| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Trojanerbefall: Bundespolizei; explorer.exe infiziertWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
30.05.2012, 12:35
| #1 |
| |  Trojanerbefall: Bundespolizei; explorer.exe infiziert Liebe Helfer, zuerst einmal ein Riesendankeschön für die Hilfestellung, die ihr uns ermöglicht. Mein Problem ist Folgendes: Mein System (Netbook ohne CD/DVD-Laufwerk) ist vom Bundespolizei-Trojaner befallen und wie es aussieht, ist die explorer.exe infiziert. Ich habe die Anweisungen unter www.redirect301.de/bundespolizei-trojaner-entfernen.html befolgt: 1. Der abgesicherte Modus mit Eingabeaufforderung wird ignoriert bzw. nicht geöffnet. 2. Der abgesicherte Modus mit Netzwerktreibern funktioniert. Den habe ich dann genommen und bin auch bis Punkt 8 gekommen, aber da bei mir im Shell-Schlüssel schon "explorer.exe" steht, wird es etwas komplizierter. Hier steht, ich müsste die explorer.exe ersetzen und ich könnte dies mit der Boot-CD, allerdings habe ich keine und ich könnte auch keine einlegen, da kein Laufwerk vorhanden. Das einzige, was ginge, wäre über einen USB-Stick, doch so einfach findet sich die explorer.exe zum Download nicht für Windows 7. Es wäre nett, wenn ihr mir helfen könntet, diesen Trojaner aus meinem System zu entfernen. Jedenfalls habe ich jetzt die auf eurer Seite empfohlenen Scans durchgeführt und poste mal die Log-Dateien: Defogger-Log: defogger_disable by jpshortstuff (23.02.10.1) Log created at 11:53 on 30/05/2012 (Hannsi) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- OTL OTL logfile created on: 5/30/2012 11:56:19 AM - Run 1 OTL by OldTimer - Version 3.2.44.0 Folder = C:\Users\Hannsi\Desktop Starter Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1013.30 Mb Total Physical Memory | 646.94 Mb Available Physical Memory | 63.85% Memory free 1.99 Gb Paging File | 1.67 Gb Available in Paging File | 83.92% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files Drive C: | 71.87 Gb Total Space | 47.82 Gb Free Space | 66.53% Space Free | Partition Type: NTFS Drive D: | 141.53 Gb Total Space | 141.44 Gb Free Space | 99.94% Space Free | Partition Type: NTFS Computer Name: HANNSI-NETBOOK | User Name: Hannsi | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012/05/30 11:55:12 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Hannsi\Desktop\OTL.exe PRC - [2011/02/25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe ========== Modules (No Company Name) ========== ========== Win32 Services (SafeList) ========== SRV - File not found [Auto | Stopped] -- C:\Program Files\Spybot -- (SBSDWSCService) SRV - [2012/05/05 01:43:43 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2010/11/05 03:52:39 | 000,128,848 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing) SRV - [2010/05/08 13:48:36 | 000,229,376 | ---- | M] () [Auto | Stopped] -- C:\ProgramData\DatacardService\DCService.exe -- (DCService.exe) SRV - [2009/12/07 03:42:40 | 000,013,824 | ---- | M] () [Auto | Stopped] -- C:\Program Files\HyperSpace\HSServiceLauncher.exe -- (HS Service Launcher) SRV - [2009/10/02 17:48:26 | 000,595,232 | ---- | M] (Broadcom Corporation.) [Auto | Stopped] -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins) SRV - [2009/08/14 12:01:40 | 000,009,216 | ---- | M] (Vodafone) [Auto | Stopped] -- C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe -- (VMCService) SRV - [2009/08/13 21:58:10 | 000,044,312 | ---- | M] () [Auto | Stopped] -- C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe -- (OberonGameConsoleService) SRV - [2009/07/14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend) SRV - [2009/07/14 03:15:41 | 000,075,264 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\System32\mprdim.dll -- (RemoteAccess) SRV - [2009/06/10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009/03/05 11:54:50 | 000,311,296 | ---- | M] () [Auto | Stopped] -- C:\Windows\System32\Rezip.exe -- (Rezip) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Hannsi\AppData\Local\Temp\phoenix\PhnxBldr.sys -- (PhnxBuilder) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbfake.sys -- (hwusbfake) DRV - [2010/11/20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV - [2010/11/20 10:42:28 | 000,246,784 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\System32\drivers\udfs.sys -- (udfs) DRV - [2010/06/10 04:43:18 | 001,271,808 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr) DRV - [2010/04/09 15:24:12 | 000,063,616 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ew_jubusenum.sys -- (huawei_enumerator) DRV - [2010/04/07 17:05:00 | 000,204,800 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbnet.sys -- (ewusbnet) DRV - [2010/03/25 10:08:38 | 000,105,984 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard) DRV - [2010/03/20 11:56:04 | 000,101,504 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ew_hwusbdev.sys -- (ew_hwusbdev) DRV - [2009/12/07 03:42:42 | 000,016,384 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | System | Stopped] -- C:\Program Files\HyperSpace\DRToggleSleep.sys -- (DRToggleSleep) DRV - [2009/12/07 03:42:40 | 000,054,784 | ---- | M] (Phoenix Technologies Ltd.) [Kernel | On_Demand | Stopped] -- C:\Program Files\HyperSpace\PhnxBldr.sys -- (PhnxBldr) DRV - [2009/09/28 11:22:00 | 000,315,392 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\yk62x86.sys -- (yukonw7) DRV - [2009/07/14 03:20:28 | 000,022,096 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\crcdisk.sys -- (crcdisk) DRV - [2009/07/14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\ws2ifsl.sys -- (ws2ifsl) DRV - [2009/07/14 01:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp) DRV - [2009/07/14 01:11:15 | 000,070,656 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\System32\drivers\cdfs.sys -- (cdfs) DRV - [2009/07/01 22:46:20 | 000,043,944 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btusbflt.sys -- (btusbflt) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.web.de/br/ie9_startpage IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\..\SearchScopes,DefaultScope = {6B1D1FB7-7233-4F7C-802C-21A1DDB12754} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{09038620-190C-402B-A92F-18864E6AB22F}: "URL" = hxxp://go.1und1.de/br/ie9_search_web/?su={searchTerms} IE - HKCU\..\SearchScopes\{40064957-18EB-412d-9146-3F57E8D92EEC}: "URL" = hxxp://go.web.de/br/ie9_search_pic/?su={searchTerms} IE - HKCU\..\SearchScopes\{5A817CF6-92D5-4DE5-AC38-82DF8A73EF28}: "URL" = hxxp://go.gmx.net/br/ie9_search_web/?su={searchTerms} IE - HKCU\..\SearchScopes\{6B1D1FB7-7233-4F7C-802C-21A1DDB12754}: "URL" = hxxp://go.web.de/br/ie9_search_web/?su={searchTerms} IE - HKCU\..\SearchScopes\{8D27B32E-89EE-460e-82D2-5FC354078EAD}: "URL" = hxxp://go.web.de/br/ie9_search_produkte/?su={searchTerms} IE - HKCU\..\SearchScopes\{DCE59F23-A446-45a5-9459-E68FDC0DE38D}: "URL" = hxxp://go.web.de/br/ie9_search_maps/?su={searchTerms} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local> ========== FireFox ========== FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\3.0.40624.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) O1 HOSTS File: ([2009/06/10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (WEB.DE Konfiguration) - {17166733-40EA-4432-A85C-AE672FF0E236} - C:\ProgramData\1und1InternetExplorerAddon\BHOXML.dll (1&1 Mail & Media GmbH) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O2 - BHO: (WEB.DE Toolbar BHO) - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files\WEB.DE Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH) O3 - HKLM\..\Toolbar: (WEB.DE Toolbar) - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Program Files\WEB.DE Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH) O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (WEB.DE Toolbar) - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Program Files\WEB.DE Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH) O4 - HKLM..\Run: [APLangApp] C:\Program Files\AnyPC Client\APLangApp.exe (DoctorSoft) O4 - HKLM..\Run: [hscontrolcenter] C:\Program Files\HyperSpace\HSControlCenter.exe (Phoenix Technologies) O4 - HKLM..\Run: [MobileConnect] C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone) O4 - HKCU..\Run: [iimebsruvtgjuga] C:\ProgramData\iimebsruvtgjugabrygf.exe () O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.) O4 - Startup: C:\Users\Hannsi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Check for TWS Updates.lnk = C:\Jts\WiseUpdt.exe () O4 - Startup: C:\Users\Hannsi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm () O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{038F7882-5F01-47EB-96EA-76DB13E7ADD5}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4488C0F3-0C17-4E5C-A7E6-78C0AE2034C7}: NameServer = 193.189.244.225 193.189.244.206 O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\webde {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\WEB.DE Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009/06/10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{027fcdf4-74bc-11df-ba2d-0026b6d8b804}\Shell - "" = AutoRun O33 - MountPoints2\{027fcdf4-74bc-11df-ba2d-0026b6d8b804}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{0bb5ff70-7aa7-11df-ba0d-0026b6d8b804}\Shell - "" = AutoRun O33 - MountPoints2\{0bb5ff70-7aa7-11df-ba0d-0026b6d8b804}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{1959898b-544f-11df-a7d5-00245468e9c5}\Shell - "" = AutoRun O33 - MountPoints2\{1959898b-544f-11df-a7d5-00245468e9c5}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{1959899f-544f-11df-a7d5-0026b6d8b804}\Shell - "" = AutoRun O33 - MountPoints2\{1959899f-544f-11df-a7d5-0026b6d8b804}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{2f2cd250-7d35-11e0-b2ae-0026b6d8b804}\Shell - "" = AutoRun O33 - MountPoints2\{2f2cd250-7d35-11e0-b2ae-0026b6d8b804}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{2f2cd252-7d35-11e0-b2ae-0026b6d8b804}\Shell - "" = AutoRun O33 - MountPoints2\{2f2cd252-7d35-11e0-b2ae-0026b6d8b804}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{2f2cd254-7d35-11e0-b2ae-0026b6d8b804}\Shell - "" = AutoRun O33 - MountPoints2\{2f2cd254-7d35-11e0-b2ae-0026b6d8b804}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{2f2cd278-7d35-11e0-b2ae-0026b6d8b804}\Shell - "" = AutoRun O33 - MountPoints2\{2f2cd278-7d35-11e0-b2ae-0026b6d8b804}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{2f2cd27c-7d35-11e0-b2ae-0026b6d8b804}\Shell - "" = AutoRun O33 - MountPoints2\{2f2cd27c-7d35-11e0-b2ae-0026b6d8b804}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{39ce0342-6354-11e0-b2a8-0026b6d8b804}\Shell - "" = AutoRun O33 - MountPoints2\{39ce0342-6354-11e0-b2a8-0026b6d8b804}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{39ce0389-6354-11e0-b2a8-0026b6d8b804}\Shell - "" = AutoRun O33 - MountPoints2\{39ce0389-6354-11e0-b2a8-0026b6d8b804}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{4dcb4684-544b-11df-a7b8-0026b6d8b804}\Shell - "" = AutoRun O33 - MountPoints2\{4dcb4684-544b-11df-a7b8-0026b6d8b804}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{4dcb4691-544b-11df-a7b8-0026b6d8b804}\Shell - "" = AutoRun O33 - MountPoints2\{4dcb4691-544b-11df-a7b8-0026b6d8b804}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{4dcb46a8-544b-11df-a7b8-0026b6d8b804}\Shell - "" = AutoRun O33 - MountPoints2\{4dcb46a8-544b-11df-a7b8-0026b6d8b804}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{4dcb46b2-544b-11df-a7b8-0026b6d8b804}\Shell - "" = AutoRun O33 - MountPoints2\{4dcb46b2-544b-11df-a7b8-0026b6d8b804}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{4dcb46bd-544b-11df-a7b8-0026b6d8b804}\Shell - "" = AutoRun O33 - MountPoints2\{4dcb46bd-544b-11df-a7b8-0026b6d8b804}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{641c7b0d-80ff-11df-ad89-0026b6d8b804}\Shell - "" = AutoRun O33 - MountPoints2\{641c7b0d-80ff-11df-ad89-0026b6d8b804}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{641c7b0f-80ff-11df-ad89-0026b6d8b804}\Shell - "" = AutoRun O33 - MountPoints2\{641c7b0f-80ff-11df-ad89-0026b6d8b804}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{ba630a72-6e2e-11df-ae3d-0026b6d8b804}\Shell - "" = AutoRun O33 - MountPoints2\{ba630a72-6e2e-11df-ae3d-0026b6d8b804}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{d9505af8-637b-11e0-99d9-b282fe7da5de}\Shell - "" = AutoRun O33 - MountPoints2\{d9505af8-637b-11e0-99d9-b282fe7da5de}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{e37d2d68-5473-11df-adb0-0026b6d8b804}\Shell - "" = AutoRun O33 - MountPoints2\{e37d2d68-5473-11df-adb0-0026b6d8b804}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{e37d2d71-5473-11df-adb0-0026b6d8b804}\Shell - "" = AutoRun O33 - MountPoints2\{e37d2d71-5473-11df-adb0-0026b6d8b804}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\{f70e3f48-51e9-11df-94b1-00245468e9c5}\Shell - "" = AutoRun O33 - MountPoints2\{f70e3f48-51e9-11df-94b1-00245468e9c5}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence O33 - MountPoints2\E\Shell - "" = AutoRun O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012/05/30 11:55:12 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\Hannsi\Desktop\OTL.exe [2012/05/29 18:09:03 | 000,000,000 | ---D | C] -- C:\ProgramData\tpimlaazqodueha [2012/05/15 18:43:27 | 000,000,000 | ---D | C] -- C:\Users\Hannsi\Documents\openoffice vorlagen [1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012/05/30 11:55:12 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Hannsi\Desktop\OTL.exe [2012/05/30 11:53:05 | 000,000,000 | ---- | M] () -- C:\Users\Hannsi\defogger_reenable [2012/05/30 11:52:12 | 000,050,477 | ---- | M] () -- C:\Users\Hannsi\Desktop\Defogger.exe [2012/05/30 10:10:58 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat [2012/05/30 10:10:46 | 796,889,088 | -HS- | M] () -- C:\hiberfil.sys [2012/05/30 10:08:22 | 000,000,014 | ---- | M] () -- C:\windows\System32\setenv.bat [2012/05/29 18:59:10 | 000,010,272 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012/05/29 18:59:09 | 000,010,272 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012/05/29 18:09:09 | 000,000,448 | ---- | M] () -- C:\ProgramData\zfixmatqcypzqro [2012/05/29 18:08:46 | 000,057,344 | ---- | M] () -- C:\ProgramData\iimebsruvtgjugabrygf.exe [2012/05/29 18:08:46 | 000,057,344 | ---- | M] () -- C:\Users\Hannsi\0.5301849565704305.exe [2012/05/29 17:43:01 | 000,000,884 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job [2012/05/10 11:03:49 | 000,349,304 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT [2012/05/09 23:01:53 | 000,654,166 | ---- | M] () -- C:\windows\System32\perfh007.dat [2012/05/09 23:01:53 | 000,616,008 | ---- | M] () -- C:\windows\System32\perfh009.dat [2012/05/09 23:01:53 | 000,130,006 | ---- | M] () -- C:\windows\System32\perfc007.dat [2012/05/09 23:01:53 | 000,106,388 | ---- | M] () -- C:\windows\System32\perfc009.dat [1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2012/05/30 11:53:05 | 000,000,000 | ---- | C] () -- C:\Users\Hannsi\defogger_reenable [2012/05/30 11:52:12 | 000,050,477 | ---- | C] () -- C:\Users\Hannsi\Desktop\Defogger.exe [2012/05/29 18:09:08 | 000,057,344 | ---- | C] () -- C:\ProgramData\iimebsruvtgjugabrygf.exe [2012/05/29 18:08:57 | 000,000,448 | ---- | C] () -- C:\ProgramData\zfixmatqcypzqro [2012/05/29 18:08:43 | 000,057,344 | ---- | C] () -- C:\Users\Hannsi\0.5301849565704305.exe [2012/05/02 17:33:48 | 000,000,884 | ---- | C] () -- C:\windows\tasks\Adobe Flash Player Updater.job [2012/04/13 18:02:12 | 000,003,584 | ---- | C] () -- C:\Users\Hannsi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012/03/15 10:44:14 | 000,000,127 | ---- | C] () -- C:\windows\System32\MRT.INI [2011/03/03 21:08:43 | 000,000,042 | ---- | C] () -- C:\windows\ib.ini [2011/03/03 21:08:40 | 000,026,624 | ---- | C] () -- C:\windows\GetIe.dll [2011/03/03 20:56:35 | 000,000,107 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc [2011/02/10 12:48:54 | 000,086,016 | ---- | C] () -- C:\windows\System32\NtDirect.dll [2010/09/13 14:02:53 | 000,000,676 | ---- | C] () -- C:\windows\wiso.ini [2010/08/12 13:19:06 | 000,007,597 | ---- | C] () -- C:\Users\Hannsi\AppData\Local\Resmon.ResmonCfg ========== LOP Check ========== [2010/09/13 14:03:07 | 000,000,000 | ---D | M] -- C:\Users\Hannsi\AppData\Roaming\Buhl Data Service [2011/01/24 20:32:06 | 000,000,000 | ---D | M] -- C:\Users\Hannsi\AppData\Roaming\elsterformular [2010/04/23 23:41:53 | 000,000,000 | ---D | M] -- C:\Users\Hannsi\AppData\Roaming\OpenOffice.org [2012/02/28 15:11:01 | 000,000,000 | ---D | M] -- C:\Users\Hannsi\AppData\Roaming\Qeli [2012/03/15 10:48:34 | 000,000,000 | ---D | M] -- C:\Users\Hannsi\AppData\Roaming\Tuinm [2012/03/14 12:48:23 | 000,000,000 | ---D | M] -- C:\Users\Hannsi\AppData\Roaming\Ufcen [2010/04/27 12:50:58 | 000,000,000 | ---D | M] -- C:\Users\Hannsi\AppData\Roaming\Vodafone [2010/11/15 13:17:26 | 000,000,000 | ---D | M] -- C:\Users\Hannsi\AppData\Roaming\Windows Live Writer [2012/02/17 10:18:07 | 000,032,640 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > OTL - Extras OTL Extras logfile created on: 5/30/2012 11:56:19 AM - Run 1 OTL by OldTimer - Version 3.2.44.0 Folder = C:\Users\Hannsi\Desktop Starter Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1013.30 Mb Total Physical Memory | 646.94 Mb Available Physical Memory | 63.85% Memory free 1.99 Gb Paging File | 1.67 Gb Available in Paging File | 83.92% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files Drive C: | 71.87 Gb Total Space | 47.82 Gb Free Space | 66.53% Space Free | Partition Type: NTFS Drive D: | 141.53 Gb Total Space | 141.44 Gb Free Space | 99.94% Space Free | Partition Type: NTFS Computer Name: HANNSI-NETBOOK | User Name: Hannsi | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\windows\System32\control.exe (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\windows\winhlp32.exe (Microsoft Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~3\Office12\ONENOTE.EXE "%L" Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = Reg Error: Unknown registry data type -- File not found "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 ========== Authorized Applications List ========== ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{120A5B51-ADD5-460E-BB38-AD3F6E14FBCE}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{1512EEE7-5ECC-4E40-B546-88F55EA1F550}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | "{33BC6615-A832-47F8-B2DF-8E642D9E1CCD}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{36658399-52B7-4C5D-86C8-B81FBE9C5274}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{4BC8866A-32BA-4E9A-8BD9-04E345ABE3FA}" = rport=445 | protocol=6 | dir=out | app=system | "{542F62AF-6A3E-451D-8B14-C2794F402937}" = rport=139 | protocol=6 | dir=out | app=system | "{6F6C3923-B0DE-401F-9A51-4975DE1A2D9E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | "{70A9D8F4-ECDB-4BAA-AB20-2302CA403093}" = rport=137 | protocol=17 | dir=out | app=system | "{84AE4EDE-269E-4FB0-AA40-BDA7841C13DD}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | "{8948571E-5D31-4A17-B909-554A256323E1}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{92857B84-FABA-4AA5-96D2-991DE659C378}" = lport=139 | protocol=6 | dir=in | app=system | "{929A1659-9759-4F11-AEDA-C79D22F051CD}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | "{942FDA78-DE72-48D9-B53E-F05476742A2A}" = lport=137 | protocol=17 | dir=in | app=system | "{95E652C0-FB7D-411E-9C46-DE52867E9660}" = rport=138 | protocol=17 | dir=out | app=system | "{A291A363-6819-4E35-A19B-19FB2F8E75F9}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | "{AE4F4791-2ED6-4028-806C-57DDC00BAC3D}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{B53D4139-0131-453D-905E-975F320186DA}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | "{C7FEFDCF-05CD-4E10-8ADB-532BF2AA2534}" = lport=138 | protocol=17 | dir=in | app=system | "{D362B42B-EBFA-4721-973B-5F5AA045CAEF}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{E1FCE2A5-09B9-466C-85D4-DF2BA10BFAD3}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{E55CDC3C-6D43-4D34-8A99-1FD3FBE5043B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{EDEF7601-21D4-4C91-84ED-C0AC95CC485D}" = lport=2869 | protocol=6 | dir=in | app=system | "{F238687D-F1A6-4AFE-B197-B8730CC9A797}" = lport=445 | protocol=6 | dir=in | app=system | "{F6EF0A76-C679-4E7B-AEC7-62794BEFF86E}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{002D8F08-E0BF-4707-A2DA-6262A080EAAB}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | "{04D2779B-6745-4097-BAE2-707BE690C4BD}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | "{2FF9B4A3-3A36-4B58-9D9D-E1AC97520DAC}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe | "{5156B38A-DDC2-4F89-B05C-49CFA9F11DBC}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | "{7EAC6B67-E246-464D-BA01-ED3214C00A9E}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | "{8691AB9A-C478-4012-AECF-BB9857E8149E}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | "{9E458C85-10F6-4AE2-B6DD-37035993A5E8}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | "{B25875CC-A6DA-42A7-9F28-5F6713C575BD}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | "{EFE87BEC-2C51-4992-9536-4894E6DF5817}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | "{FB7FD76A-596E-4AEB-B811-D3C71BA9F149}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | "TCP Query User{03451E8C-7A1E-487E-8203-8743EC3F3A39}C:\windows\system32\javaw.exe" = protocol=6 | dir=in | app=c:\windows\system32\javaw.exe | "TCP Query User{0CF88987-EF67-4DB9-8527-AC25F0400E46}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe | "TCP Query User{34AAE614-C39D-4FCF-AB45-DE291765BACC}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe | "TCP Query User{3BAFE50A-6B6C-4172-802E-195D8B3274B0}C:\program files\ninjatrader 7\bin\ninjatrader.exe" = protocol=6 | dir=in | app=c:\program files\ninjatrader 7\bin\ninjatrader.exe | "TCP Query User{8A99DED5-0586-4690-AE34-8D0C2E4AF073}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | "TCP Query User{F05557A9-8EC0-4784-84A3-54127EC9E534}C:\windows\system32\taskhost.exe" = protocol=6 | dir=in | app=c:\windows\system32\taskhost.exe | "TCP Query User{FA2016FB-78B8-49DC-9565-649875657248}C:\windows\system32\taskhost.exe" = protocol=6 | dir=in | app=c:\windows\system32\taskhost.exe | "UDP Query User{077BA745-F523-444C-B1DF-413DB4E28BDC}C:\windows\system32\javaw.exe" = protocol=17 | dir=in | app=c:\windows\system32\javaw.exe | "UDP Query User{0B86C9F3-4022-478A-8BE9-73AB9D156B72}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe | "UDP Query User{3FA989EA-6BBB-46E6-92E9-DB649B91E170}C:\windows\system32\taskhost.exe" = protocol=17 | dir=in | app=c:\windows\system32\taskhost.exe | "UDP Query User{5A33B077-76F5-4D8E-981B-FB39EB604DE4}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | "UDP Query User{7EB51E27-CC3B-4743-9229-B50323A2B5DF}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe | "UDP Query User{ADE8BEE5-E74C-4DA0-AA6D-A6F196AAD2FC}C:\windows\system32\taskhost.exe" = protocol=17 | dir=in | app=c:\windows\system32\taskhost.exe | "UDP Query User{C029F917-E42D-43B0-8DCA-D363139F200E}C:\program files\ninjatrader 7\bin\ninjatrader.exe" = protocol=17 | dir=in | app=c:\program files\ninjatrader 7\bin\ninjatrader.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam "{02F0B8AE-7501-4333-AFBE-6BAABFEC7637}" = WISO Steuer-Sparbuch 2011 "{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution 4 "{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager "{178EE5F4-0F86-4BF0-A0D1-9790AFF409D1}" = EasyBatteryManager "{192A107E-C6B9-41B9-BDBF-38E3AA226054}" = OpenOffice.org 3.2 "{1AFA1FEF-8CF9-4A51-AC46-64FAA7F3D9E2}" = AnyPC Client "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool "{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT "{26A24AE4-039D-4CA4-87B4-2F83216018F0}" = Java(TM) 6 Update 18 "{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 24 "{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie "{32749442-4BA0-4C1C-B722-EE3885AA0E80}" = NinjaTrader 7 "{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works "{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile "{3EFEF049-23D4-4B46-8903-4592FEA51018}" = Windows Live Movie Maker "{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger "{45535A5E-1F81-4F35-BE1D-43D10A7D03B4}" = Easy Resolution Manager "{4725E135-CF7D-4906-B4D0-D9F5FED44254}" = PreSetup HyperSpace "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent "{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3 "{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call "{63eafc52-b963-4297-a7eb-d412944e7065}_is1" = Game Pack "{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 "{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-114072167}" = Go-Go Gourmet "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115053100}" = Dairy Dash "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11531173}" = Farm Frenzy 2 "{853F8A41-A3C9-43FA-87FA-1AE74FC6F3F7}" = BatteryLifeExtender "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007 "{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007 "{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007 "{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007 "{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007 "{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007 "{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System "{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007 "{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007 "{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007 "{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager "{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007 "{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{92D50865-FC60-4EA8-BA7A-5581B0D13EFB}" = ChargeableUSB "{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German) "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting "{96B51C0B-D3BE-4DF3-959C-28B22C10CFBB}" = Vodafone Mobile Connect Lite "{994223F3-A99B-4DDD-9E1D-0190A17C6860}" = Windows Live Family Safety "{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}" = WIDCOMM Bluetooth Software "{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.3 - Deutsch "{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9 "{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy "{B660E0D0-A8CB-45A7-96FB-93E8C915A0B2}" = Easy Network Manager "{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}" = User Guide "{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail "{CC4BBCBA-89F6-47C3-9B0F-5CE5BB1C316C}" = WEB.DE Toolbar MSVC100 CRT x86 "{CCC2B140-B47A-45FA-AAE3-BD60DA41AE00}" = Samsung Support Center "{D1434266-0486-4469-B338-A60082CC04E1}" = Atheros Client Installation Program "{D3F2FAA5-FEC4-42AA-9ABA-1F763919A2B5}" = Samsung Update Plus "{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer "{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update "{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant "{EF367AA4-070B-493C-9575-85BE59D789C9}" = Easy SpeedUp Manager "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU] "{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F2BC3383-F000-410C-A038-3846ADBE8D90}" = REALTEK Wireless LAN Software "{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials "1&1 Mail & Media GmbH 1und1InternetExplorerAddon" = WEB.DE Internet Explorer Addon "1&1 Mail & Media GmbH 1und1Softwareaktualisierung" = WEB.DE Softwareaktualisierung "1&1 Mail & Media GmbH Toolbar IE8" = WEB.DE Toolbar für Internet Explorer "755087041320E005CB1E8A67C5C55A260EB81B90" = Windows Driver Package - Broadcom Bluetooth (09/11/2009 6.2.0.9407) "A6A8668C0A13640CA28FE2A7D9654BE4AE478B13" = Windows Driver Package - Broadcom Bluetooth (07/30/2009 6.2.0.9405) "Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX "BF20603967CFDCB2BBF91950E8A56DFBC5C833FE" = Windows Driver Package - Broadcom HIDClass (07/28/2009 6.2.0.9800) "ElsterFormular für Privatanwender und Unternehmer 12.0.0.5880k" = ElsterFormular für Privatanwender und Unternehmer "HDMI" = Intel(R) Graphics Media Accelerator Driver "HOMESTUDENTR" = Microsoft Office Home and Student 2007 "HyperSpace" = HyperSpace "InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam "Marvell Miniport Driver" = Marvell Miniport Driver "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "Mobile Partner" = Mobile Partner "SynTPDeinstKey" = Synaptics Pointing Device Driver "Trader Workstation 4.0" = Trader Workstation 4.0 "WinLiveSuite_Wave3" = Windows Live Essentials ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Trader Workstation" = Trader Workstation ========== Last 10 Event Log Errors ========== Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt! < End of report > GMER.TXT GMER 1.0.15.15641 - hxxp://www.gmer.net Rootkit scan 2012-05-30 12:55:39 Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 SAMSUNG_ rev.2AC1 Running: tdxddebs.exe; Driver: C:\Users\Hannsi\AppData\Local\Temp\awdcipow.sys ---- Kernel code sections - GMER 1.0.15 ---- .text ntkrnlpa.exe!ZwRollbackEnlistment + 140D 81E8D3C9 1 Byte [06] .text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 81EC6D52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3} ---- Devices - GMER 1.0.15 ---- AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation) AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume5 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume5 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation) Device \Driver\ACPI_HAL \Device\0000004b halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) Device \FileSystem\fastfat \Fat 93103130 Device \FileSystem\fastfat \Fat 930FF62C AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation) ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0026b654f6e1 Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0026b6d8b804 Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0c6076fedcf2 Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0c6076fedd81 Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0026b654f6e1 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0026b6d8b804 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0c6076fedcf2 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0c6076fedd81 (not active ControlSet) ---- EOF - GMER 1.0.15 ---- Warte gespannt auf Nachrichten Nene |
|
30.05.2012, 12:54
| #2 |
  | Trojanerbefall: Bundespolizei; explorer.exe infiziert Hi,
__________________sollte nicht notwendig sein, es reicht wahrscheinlich das killen des Eintrags: Code:
ATTFilter O4 - HKCU..\Run: [iimebsruvtgjuga] C:\ProgramData\iimebsruvtgjugabrygf.exe ()
Fix für OTL:
 Code:
ATTFilter
:OTL
O4 - HKCU..\Run: [iimebsruvtgjuga] C:\ProgramData\iimebsruvtgjugabrygf.exe ()
[2012/05/29 18:09:09 | 000,000,448 | ---- | M] () -- C:\ProgramData\zfixmatqcypzqro
[2012/05/29 18:08:46 | 000,057,344 | ---- | M] () -- C:\ProgramData\iimebsruvtgjugabrygf.exe
[2012/05/29 18:08:46 | 000,057,344 | ---- | M] () -- C:\Users\Hannsi\0.5301849565704305.exe
O33 - MountPoints2\{027fcdf4-74bc-11df-ba2d-0026b6d8b804}\Shell - "" = AutoRun
O33 - MountPoints2\{027fcdf4-74bc-11df-ba2d-0026b6d8b804}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{0bb5ff70-7aa7-11df-ba0d-0026b6d8b804}\Shell - "" = AutoRun
O33 - MountPoints2\{0bb5ff70-7aa7-11df-ba0d-0026b6d8b804}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{1959898b-544f-11df-a7d5-00245468e9c5}\Shell - "" = AutoRun
O33 - MountPoints2\{1959898b-544f-11df-a7d5-00245468e9c5}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{1959899f-544f-11df-a7d5-0026b6d8b804}\Shell - "" = AutoRun
O33 - MountPoints2\{1959899f-544f-11df-a7d5-0026b6d8b804}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{2f2cd250-7d35-11e0-b2ae-0026b6d8b804}\Shell - "" = AutoRun
O33 - MountPoints2\{2f2cd250-7d35-11e0-b2ae-0026b6d8b804}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{2f2cd252-7d35-11e0-b2ae-0026b6d8b804}\Shell - "" = AutoRun
O33 - MountPoints2\{2f2cd252-7d35-11e0-b2ae-0026b6d8b804}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{2f2cd254-7d35-11e0-b2ae-0026b6d8b804}\Shell - "" = AutoRun
O33 - MountPoints2\{2f2cd254-7d35-11e0-b2ae-0026b6d8b804}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{2f2cd278-7d35-11e0-b2ae-0026b6d8b804}\Shell - "" = AutoRun
O33 - MountPoints2\{2f2cd278-7d35-11e0-b2ae-0026b6d8b804}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{2f2cd27c-7d35-11e0-b2ae-0026b6d8b804}\Shell - "" = AutoRun
O33 - MountPoints2\{2f2cd27c-7d35-11e0-b2ae-0026b6d8b804}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{39ce0342-6354-11e0-b2a8-0026b6d8b804}\Shell - "" = AutoRun
O33 - MountPoints2\{39ce0342-6354-11e0-b2a8-0026b6d8b804}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{39ce0389-6354-11e0-b2a8-0026b6d8b804}\Shell - "" = AutoRun
O33 - MountPoints2\{39ce0389-6354-11e0-b2a8-0026b6d8b804}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{4dcb4684-544b-11df-a7b8-0026b6d8b804}\Shell - "" = AutoRun
O33 - MountPoints2\{4dcb4684-544b-11df-a7b8-0026b6d8b804}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{4dcb4691-544b-11df-a7b8-0026b6d8b804}\Shell - "" = AutoRun
O33 - MountPoints2\{4dcb4691-544b-11df-a7b8-0026b6d8b804}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{4dcb46a8-544b-11df-a7b8-0026b6d8b804}\Shell - "" = AutoRun
O33 - MountPoints2\{4dcb46a8-544b-11df-a7b8-0026b6d8b804}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{4dcb46b2-544b-11df-a7b8-0026b6d8b804}\Shell - "" = AutoRun
O33 - MountPoints2\{4dcb46b2-544b-11df-a7b8-0026b6d8b804}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{4dcb46bd-544b-11df-a7b8-0026b6d8b804}\Shell - "" = AutoRun
O33 - MountPoints2\{4dcb46bd-544b-11df-a7b8-0026b6d8b804}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{641c7b0d-80ff-11df-ad89-0026b6d8b804}\Shell - "" = AutoRun
O33 - MountPoints2\{641c7b0d-80ff-11df-ad89-0026b6d8b804}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{641c7b0f-80ff-11df-ad89-0026b6d8b804}\Shell - "" = AutoRun
O33 - MountPoints2\{641c7b0f-80ff-11df-ad89-0026b6d8b804}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{ba630a72-6e2e-11df-ae3d-0026b6d8b804}\Shell - "" = AutoRun
O33 - MountPoints2\{ba630a72-6e2e-11df-ae3d-0026b6d8b804}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{d9505af8-637b-11e0-99d9-b282fe7da5de}\Shell - "" = AutoRun
O33 - MountPoints2\{d9505af8-637b-11e0-99d9-b282fe7da5de}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{e37d2d68-5473-11df-adb0-0026b6d8b804}\Shell - "" = AutoRun
O33 - MountPoints2\{e37d2d68-5473-11df-adb0-0026b6d8b804}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{e37d2d71-5473-11df-adb0-0026b6d8b804}\Shell - "" = AutoRun
O33 - MountPoints2\{e37d2d71-5473-11df-adb0-0026b6d8b804}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{f70e3f48-51e9-11df-94b1-00245468e9c5}\Shell - "" = AutoRun
O33 - MountPoints2\{f70e3f48-51e9-11df-94b1-00245468e9c5}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = dword:0x01
:Commands
[emptytemp]
[Reboot]
Danach sollte sich der Rechner normal booten lassen... Malwarebytes Antimalware (MAM) Anleitung&Download hier: http://www.trojaner-board.de/51187-m...i-malware.html Falls der Download nicht klappt, bitte hierüber eine generische Version runterladen: http://filepony.de/download-chameleon/ Danach bitte update der Signaturdateien (Reiter "Aktualisierungen" -> Suche nach Aktualisierungen") Fullscan und alles bereinigen lassen! Log posten. chris
__________________ |
|
| Themen zu Trojanerbefall: Bundespolizei; explorer.exe infiziert |
| adobe, adobe flash player, autorun, bho, boot-cd, defender, download, error, firefox, flash player, format, infiziert, install.exe, installation, locker, logfile, microsoft office word, netzwerk, office 2007, opera, plug-in, problem, realtek, registry, rundll, safer networking, searchscopes, security, software, system, taskhost.exe, temp, udp, version=1.0, vodafone, windows |
Linear-Darstellung
