09 11:22 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys 2009-08-14 15:53 . 2009-09-09 11:22 17920 ----a-w- c:\windows\system32\netevent.dll 2009-08-14 13:49 . 2009-09-09 11:22 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE 2009-08-14 13:49 . 2009-09-09 11:22 17920 ----a-w- c:\windows\system32\ROUTE.EXE 2009-08-14 13:49 . 2009-09-09 11:22 11264 ----a-w- c:\windows\system32\MRINFO.EXE 2009-08-14 13:49 . 2009-09-09 11:22 27136 ----a-w- c:\windows\system32\NETSTAT.EXE 2009-08-14 13:49 . 2009-09-09 11:22 19968 ----a-w- c:\windows\system32\ARP.EXE 2009-08-14 13:49 . 2009-09-09 11:22 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE 2009-08-14 13:49 . 2009-09-09 11:22 10240 ----a-w- c:\windows\system32\finger.exe 2009-08-14 13:48 . 2009-09-09 11:22 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys 2009-08-14 13:48 . 2009-09-09 11:22 105984 ----a-w- c:\windows\system32\netiohlp.dll 2009-08-13 19:13 . 2009-08-13 19:13 34062 ----a-w- c:\users\David\AppData\Roaming\Move Networks\ie_bin\Uninst.exe 2009-08-10 18:27 . 2008-10-01 16:52 80360 ----a-w- c:\users\David\AppData\Local\GDIPFONTCACHEV1.DAT 2009-08-07 17:51 . 2009-08-07 17:51 15308424 ----a-w- c:\windows\system32\xlive.dll 2009-08-07 17:51 . 2009-08-07 17:51 13642888 ----a-w- c:\windows\system32\xlivefnt.dll . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP] @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}" [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}] 2008-03-04 21:38 121392 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952] "AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2008-11-23 2356088] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-11-06 39408] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883840] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-18 1033512] "ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-04-23 397312] "eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-03-04 526896] "eAudio"="c:\program files\Acer\Empowering Technology\eAudio\eAudio.exe" [2008-03-07 544768] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-03-08 40048] "BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-06 34040] "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-04-15 178712] "WarReg_PopUp"="c:\program files\Acer\WR_PopUp\WarReg_PopUp.exe" [2008-01-29 303104] "LManager"="c:\progra~1\LAUNCH~1\QtZgAcer.EXE" [2008-07-02 821768] "PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704] "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 1037736] "F-Secure Manager"="c:\program files\Bluewin Security\Common\FSM32.EXE" [2009-08-05 199264] "F-Secure TNB"="c:\program files\Bluewin Security\FSGUI\TNBUtil.exe" [2009-08-05 2349664] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-08 13601312] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-08 92704] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888] "fssui"="c:\program files\Windows Live\Family Safety\fsui.exe" [2009-08-05 647520] "Corel Photo Downloader"="c:\program files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" [2008-08-18 532808] "Corel File Shell Monitor"="c:\program files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe" [2008-08-18 16712] "RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-04-28 6111232] "Skytel"="Skytel.exe" - c:\windows\SkyTel.exe [2007-11-20 1826816] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ BTTray.lnk - c:\program files\ANYCOM\Bluetooth-USB\BTTray.exe [2008-6-9 752168] WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2009-6-24 525640] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc] "VistaSp2"=hex(b):48,32,9e,bc,8a,49,ca,01 R0 fsbts;fsbts;c:\windows\System32\drivers\fsbts.sys [21.11.2008 12:53 33920] R1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files\Bluewin Security\HIPS\drivers\fshs.sys [20.11.2008 18:28 68064] R1 FSES;F-Secure Email Scanning Driver;c:\windows\System32\drivers\fses.sys [02.10.2008 14:23 35680] R1 FSFW;F-Secure Firewall Driver;c:\windows\System32\drivers\fsdfw.sys [02.10.2008 14:23 71040] R1 fsvista;F-Secure Vista Support Driver;c:\program files\Bluewin Security\Anti-Virus\minifilter\fsvista.sys [02.10.2008 14:22 12384] R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [03.03.2008 12:11 16384] R2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [18.04.2008 09:52 24576] R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [06.04.2008 21:42 50424] R2 wlidsvc;Windows Live ID Sign-in Assistant;c:\program files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE [30.03.2009 15:28 1533808] R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\b57nd60x.sys [28.03.2008 03:44 210432] R3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files\Bluewin Security\Anti-Virus\minifilter\fsgk.sys [02.10.2008 14:22 101496] R3 FSORSPClient;F-Secure ORSP Client;c:\program files\Bluewin Security\ORSP Client\fsorsp.exe [20.11.2008 18:29 55928] R3 JMCR;JMCR;c:\windows\System32\drivers\jmcr.sys [18.04.2008 19:25 81296] R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\System32\drivers\NETw5v32.sys [17.11.2008 06:40 3668480] R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\System32\drivers\nvhda32v.sys [24.09.2008 16:09 45600] R3 USBPNPA;USB PnP Sound Device Interface;c:\windows\System32\drivers\CM108.sys [28.06.2007 06:18 1310720] R3 winbondcir;Winbond IR Transceiver;c:\windows\System32\drivers\winbondcir.sys [28.03.2007 06:51 43008] S2 gupdate1c9f1cd98326900;Google Update Service (gupdate1c9f1cd98326900);c:\program files\Google\Update\GoogleUpdate.exe [20.06.2009 18:36 133104] S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [04.04.2008 02:03 131072] S3 A310;AVerMedia A310 DVB-T;c:\windows\System32\drivers\AVerA310USB.sys [18.04.2008 09:50 25856] S3 BDASwCap;AVerMedia A310 BDA DVBT Capture Device;c:\windows\System32\drivers\AVerA310Cap.sys [18.04.2008 09:50 42880] S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\System32\drivers\btwl2cap.sys [06.12.2008 22:44 29736] S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [02.10.2009 18:53 54632] S3 fsssvc;Windows Live Family Safety-Dienst;c:\program files\Windows Live\Family Safety\fsssvc.exe [05.08.2009 21:48 704864] S4 F-Secure Filter;F-Secure File System Filter;c:\program files\Bluewin Security\Anti-Virus\win2k\fsfilter.sys [02.10.2008 14:22 39776] S4 F-Secure Recognizer;F-Secure File System Recognizer;c:\program files\Bluewin Security\Anti-Virus\win2k\fsrec.sys [02.10.2008 14:22 25184] --- Andere Dienste/Treiber im Speicher --- *NewlyCreated* - MBR *NewlyCreated* - PROCEXP113 *Deregistered* - mbr *Deregistered* - PROCEXP113 [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 bthsvcs REG_MULTI_SZ BthServ . Inhalt des "geplante Tasks" Ordners 2009-11-05 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-10-12 13:09] 2009-11-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-06-20 17:35] 2009-11-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-06-20 17:35] 2009-11-04 c:\windows\Tasks\User_Feed_Synchronization-{1EEC57AA-E99D-4765-B342-E8E40EEBA92E}.job - c:\windows\system32\msfeedssync.exe [2009-10-16 03:41] . . ------- Zusätzlicher Suchlauf ------- . uStart Page = hxxp://www.google.ch/ig?hl=de uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx IE: Bild an &Bluetooth-Gerät senden... - c:\program files\ANYCOM\Bluetooth-USB\btsendto_ie_ctx.htm IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: Seite an &Bluetooth-Gerät senden... - c:\program files\ANYCOM\Bluetooth-USB\btsendto_ie.htm LSP: c:\program files\Bluewin Security\FSPS\program\FSLSP.DLL TCP: {6A250EB2-C942-40C9-8010-CEC49AE5F15E} = 195.186.1.111,195.186.4.111 DPF: {2EF98DE5-183F-11D4-83EC-EC6A1DB6E213} - hxxp://www.dynageo.de/download/dynageoviewer.cab . - - - - Entfernte verwaiste Registrierungseinträge - - - - WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) HKLM-Run-eRecoveryService - (no file) AddRemove-AVerMedia A310 (MiniCard, DVB-T) - c:\program files\AVerMedia\AVerMedia A310 (MiniCard ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-11-05 17:31 Windows 6.0.6002 Service Pack 2 NTFS Scanne versteckte Prozesse... Scanne versteckte Autostarteinträge... Scanne versteckte Dateien... Scan erfolgreich abgeschlossen versteckte Dateien: 0 ************************************************************************** . --------------------- Gesperrte Registrierungsschluessel --------------------- [HKEY_USERS\S-1-5-21-2224810489-1605764362-1537619351-1000\Software\SecuROM\License information*] @Allowed: (Read) (RestrictedCode) "datasecu"=hex:4e,a1,0f,92,bf,19,98,a5,21,ae,30,96,a5,69,ce,f9,8a,d0,92,00,8e, 64,39,7e,78,e1,07,16,e1,ae,da,6c,3d,c5,c3,1b,9a,e8,2e,6b,03,df,59,32,f0,51,\ "rkeysecu"=hex:29,3f,41,1f,c6,3d,02,e6,8e,c8,f5,8e,57,70,3d,3b [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . --------------------- Durch laufende Prozesse gestartete DLLs --------------------- - - - - - - - > 'winlogon.exe'(1372) c:\program files\bluewin security\hips\fshook32.dll - - - - - - - > 'lsass.exe'(748) c:\program files\bluewin security\hips\fshook32.dll . Zeit der Fertigstellung: 2009-11-05 17:43 ComboFix-quarantined-files.txt 2009-11-05 16:43 Vor Suchlauf: 14 Verzeichnis(se), 46'731'251'712 Bytes frei Nach Suchlauf: 19 Verzeichnis(se), 46'700'351'488 Bytes frei |
hat es jetzt ein virus oder nichtmehr? |
Das Logfile ist unauffällig. Mach mal einen Kontrollscan: Überprüfe den Rechner mit PrevXCSI. Poste ein Screenshot falls etwas gefunden werden sollte oder poste Namen und Pfade. |
Zitat:
Habe heute den scan gemacht es hat aber nichts gefunden es stand oben clean. |
was ist jetzt los habe ich noch was oder nicht?? |
:confused: Du hast doch geschrieben, dass der PrevX Kontrollscan nix zum Vorschein brachte. Was soll denn jetzt schon wieder sein? :dummguck: |
Zitat:
|
| Alle Zeitangaben in WEZ +1. Es ist jetzt 00:09 Uhr. |
Copyright ©2000-2024, Trojaner-Board