hwclock.exe, Hardware Clock Driver

hwclock.exe, Hardware Clock Driver

Start -- Ausführen -- schreib rein: cmd

kopiere rein:
sc stop hwclock
klicke "enter"

und warte ein bisschen, dann kopiere rein:
sc delete hwclock
klicke "enter"

kopiere rein:
del C:\WINDOWS\System32\hwclock.exe
Klicke "enter

Den folgenden Text in den Editor (Start - Zubehör - Editor) kopieren und als fixme.reg mit 'Speichern unter' auf dem Desktop. Gebe bei Dateityp 'Alle Dateien' an. Du solltest jetzt auf dem Desktop diese Datei finden.

REGEDIT4 [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_HWCLOCK] [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\hwclock] [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_HWCLOCK] [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\hwclock] [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hwclock]

Computer in den abgesicherten Modus neustarten (F8 beim Starten drücken).
Die Datei "fixme.reg" auf dem Desktop doppelklicken.
und sofort wieder neustarten

HijackThis

O4 - HKLM\..\Run: [rfagent] "C:\Programme\RFA\rfagent.exe
O4 - HKLM\..\Run: [MS MSN Menssenger 7.0] MSMSN7.exe
O4 - HKLM\..\RunServices: [MS MSN Menssenger 7.0] MSMSN7.exe
O4 - HKCU\..\Run: [MS MSN Menssenger 7.0] MSMSN7.exe
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe (file missing)

O4 - HKLM\..\Run: [MS UniX] navupdate64.exe
O4 - HKLM\..\Run: [SYSTRAY] C:\UNMT.EXE
O4 - HKLM\..\RunServices: [MS UniX] navupdate64.exe
O4 - HKCU\..\Run: [MS UniX] navupdate64.exe
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe (file missing)

O4 - HKLM\..\Run: [*Wssocks] wssocks.exe
O4 - HKLM\..\RunServices: [*Wssocks] wssocks.exe
O4 - HKCU\..\Run: [*Wssocks] wssocks.exe
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe (file missing)

datfindbat

18.06.2005 17:19 109.056 navupdate64.exe
18.06.2005 16:04 0 TFTP2580
18.06.2005 01:29 0 TFTP3844
14.06.2005 13:07 0 TFTP3884
13.06.2005 21:15 0 TFTP868

C:\UNMT.EXE
C:\WINDOWS\system32\TFTP2580
C:\WINDOWS\system32\TFTP3844
C:\WINDOWS\system32\TFTP3884
C:\WINDOWS\system32\TFTP868
C:\WINDOWS\System32\hwclock.exe
C:\WINDOWS\system32\navupdate64.exe

C:\WINDOWS\System32\MSMSN7.exe
C:\WINDOWS\System32\hwclock.exe
Windows/Prefetch-Ordner (hwclock.exe-0f82b9c8)

C:\WINDOWS\System32\ntload.bat
C:\ntload.bat
C:\sys.bat
C:\WINDOWS\system32\TFTP1884
C:\WINDOWS\system32\TFTP2640
C:\WINDOWS\system32\TFTP1796
C:\WINDOWS\system32\TFTP2612
C:\WINDOWS\System32\hwclock.exe
C:\WINDOWS\system 32\ftpupd.exe
C:\WINDOWS\system32\o
C:\WINDOWS\system32\work.exe
C:\WINDOWS\System32\winpnp32.exe
C:\WINDOWS\System32\SCardClnt.exe

?????
C:\Windows\System32\SYSTEM.EXE
C:\Windows\System32\winpnp32.exe
C:\Windows\System32\winpnp.exe
C:\Windows\System32\mousehs.exe
C:\Windows\System32\hwclock.exe

"dcpromo.log" into the "%Windows%\Debug" directory

W32/Hwbot-A sets the following entries in the registry:

HKLM\software\microsoft\ole
enabledcom
"n"

HKLM\system\currentcontrolset\control\lsa
restrictanonymous
"1"

Service name: Service Control Application
Display name: SCA
Description: Controls and manages system services.
Path to executable: %System%\SYSTEM.EXE
Startup type: Automatic

Service name: hwclock
Display name: Hardware Clock Driver
Description: Enables a computer to save and restore system time information using the hardware clock. Stopping or disabling this service will result in system instability.

Path to executable: %System%\hwclock.exe
Startup type: Automatic

Service name: winpnp32
Display name: Windows 32-bit PnP Driver
Description: Enables a computer to recognize and adapt to hardware changes with little or no user input. Stopping or disabling this service will result in system instability.
Path to executable: %System%\winpnp32.exe
Startup type: Automatic

Service name: mousehs
Display name: Mouse Hardware Sync
Description: Enables a computer to maintain synchronization with a PS/2 pointing device. Stopping or disabling this service will result in system instability.
Path to executable: %System%\mousehs.exe
Startup type: Automatic

Service name: winpnp
Display name: Windows PnP Driver
Description: Enables a computer to recognize and adapt to hardware changes with little or no user input. Stopping or disabling this service will result in system instability.
Path to executable: %System%\winpnp.exe
Startup type: Automatic