Fehlermeldung scan32.exe

Sandy1231 · 22.04.2009, 10:27

Habe ein Problem mit meinem Virenscanner McAfee, wenn ich scanne kommt die Meldung "scan32.exe hat ein Problem festgestellt und muss beendet werden." Versuchte ihn auch schon zu reparieren. Macht auch keine Updates.
Kennt sich da jemand aus. Danke für eure Hilfe mfG
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:26:26, on 22.04.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\Explorer.EXE
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programme\Network Associates\VirusScan\SHSTAT.EXE
C:\Programme\Network Associates\Common Framework\UpdaterUI.exe
C:\Programme\Canon\MyPrinter\BJMyPrt.exe
C:\Programme\Gemeinsame Dateien\Network Associates\TalkBack\TBMon.exe
D:\Rene\Programme\iTunes\iTunesHelper.exe
C:\windows\Dit.exe
C:\Programme\Java\jre6\bin\jusched.exe
C:\windows\system32\ctfmon.exe
D:\program files\wcescomm.exe
C:\Programme\Messenger\msmsgs.exe
C:\windows\DitExp.exe
C:\Programme\Samsung\Samsung New PC Studio\NPSAgent.exe
d:\PROGRA~1\rapimgr.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\FsUsbExService.Exe
C:\Programme\Canon\IJPLM\IJPLMSVC.EXE
C:\Programme\Java\jre6\bin\jqs.exe
C:\Programme\Network Associates\Common Framework\FrameworkService.exe
C:\Programme\Network Associates\VirusScan\Mcshield.exe
C:\Programme\Network Associates\VirusScan\VsTskMgr.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\Programme\Photodex\ProShowGold\ScsiAccess.exe
C:\windows\system32\svchost.exe
C:\WINDOWS\SCARDS32.EXE
C:\Programme\iPod\bin\iPodService.exe
C:\WINDOWS\system32\msiexec.exe
C:\windows\system32\wuauclt.exe
C:\Programme\Internet Explorer\iexplore.exe
G:\Neuer Ordner\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gmx.at/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.aon.at/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=proxy.aon.at:8080;http=proxy.aon.at:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.aon.at;*.jet2web.net;<local>
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: VS_IEHlprObj Class - {829CAB51-A4EA-4a15-87B6-4B7D0747939C} - C:\Programme\Network Associates\VirusScan\bho.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: XBTBPos00 - {E552EEFC-DE97-45D4-BA1A-F534A1B4A579} - (no file)
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Morpheus Toolbar - {119DBEDA-9c41-4F97-94B4-B6BCD01133CF} - (no file)
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Verknüpfung mit der High Definition Audio-Eigenschaftenseite] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Programme\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Programme\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [QuickTime Task] "D:\rene\kazaa\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Programme\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Programme\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Programme\Gemeinsame Dateien\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] "D:\Rene\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "D:\program files\wcescomm.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AutoStartNPSAgent] C:\Programme\Samsung\Samsung New PC Studio\NPSAgent.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
O8 - Extra context menu item: &Search - http://ku.bar.need2find.com/KU/menusearch.html?p=KU
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Morpheus Toolbar - {119DBEDA-9c41-4F97-94B4-B6BCD01133CF} - (no file)
O9 - Extra 'Tools' menuitem: Morpheus Toolbar - {119DBEDA-9c41-4F97-94B4-B6BCD01133CF} - (no file)
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - d:\PROGRA~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - d:\PROGRA~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Mobilen Favoriten erstellen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - d:\PROGRA~1\INetRepl.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Rene\Poker\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Rene\Poker\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.msn.at/
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1134404968500
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1184852540593
O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} (CPlayFirstddfotgControl Object) - http://games.bigfishgames.com/de_dinerdashfloontheg/online/ddfotg.1.0.0.33.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A0B5E0B3-14EB-448C-9155-0EAFAEACD4E2}: NameServer = 195.3.96.67 195.3.96.68
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\windows\system32\Ati2evxx.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: Boonty Games - BOONTY - C:\Programme\Gemeinsame Dateien\BOONTY Shared\Service\Boonty.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FsUsbExService - Teruten - C:\WINDOWS\system32\FsUsbExService.Exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Inkjet Printer/Scanner Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Programme\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Programme\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Programme\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Programme\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Programme\Photodex\ProShowGold\ScsiAccess.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programme\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: CHIPDRIVE SCARD Service (TWKSCARDSRV) - SCM Microsystems - C:\WINDOWS\SCARDS32.EXE

--
End of file - 10011 bytes

Ghost1975 · 23.04.2009, 08:22

Hi

Bitte lade mal folgendes bei Virustotal hoch und Poste das Ergebnis hier komplett:

C:\WINDOWS\system32\FsUsbExService.Exe

Dann mache einen Kompletten Scan mit Malwarebytes Antimalware (Bitte die Software vor dem Scan Updaten lassen)

MfG

Ghost1975

Sandy1231 · 23.04.2009, 14:17

Ich hoffe es ist so richtig?
Nach der Analyse.
Und Danke vorab
vlG
a-squared 4.0.0.101 2009.04.23 -
AhnLab-V3 5.0.0.2 2009.04.23 -
AntiVir 7.9.0.148 2009.04.23 -
Antiy-AVL 2.0.3.1 2009.04.23 -
Authentium 5.1.2.4 2009.04.22 -
Avast 4.8.1335.0 2009.04.22 -
AVG 8.5.0.287 2009.04.23 -
BitDefender 7.2 2009.04.23 -
CAT-QuickHeal 10.00 2009.04.23 -
ClamAV 0.94.1 2009.04.23 -
Comodo 1127 2009.04.22 -
DrWeb 4.44.0.09170 2009.04.23 -
eSafe 7.0.17.0 2009.04.23 -
eTrust-Vet 31.6.6440 2009.04.20 -
F-Prot 4.4.4.56 2009.04.22 -
F-Secure 8.0.14470.0 2009.04.23 -
Fortinet 3.117.0.0 2009.04.23 -
GData 19 2009.04.23 -
Ikarus T3.1.1.49.0 2009.04.23 -
K7AntiVirus 7.10.714 2009.04.23 -
Kaspersky 7.0.0.125 2009.04.23 -
McAfee 5593 2009.04.23 -
McAfee+Artemis 5593 2009.04.23 -
McAfee-GW-Edition 6.7.6 2009.04.23 -
Microsoft 1.4602 2009.04.23 -
NOD32 4030 2009.04.23 -
Norman 6.00.06 2009.04.23 -
nProtect 2009.1.8.0 2009.04.23 -
Panda 10.0.0.14 2009.04.23 -
PCTools 4.4.2.0 2009.04.23 -
Prevx1 3.0 2009.04.23 -
Rising 21.26.34.00 2009.04.23 -
Sophos 4.41.0 2009.04.23 -
Sunbelt 3.2.1858.2 2009.04.22 -
Symantec 1.4.4.12 2009.04.23 -
TheHacker 6.3.4.0.312 2009.04.23 -
TrendMicro 8.700.0.1004 2009.04.23 -
VBA32 3.12.10.2 2009.04.23 -
ViRobot 2009.4.23.1706 2009.04.23 -
VirusBuster 4.6.5.0 2009.04.22 -
weitere Informationen
File size: 233472 bytes
MD5...: d3f9205cc4cb07553f2f9472c767ea87
SHA1..: 78046997cb4dc1d9b6fcb74ee35b37efd770eadb
SHA256: b1df2b8d718cf7958e5e0b367859eefb45cc9042b1b88e0c4da884df2608b59a
SHA512: 08d95419d8cf8a9d8b70ddd1f70a6957294cbc2f376ea7dec70dee61c63d2f99
b2111aa5eef9e4f2d34e4b29059048a2f0f17b3016c233c705db3f18a83d712f
ssdeep: 3072:MQg3O0E7fBSoGg4qQLQYmxCNjdvwCqltPWiwhtVrvAPQuULvVPAMLkfW4Lq
lMgIC:sVEBohLQvstzqvWbhrruUTe2I45

PEiD..: Armadillo v1.71
TrID..: File type identification
Win64 Executable Generic (54.6%)
Win32 Executable MS Visual C++ (generic) (24.0%)
Windows Screen Saver (8.3%)
Win32 Executable Generic (5.4%)
Win32 Dynamic Link Library (generic) (4.8%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0xcbdd
timedatestamp.....: 0x48689dee (Mon Jun 30 08:48:46 2008)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x2606b 0x27000 6.53 6ccd9a63a30c42960bae746b8d61fa00
.rdata 0x28000 0x8f98 0x9000 4.91 b8cfad9cf8628b12edf1b151c7b1caf5
.data 0x31000 0xa9e8 0x5000 2.63 9f90926e52bbda271cc236cfc9717835
.rsrc 0x3c000 0x27b8 0x3000 4.10 5f172820ee971d0c987f80c9127f95f0

( 11 imports )
> KERNEL32.dll: HeapFree, HeapAlloc, RaiseException, GetTimeZoneInformation, GetSystemTime, GetLocalTime, GetACP, HeapReAlloc, HeapSize, SetHandleCount, UnhandledExceptionFilter, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStrings, GetEnvironmentStringsW, GetEnvironmentVariableA, HeapDestroy, HeapCreate, GetCommandLineA, VirtualAlloc, IsBadWritePtr, SetUnhandledExceptionFilter, LCMapStringA, LCMapStringW, GetDriveTypeA, GetStringTypeA, GetStringTypeW, IsBadReadPtr, IsBadCodePtr, CompareStringA, CompareStringW, SetEnvironmentVariableA, GetStartupInfoA, GetFileType, SetStdHandle, GetProfileStringA, TerminateProcess, ExitProcess, RtlUnwind, GetFileTime, GetFileSize, GetTickCount, GetFullPathNameA, GetVolumeInformationA, SetEndOfFile, UnlockFile, LockFile, FlushFileBuffers, GetCurrentProcess, DuplicateHandle, SetErrorMode, GetOEMCP, GetCPInfo, SizeofResource, GetThreadLocale, GetProcessVersion, WritePrivateProfileStringA, GlobalFlags, lstrcpynA, TlsGetValue, LocalReAlloc, TlsSetValue, GlobalReAlloc, TlsFree, GlobalHandle, TlsAlloc, LocalAlloc, FileTimeToLocalFileTime, FileTimeToSystemTime, FindNextFileA, FindFirstFileA, FindClose, MulDiv, SetLastError, MultiByteToWideChar, WideCharToMultiByte, lstrlenA, InterlockedIncrement, InterlockedDecrement, GetVersion, lstrcatA, GlobalGetAtomNameA, GlobalAddAtomA, GlobalFindAtomA, lstrcpyA, GlobalUnlock, FindResourceA, LoadResource, LockResource, WaitForSingleObject, GlobalLock, GlobalDeleteAtom, lstrcmpA, lstrcmpiA, GetCurrentThread, GetCurrentThreadId, AllocConsole, GetStdHandle, GlobalAlloc, GlobalFree, FormatMessageA, LocalFree, SetConsoleCtrlHandler, GetModuleHandleA, GetVersionExA, GetCurrentDirectoryA, SetCurrentDirectoryA, LoadLibraryA, GetProcAddress, FreeLibrary, CreateToolhelp32Snapshot, Process32First, Process32Next, SetFilePointer, LeaveCriticalSection, EnterCriticalSection, GetFileAttributesA, CreateFileA, DeviceIoControl, GetModuleFileNameA, ResetEvent, ConnectNamedPipe, GetLastError, DeleteCriticalSection, WaitForMultipleObjects, ReadFile, Sleep, WriteFile, DisconnectNamedPipe, CreateNamedPipeA, SetEvent, CreateEventA, CloseHandle, InitializeCriticalSection, VirtualFree
> USER32.dll: DestroyMenu, LoadStringA, ShowWindow, MoveWindow, SetWindowTextA, IsDialogMessageA, UpdateWindow, SendDlgItemMessageA, MapWindowPoints, GetSysColor, SetFocus, AdjustWindowRectEx, ScreenToClient, CopyRect, GetTopWindow, IsChild, GetCapture, WinHelpA, GetClassInfoA, GetMenu, GetMenuItemCount, GetSubMenu, GetMenuItemID, GetWindowTextLengthA, GetWindowTextA, GetDlgCtrlID, GetClassLongA, SetPropA, UnhookWindowsHookEx, GetPropA, CallWindowProcA, RemovePropA, GetMessageTime, GetMessagePos, GetForegroundWindow, SetForegroundWindow, ClientToScreen, RegisterWindowMessageA, OffsetRect, InflateRect, SystemParametersInfoA, GetWindowPlacement, GetWindowRect, EndDialog, SetActiveWindow, IsWindow, CreateDialogIndirectParamA, GetDlgItem, MapDialogRect, SetWindowPos, GetWindow, SetWindowContextHelpId, GetMenuCheckMarkDimensions, LoadBitmapA, GetMenuState, LoadIconA, SendMessageA, UnregisterClassA, HideCaret, ShowCaret, ExcludeUpdateRgn, ModifyMenuA, SetMenuItemBitmaps, CheckMenuItem, EnableMenuItem, GetFocus, GetNextDlgTabItem, GetMessageA, TranslateMessage, DispatchMessageA, GetActiveWindow, GetKeyState, CallNextHookEx, ValidateRect, IsWindowVisible, PeekMessageA, GetCursorPos, SetWindowsHookExA, GetParent, GetLastActivePopup, IsWindowEnabled, GetWindowLongA, SetCursor, PostQuitMessage, PostMessageA, wsprintfA, RegisterClassA, CreateWindowExA, DefWindowProcA, DestroyWindow, EnableWindow, IsIconic, GetSystemMetrics, GetClientRect, GetDC, ReleaseDC, PostThreadMessageA, SetWindowLongA, DrawIcon, DrawFocusRect, DefDlgProcA, IsWindowUnicode, CharUpperA, InvalidateRect, MessageBeep, GetNextDlgGroupItem, SetRect, CopyAcceleratorTableA, CharNextA, GetSysColorBrush, PtInRect, GetClassNameA, GetDesktopWindow, LoadCursorA, GrayStringA, DrawTextA, MessageBoxA, RegisterClipboardFormatA, TabbedTextOutA, EndPaint, BeginPaint, IntersectRect, GetWindowDC
> GDI32.dll: DeleteObject, GetDeviceCaps, GetViewportExtEx, GetWindowExtEx, CreateSolidBrush, PtVisible, RectVisible, TextOutA, ExtTextOutA, Escape, GetTextColor, GetBkColor, DPtoLP, LPtoDP, GetMapMode, PatBlt, IntersectClipRect, ScaleWindowExtEx, SetWindowExtEx, ScaleViewportExtEx, SetViewportExtEx, OffsetViewportOrgEx, SetViewportOrgEx, SetMapMode, SetBkMode, GetStockObject, SelectObject, RestoreDC, SaveDC, DeleteDC, GetObjectA, SetBkColor, SetTextColor, GetClipBox, CreateDIBitmap, GetTextExtentPointA, BitBlt, CreateCompatibleDC, CreateBitmap
> comdlg32.dll: GetFileTitleA
> WINSPOOL.DRV: ClosePrinter, DocumentPropertiesA, OpenPrinterA
> ADVAPI32.dll: OpenSCManagerA, RegCreateKeyExA, RegOpenKeyExA, RegisterEventSourceA, ReportEventA, DeregisterEventSource, SetServiceStatus, RegisterServiceCtrlHandlerA, StartServiceA, OpenServiceA, ControlService, QueryServiceStatus, DeleteService, SetSecurityDescriptorDacl, CreateServiceA, CloseServiceHandle, StartServiceCtrlDispatcherA, GetUserNameA, LookupAccountNameA, IsValidSid, GetLengthSid, CopySid, RegCloseKey, RegCreateKeyA, RegQueryValueExA, RegSetValueExA, RegDeleteValueA, RegDeleteKeyA, InitializeSecurityDescriptor
> COMCTL32.dll: -
> oledlg.dll: -
> ole32.dll: CoFreeUnusedLibraries, CoRegisterMessageFilter, OleInitialize, CoTaskMemAlloc, CoTaskMemFree, CreateILockBytesOnHGlobal, StgCreateDocfileOnILockBytes, StgOpenStorageOnILockBytes, CoGetClassObject, CLSIDFromString, CLSIDFromProgID, CoRevokeClassObject, OleFlushClipboard, OleIsCurrentClipboard, OleUninitialize
> OLEPRO32.DLL: -
> OLEAUT32.dll: -, -, -, -, -, -, -, -, -

Ghost1975 · 23.04.2009, 15:04

Ja genau war richtig.
und das Ergebnis ist gut.
Nun fehlt noch der Bericht von Malwarebytes,wenn du ihn fertig hast.

MfG

Ghost1975

Sandy1231 · 24.04.2009, 18:58

Zitat:

Zitat von Sandy1231

Ich hoffe es ist so richtig?
Nach der Analyse.
Und Danke vorab
vlG
a-squared 4.0.0.101 2009.04.23 -
AhnLab-V3 5.0.0.2 2009.04.23 -
AntiVir 7.9.0.148 2009.04.23 -
Antiy-AVL 2.0.3.1 2009.04.23 -
Authentium 5.1.2.4 2009.04.22 -
Avast 4.8.1335.0 2009.04.22 -
AVG 8.5.0.287 2009.04.23 -
BitDefender 7.2 2009.04.23 -
CAT-QuickHeal 10.00 2009.04.23 -
ClamAV 0.94.1 2009.04.23 -
Comodo 1127 2009.04.22 -
DrWeb 4.44.0.09170 2009.04.23 -
eSafe 7.0.17.0 2009.04.23 -
eTrust-Vet 31.6.6440 2009.04.20 -
F-Prot 4.4.4.56 2009.04.22 -
F-Secure 8.0.14470.0 2009.04.23 -
Fortinet 3.117.0.0 2009.04.23 -
GData 19 2009.04.23 -
Ikarus T3.1.1.49.0 2009.04.23 -
K7AntiVirus 7.10.714 2009.04.23 -
Kaspersky 7.0.0.125 2009.04.23 -
McAfee 5593 2009.04.23 -
McAfee+Artemis 5593 2009.04.23 -
McAfee-GW-Edition 6.7.6 2009.04.23 -
Microsoft 1.4602 2009.04.23 -
NOD32 4030 2009.04.23 -
Norman 6.00.06 2009.04.23 -
nProtect 2009.1.8.0 2009.04.23 -
Panda 10.0.0.14 2009.04.23 -
PCTools 4.4.2.0 2009.04.23 -
Prevx1 3.0 2009.04.23 -
Rising 21.26.34.00 2009.04.23 -
Sophos 4.41.0 2009.04.23 -
Sunbelt 3.2.1858.2 2009.04.22 -
Symantec 1.4.4.12 2009.04.23 -
TheHacker 6.3.4.0.312 2009.04.23 -
TrendMicro 8.700.0.1004 2009.04.23 -
VBA32 3.12.10.2 2009.04.23 -
ViRobot 2009.4.23.1706 2009.04.23 -
VirusBuster 4.6.5.0 2009.04.22 -
weitere Informationen
File size: 233472 bytes
MD5...: d3f9205cc4cb07553f2f9472c767ea87
SHA1..: 78046997cb4dc1d9b6fcb74ee35b37efd770eadb
SHA256: b1df2b8d718cf7958e5e0b367859eefb45cc9042b1b88e0c4da884df2608b59a
SHA512: 08d95419d8cf8a9d8b70ddd1f70a6957294cbc2f376ea7dec70dee61c63d2f99
b2111aa5eef9e4f2d34e4b29059048a2f0f17b3016c233c705db3f18a83d712f
ssdeep: 3072:MQg3O0E7fBSoGg4qQLQYmxCNjdvwCqltPWiwhtVrvAPQuULvVPAMLkfW4Lq
lMgIC:sVEBohLQvstzqvWbhrruUTe2I45

PEiD..: Armadillo v1.71
TrID..: File type identification
Win64 Executable Generic (54.6%)
Win32 Executable MS Visual C++ (generic) (24.0%)
Windows Screen Saver (8.3%)
Win32 Executable Generic (5.4%)
Win32 Dynamic Link Library (generic) (4.8%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0xcbdd
timedatestamp.....: 0x48689dee (Mon Jun 30 08:48:46 2008)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x2606b 0x27000 6.53 6ccd9a63a30c42960bae746b8d61fa00
.rdata 0x28000 0x8f98 0x9000 4.91 b8cfad9cf8628b12edf1b151c7b1caf5
.data 0x31000 0xa9e8 0x5000 2.63 9f90926e52bbda271cc236cfc9717835
.rsrc 0x3c000 0x27b8 0x3000 4.10 5f172820ee971d0c987f80c9127f95f0

( 11 imports )
> KERNEL32.dll: HeapFree, HeapAlloc, RaiseException, GetTimeZoneInformation, GetSystemTime, GetLocalTime, GetACP, HeapReAlloc, HeapSize, SetHandleCount, UnhandledExceptionFilter, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStrings, GetEnvironmentStringsW, GetEnvironmentVariableA, HeapDestroy, HeapCreate, GetCommandLineA, VirtualAlloc, IsBadWritePtr, SetUnhandledExceptionFilter, LCMapStringA, LCMapStringW, GetDriveTypeA, GetStringTypeA, GetStringTypeW, IsBadReadPtr, IsBadCodePtr, CompareStringA, CompareStringW, SetEnvironmentVariableA, GetStartupInfoA, GetFileType, SetStdHandle, GetProfileStringA, TerminateProcess, ExitProcess, RtlUnwind, GetFileTime, GetFileSize, GetTickCount, GetFullPathNameA, GetVolumeInformationA, SetEndOfFile, UnlockFile, LockFile, FlushFileBuffers, GetCurrentProcess, DuplicateHandle, SetErrorMode, GetOEMCP, GetCPInfo, SizeofResource, GetThreadLocale, GetProcessVersion, WritePrivateProfileStringA, GlobalFlags, lstrcpynA, TlsGetValue, LocalReAlloc, TlsSetValue, GlobalReAlloc, TlsFree, GlobalHandle, TlsAlloc, LocalAlloc, FileTimeToLocalFileTime, FileTimeToSystemTime, FindNextFileA, FindFirstFileA, FindClose, MulDiv, SetLastError, MultiByteToWideChar, WideCharToMultiByte, lstrlenA, InterlockedIncrement, InterlockedDecrement, GetVersion, lstrcatA, GlobalGetAtomNameA, GlobalAddAtomA, GlobalFindAtomA, lstrcpyA, GlobalUnlock, FindResourceA, LoadResource, LockResource, WaitForSingleObject, GlobalLock, GlobalDeleteAtom, lstrcmpA, lstrcmpiA, GetCurrentThread, GetCurrentThreadId, AllocConsole, GetStdHandle, GlobalAlloc, GlobalFree, FormatMessageA, LocalFree, SetConsoleCtrlHandler, GetModuleHandleA, GetVersionExA, GetCurrentDirectoryA, SetCurrentDirectoryA, LoadLibraryA, GetProcAddress, FreeLibrary, CreateToolhelp32Snapshot, Process32First, Process32Next, SetFilePointer, LeaveCriticalSection, EnterCriticalSection, GetFileAttributesA, CreateFileA, DeviceIoControl, GetModuleFileNameA, ResetEvent, ConnectNamedPipe, GetLastError, DeleteCriticalSection, WaitForMultipleObjects, ReadFile, Sleep, WriteFile, DisconnectNamedPipe, CreateNamedPipeA, SetEvent, CreateEventA, CloseHandle, InitializeCriticalSection, VirtualFree
> USER32.dll: DestroyMenu, LoadStringA, ShowWindow, MoveWindow, SetWindowTextA, IsDialogMessageA, UpdateWindow, SendDlgItemMessageA, MapWindowPoints, GetSysColor, SetFocus, AdjustWindowRectEx, ScreenToClient, CopyRect, GetTopWindow, IsChild, GetCapture, WinHelpA, GetClassInfoA, GetMenu, GetMenuItemCount, GetSubMenu, GetMenuItemID, GetWindowTextLengthA, GetWindowTextA, GetDlgCtrlID, GetClassLongA, SetPropA, UnhookWindowsHookEx, GetPropA, CallWindowProcA, RemovePropA, GetMessageTime, GetMessagePos, GetForegroundWindow, SetForegroundWindow, ClientToScreen, RegisterWindowMessageA, OffsetRect, InflateRect, SystemParametersInfoA, GetWindowPlacement, GetWindowRect, EndDialog, SetActiveWindow, IsWindow, CreateDialogIndirectParamA, GetDlgItem, MapDialogRect, SetWindowPos, GetWindow, SetWindowContextHelpId, GetMenuCheckMarkDimensions, LoadBitmapA, GetMenuState, LoadIconA, SendMessageA, UnregisterClassA, HideCaret, ShowCaret, ExcludeUpdateRgn, ModifyMenuA, SetMenuItemBitmaps, CheckMenuItem, EnableMenuItem, GetFocus, GetNextDlgTabItem, GetMessageA, TranslateMessage, DispatchMessageA, GetActiveWindow, GetKeyState, CallNextHookEx, ValidateRect, IsWindowVisible, PeekMessageA, GetCursorPos, SetWindowsHookExA, GetParent, GetLastActivePopup, IsWindowEnabled, GetWindowLongA, SetCursor, PostQuitMessage, PostMessageA, wsprintfA, RegisterClassA, CreateWindowExA, DefWindowProcA, DestroyWindow, EnableWindow, IsIconic, GetSystemMetrics, GetClientRect, GetDC, ReleaseDC, PostThreadMessageA, SetWindowLongA, DrawIcon, DrawFocusRect, DefDlgProcA, IsWindowUnicode, CharUpperA, InvalidateRect, MessageBeep, GetNextDlgGroupItem, SetRect, CopyAcceleratorTableA, CharNextA, GetSysColorBrush, PtInRect, GetClassNameA, GetDesktopWindow, LoadCursorA, GrayStringA, DrawTextA, MessageBoxA, RegisterClipboardFormatA, TabbedTextOutA, EndPaint, BeginPaint, IntersectRect, GetWindowDC
> GDI32.dll: DeleteObject, GetDeviceCaps, GetViewportExtEx, GetWindowExtEx, CreateSolidBrush, PtVisible, RectVisible, TextOutA, ExtTextOutA, Escape, GetTextColor, GetBkColor, DPtoLP, LPtoDP, GetMapMode, PatBlt, IntersectClipRect, ScaleWindowExtEx, SetWindowExtEx, ScaleViewportExtEx, SetViewportExtEx, OffsetViewportOrgEx, SetViewportOrgEx, SetMapMode, SetBkMode, GetStockObject, SelectObject, RestoreDC, SaveDC, DeleteDC, GetObjectA, SetBkColor, SetTextColor, GetClipBox, CreateDIBitmap, GetTextExtentPointA, BitBlt, CreateCompatibleDC, CreateBitmap
> comdlg32.dll: GetFileTitleA
> WINSPOOL.DRV: ClosePrinter, DocumentPropertiesA, OpenPrinterA
> ADVAPI32.dll: OpenSCManagerA, RegCreateKeyExA, RegOpenKeyExA, RegisterEventSourceA, ReportEventA, DeregisterEventSource, SetServiceStatus, RegisterServiceCtrlHandlerA, StartServiceA, OpenServiceA, ControlService, QueryServiceStatus, DeleteService, SetSecurityDescriptorDacl, CreateServiceA, CloseServiceHandle, StartServiceCtrlDispatcherA, GetUserNameA, LookupAccountNameA, IsValidSid, GetLengthSid, CopySid, RegCloseKey, RegCreateKeyA, RegQueryValueExA, RegSetValueExA, RegDeleteValueA, RegDeleteKeyA, InitializeSecurityDescriptor
> COMCTL32.dll: -
> oledlg.dll: -
> ole32.dll: CoFreeUnusedLibraries, CoRegisterMessageFilter, OleInitialize, CoTaskMemAlloc, CoTaskMemFree, CreateILockBytesOnHGlobal, StgCreateDocfileOnILockBytes, StgOpenStorageOnILockBytes, CoGetClassObject, CLSIDFromString, CLSIDFromProgID, CoRevokeClassObject, OleFlushClipboard, OleIsCurrentClipboard, OleUninitialize
> OLEPRO32.DLL: -
> OLEAUT32.dll: -, -, -, -, -, -, -, -, -

Malwarebytes' Anti-Malware 1.36
Datenbank Version: 2031
Windows 5.1.2600 Service Pack 3

24.04.2009 19:56:16
mbam-log-2009-04-24 (19-56-16).txt

Scan-Methode: Vollständiger Scan (C:\|D:\|E:\|)
Durchsuchte Objekte: 245370
Laufzeit: 1 hour(s), 1 minute(s), 31 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Ghost1975 · 28.04.2009, 14:25

Hi Sandy

hatte dein Problem (fast)vergessen,sorry!
Es gibt die möglichkeit von 2 Antivirenherstellern Bootbare Cd zu laden, von diesen CDs wird dann der Rechner gebootet und man kann scannen:

-da gibt es einmal von Avira System Rescue

- oder von Gdata die Boot-CD

die Cd von Avira hat nur nen kleinen Fehler/Problem sie kommt mit ATI Grafikkarten nicht klar,wenn du also ne Grafikkarte von Ati hast nicht verwenden.
Die Sachen werden als Iso Dateien angeboten,lade sie runter und benutze ein Program wie IMGBurn um es zu Brennen,geht natürlich auch mit Nero usw.(Falls vorhanden benutze ne Wiederbescheibbare CD)
Wenns noch fragen gibt einfach melden.

Fehlermeldung scan32.exe

Antiviren-, Firewall- und andere Schutzprogramme: Fehlermeldung scan32.exe