Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
GVU Trojaner Win7 64bit

GVU Trojaner Win7 64bit


Log-Analyse und Auswertung: GVU Trojaner Win7 64bit

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML

Antwort
Alt 23.07.2012, 17:53   #1
gutschge
 
GVU Trojaner Win7 64bit - Standard

GVU Trojaner Win7 64bit


Hallo,

Ich habe mir den GVU Trojaner eingefangen (den neuen mit Webcam). Ich habe zunächst versucht eine Systemwiederherstellung zu machen, was aber nicht funktionierte. Anschliesend habe ich Kaspersky Windows Unlocker drüber laufen gelassen. Das klappte auch nicht, der Trojaner-Bildschirm war sofort nach dem Hochfahren wieder da.
Habe den Rechner dann im Abgesicherten Modus hochgefahren und Malwarebytes ausgeführt. Danach fuhr der Rechner dann normal Hoch.

Hier das Log:

Code:
ATTFilter
Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.23.09

Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 8.0.7601.17514
Ich Selbst :: ICHSELBST-PC [Administrator]

23.07.2012 18:14:31
mbam-log-2012-07-23 (18-14-31).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 206967
Laufzeit: 2 Minute(n), 30 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Users\Ich Selbst\AppData\Local\Temp\fe0_zip.exe (Spyware.Zbot.DG) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Ich Selbst\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk (Trojan.Ransom.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
Hier noch das Log von OTL. Eine Extras.txt Datei wurde nicht erstellt.

Code:
ATTFilter
OTL logfile created on: 23.07.2012 18:37:15 - Run 3
OTL by OldTimer - Version 3.2.54.0     Folder = C:\Users\Ich Selbst\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 0,90 Gb Available Physical Memory | 45,14% Memory free
4,00 Gb Paging File | 2,47 Gb Available in Paging File | 61,77% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 97,65 Gb Total Space | 24,03 Gb Free Space | 24,61% Space Free | Partition Type: NTFS
Drive D: | 125,46 Gb Total Space | 87,69 Gb Free Space | 69,90% Space Free | Partition Type: NTFS
Drive E: | 104,49 Gb Total Space | 27,42 Gb Free Space | 26,25% Space Free | Partition Type: NTFS
Drive F: | 2,93 Gb Total Space | 2,93 Gb Free Space | 99,99% Space Free | Partition Type: FAT32
Drive G: | 135,22 Gb Total Space | 87,69 Gb Free Space | 64,85% Space Free | Partition Type: NTFS
Drive H: | 4,30 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive I: | 1,94 Gb Total Space | 1,72 Gb Free Space | 88,51% Space Free | Partition Type: FAT32
 
Computer Name: ICHSELBST-PC | User Name: Ich Selbst | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.07.18 22:47:11 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Ich Selbst\Desktop\OTL.exe
PRC - [2012.06.19 22:43:15 | 000,529,232 | ---- | M] (Valve Corporation) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe
PRC - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.02 00:31:35 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.04.29 16:05:06 | 000,076,888 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2012.03.03 14:20:50 | 000,021,416 | ---- | M] () -- C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
PRC - [2012.02.22 07:57:02 | 003,508,624 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
PRC - [2012.02.10 06:13:00 | 002,348,352 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2012.02.09 21:05:32 | 000,382,272 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.10.03 10:14:06 | 001,409,384 | ---- | M] (Garmin) -- C:\Program Files (x86)\Garmin\Lifetime Updater\GarminLifetime.exe
PRC - [2011.09.03 22:21:57 | 001,242,448 | ---- | M] (Valve Corporation) -- C:\Program Files (x86)\Steam\steam.exe
PRC - [2011.01.17 18:50:34 | 011,322,880 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
PRC - [2011.01.17 18:50:34 | 011,314,688 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
PRC - [2008.11.18 13:15:30 | 000,307,200 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.06.19 22:43:13 | 020,313,384 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\libcef.dll
MOD - [2012.06.19 22:43:07 | 001,099,576 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avcodec-53.dll
MOD - [2012.06.19 22:43:07 | 000,895,312 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\chromehtml.DLL
MOD - [2012.06.19 22:43:07 | 000,190,776 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avformat-53.dll
MOD - [2012.06.19 22:43:07 | 000,123,192 | ---- | M] () -- C:\Program Files (x86)\Steam\bin\avutil-51.dll
MOD - [2012.06.14 03:12:18 | 018,019,840 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\d239f585ee55f833dbe21e897e1265ac\PresentationFramework.ni.dll
MOD - [2012.06.14 03:12:07 | 011,522,048 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\b7de318e9fd1ef519ca6c1f3b5dba8e0\PresentationCore.ni.dll
MOD - [2012.06.14 03:12:05 | 013,198,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\00a4922fbf869a79c043b665035516b6\System.Windows.Forms.ni.dll
MOD - [2012.06.14 03:11:59 | 003,881,984 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\a6e37a05b8d0cedbc5c3ea266ae3fc31\WindowsBase.ni.dll
MOD - [2012.06.14 03:11:58 | 001,666,048 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\4230ed1c7990e4ee8352baf67a2a85fa\System.Drawing.ni.dll
MOD - [2012.05.14 15:02:46 | 001,218,560 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Management\d0e1cdaff8f9055187f8e7b52c060dff\System.Management.ni.dll
MOD - [2012.05.14 15:01:41 | 000,762,880 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\31fab24c51c0cfe8b8115f24545f169f\System.Runtime.Remoting.ni.dll
MOD - [2012.05.14 15:01:35 | 001,782,272 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\b68bee05c7e518172982cc92059c3315\System.Xaml.ni.dll
MOD - [2012.05.14 15:01:35 | 000,393,216 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\8a8079623eab0ba9e106436885a0281d\System.Xml.Linq.ni.dll
MOD - [2012.05.14 01:26:11 | 000,595,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\608d29d7cc89f3a9a195c91354561915\PresentationFramework.Aero.ni.dll
MOD - [2012.05.14 01:23:15 | 007,069,184 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\09bd2126bba2ab4f29ed52afde1470d7\System.Core.ni.dll
MOD - [2012.05.14 01:23:13 | 005,617,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\9abe44a0f82070ead5f1256683a4d25a\System.Xml.ni.dll
MOD - [2012.05.14 01:23:11 | 000,982,528 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\a84262e1224189f93e10cd3c403a9527\System.Configuration.ni.dll
MOD - [2012.05.14 01:23:10 | 009,092,096 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\a6be120e49f895ef6b00e9918402395b\System.ni.dll
MOD - [2012.05.14 01:23:06 | 014,414,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\c1af4ec9a36f671617a8ecaec00373f4\mscorlib.ni.dll
MOD - [2012.03.03 14:20:55 | 000,115,137 | ---- | M] () -- C:\Users\Ich Selbst\AppData\Local\Temp\85e80529-e4f2-4f39-a0f4-8e660bf7f00d\CliSecureRT.dll
MOD - [2012.03.03 14:20:50 | 000,021,416 | ---- | M] () -- C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
MOD - [2011.09.25 16:12:11 | 000,985,088 | ---- | M] () -- C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
MOD - [2009.07.10 09:07:18 | 000,166,912 | ---- | M] () -- C:\Windows\SysWOW64\APOMngr.DLL
MOD - [2009.02.06 18:52:24 | 000,073,728 | ---- | M] () -- C:\Windows\SysWOW64\CmdRtr.DLL
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012.07.20 16:28:00 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.07.19 14:51:08 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.06.19 22:43:15 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.04.29 16:05:06 | 000,076,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2012.03.26 18:49:56 | 000,291,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV - [2012.03.26 18:49:56 | 000,012,600 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2012.02.10 06:13:00 | 002,348,352 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012.02.09 21:05:32 | 000,382,272 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.09.04 00:07:01 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe -- (Creative ALchemy AL6 Licensing Service)
SRV - [2011.09.03 21:31:34 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008.11.18 13:15:30 | 000,307,200 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.05.02 15:24:12 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2012.04.27 10:20:04 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.04.25 00:32:27 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.03.20 20:44:12 | 000,098,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.12.08 06:22:38 | 000,203,320 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm) SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.)
DRV:64bit: - [2011.12.08 06:22:38 | 000,098,616 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.08.10 08:43:14 | 000,050,056 | ---- | M] (Saitek) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SaiBus.sys -- (SaiNtBus)
DRV:64bit: - [2010.08.10 08:43:14 | 000,022,792 | ---- | M] (Saitek) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SaiMini.sys -- (SaiMini)
DRV:64bit: - [2009.10.16 06:44:56 | 001,309,696 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\P17.sys -- (P17)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.20 04:09:57 | 000,054,272 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1E62x64.sys -- (L1E) NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller(NDIS6.20)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2008.04.04 14:33:32 | 000,178,560 | ---- | M] (Saitek) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SaiH353E.sys -- (SaiH353E)
DRV:64bit: - [2007.12.11 10:52:12 | 000,030,752 | ---- | M] (RapidSolution Software AG) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tbhsd.sys -- (tbhsd)
DRV:64bit: - [2005.03.29 01:30:38 | 000,008,192 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\URLSearchHook: {7e111a5c-3d11-4f56-9463-5310c3c69025} - C:\Program Files (x86)\Freeware.de\prxtbFree.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2736476
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2736476
IE - HKCU\..\URLSearchHook: {7e111a5c-3d11-4f56-9463-5310c3c69025} - C:\Program Files (x86)\Freeware.de\prxtbFree.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2736476
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.shortnews.de/"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.9
FF - prefs.js..extensions.enabledItems: {e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.2.5
FF - prefs.js..extensions.enabledItems: {FFB96CC1-7EB3-449D-B827-DB661701C6BB}:1.5.265.2
FF - prefs.js..extensions.enabledItems: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}:3.6.0.10
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: quickstores@quickstores.de:1.2.0
FF - prefs.js..extensions.enabledItems: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E}:3.0.1
FF - prefs.js..extensions.enabledItems: foxyproxy@eric.h.jung:3.1.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: battlefieldplay4free@ea.com:1.0.53.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - prefs.js..network.proxy.backup.ftp: "24.159.189.101"
FF - prefs.js..network.proxy.backup.ftp_port: 36081
FF - prefs.js..network.proxy.backup.socks: "24.159.189.101"
FF - prefs.js..network.proxy.backup.socks_port: 36081
FF - prefs.js..network.proxy.backup.ssl: "24.159.189.101"
FF - prefs.js..network.proxy.backup.ssl_port: 36081
FF - prefs.js..network.proxy.ftp: "24.159.189.101"
FF - prefs.js..network.proxy.ftp_port: 36081
FF - prefs.js..network.proxy.http: "24.159.189.101"
FF - prefs.js..network.proxy.http_port: 36081
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "24.159.189.101"
FF - prefs.js..network.proxy.socks_port: 36081
FF - prefs.js..network.proxy.ssl: "24.159.189.101"
FF - prefs.js..network.proxy.ssl_port: 36081
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_265.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.20 16:28:01 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.04.18 22:28:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.06.22 10:17:41 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\mail@gutscheinrausch.de: C:\Users\Ich Selbst\AppData\Roaming\Mozilla\Firefox\Profiles\ad9lm4uu.default\extensions\mail@gutscheinrausch.de
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.20 16:28:01 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.04.18 22:28:59 | 000,000,000 | ---D | M]
 
[2011.09.03 21:32:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ich Selbst\AppData\Roaming\mozilla\Extensions
[2012.07.04 15:11:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ich Selbst\AppData\Roaming\mozilla\Firefox\Profiles\ad9lm4uu.default\extensions
[2011.09.03 21:40:24 | 000,000,000 | ---D | M] (Garmin Communicator) -- C:\Users\Ich Selbst\AppData\Roaming\mozilla\Firefox\Profiles\ad9lm4uu.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2011.09.03 21:40:28 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Ich Selbst\AppData\Roaming\mozilla\Firefox\Profiles\ad9lm4uu.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.09.03 21:40:29 | 000,000,000 | ---D | M] (Torbutton) -- C:\Users\Ich Selbst\AppData\Roaming\mozilla\Firefox\Profiles\ad9lm4uu.default\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}
[2011.10.08 23:07:08 | 000,000,000 | ---D | M] (Battlefield Play4Free) -- C:\Users\Ich Selbst\AppData\Roaming\mozilla\Firefox\Profiles\ad9lm4uu.default\extensions\battlefieldplay4free@ea.com
[2012.02.28 12:30:48 | 000,000,925 | ---- | M] () -- C:\Users\Ich Selbst\AppData\Roaming\Mozilla\Firefox\Profiles\ad9lm4uu.default\searchplugins\conduit.xml
[2012.03.24 18:16:25 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.06.23 16:22:00 | 000,013,955 | ---- | M] () (No name found) -- C:\USERS\ICH SELBST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\AD9LM4UU.DEFAULT\EXTENSIONS\ADMIN@PROXY-LISTEN.DE.XPI
[2012.07.03 15:12:40 | 000,048,665 | ---- | M] () (No name found) -- C:\USERS\ICH SELBST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\AD9LM4UU.DEFAULT\EXTENSIONS\GOOGLEDICTIONARY@TOPTIP.CA.XPI
[2012.07.20 16:28:01 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.03.23 07:35:06 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2012.06.13 20:47:33 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.13 20:47:33 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.06.13 20:47:33 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.13 20:47:33 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.13 20:47:33 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.13 20:47:33 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Freeware.de Toolbar) - {7e111a5c-3d11-4f56-9463-5310c3c69025} - C:\Program Files (x86)\Freeware.de\prxtbFree.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Freeware.de Toolbar) - {7e111a5c-3d11-4f56-9463-5310c3c69025} - C:\Program Files (x86)\Freeware.de\prxtbFree.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Freeware.de Toolbar) - {7E111A5C-3D11-4F56-9463-5310C3C69025} - C:\Program Files (x86)\Freeware.de\prxtbFree.dll (Conduit Ltd.)
O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Easy TM Forever] C:\Program Files (x86)\Easy TM Forever\EasyTM.exe (NazguL)
O4 - HKLM..\Run: [Garmin Lifetime Updater] C:\Program Files (x86)\Garmin\Lifetime Updater\GarminLifetime.exe (Garmin)
O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKLM..\Run: [NapsterShell] C:\Program Files (x86)\Napster\napster.exe /systray File not found
O4 - HKLM..\Run: [P17RunE] C:\Windows\SysWow64\P17RunE.dll (Creative Technology Ltd.)
O4 - HKCU..\Run: [KiesHelper] C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe (Samsung)
O4 - HKCU..\Run: [KiesPDLR] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\steam.exe (Valve Corporation)
O4 - HKCU..\Run: [Tunebite] C:\Program Files (x86)\RapidSolution\Tunebite\Tunebite.exe -tray File not found
O4 - Startup: C:\Users\Ich Selbst\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)
O16 - DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab (Creative Software AutoUpdate 2)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15118/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7EE2E9CC-6481-4374-A7A0-4B7223FCCB66}: DhcpNameServer = 192.168.0.1
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.10.30 17:05:34 | 000,000,048 | R--- | M] () - H:\autorun.inf -- [ CDFS ]
O33 - MountPoints2\{f76ef869-d660-11e0-ba73-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{f76ef869-d660-11e0-ba73-806e6f6e6963}\Shell\AutoRun\command - "" = H:\CdAutoRun.exe -- [2006.10.30 17:54:10 | 000,049,152 | R--- | M] ()
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.07.21 15:52:21 | 000,000,000 | ---D | C] -- C:\Users\Ich Selbst\AppData\Roaming\gtk-2.0
[2012.07.21 15:50:04 | 000,000,000 | ---D | C] -- C:\Users\Ich Selbst\AppData\Roaming\Grisbi
[2012.07.18 22:47:08 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Ich Selbst\Desktop\OTL.exe
[2012.07.18 22:42:04 | 000,000,000 | ---D | C] -- C:\Users\Ich Selbst\AppData\Roaming\Malwarebytes
[2012.07.18 22:41:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.07.18 22:41:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.07.18 22:41:51 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.07.18 22:41:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.07.18 22:41:30 | 010,652,120 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\Ich Selbst\Desktop\mbam-setup-1.62.0.1300.exe
[2012.07.18 21:14:26 | 000,000,000 | ---D | C] -- C:\Users\Ich Selbst\AppData\Roaming\Avira
[2012.07.18 21:13:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2012.07.18 21:13:19 | 000,132,832 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys
[2012.07.18 21:13:19 | 000,098,848 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2012.07.18 21:13:19 | 000,027,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2012.07.18 21:13:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2012.07.18 21:13:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
[2012.07.18 20:25:25 | 000,000,000 | ---D | C] -- C:\Users\Ich Selbst\AppData\Roaming\UAs
[2012.07.18 15:49:20 | 000,000,000 | ---D | C] -- C:\Users\Ich Selbst\AppData\Roaming\13001.027
[2012.07.17 21:34:42 | 000,000,000 | ---D | C] -- C:\Users\Ich Selbst\AppData\Roaming\13001.026
[2012.07.17 21:34:22 | 000,000,000 | ---D | C] -- C:\Users\Ich Selbst\AppData\Roaming\xmldm
[2012.07.17 21:34:17 | 000,000,000 | ---D | C] -- C:\Users\Ich Selbst\AppData\Roaming\kock
[2012.06.24 22:31:50 | 000,000,000 | ---D | C] -- C:\Users\Ich Selbst\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Easy TM Forever
[2012.06.24 22:31:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Easy TM Forever
[2012.06.24 22:31:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Easy TM Forever
[1 C:\Users\Ich Selbst\AppData\Roaming\*.tmp files -> C:\Users\Ich Selbst\AppData\Roaming\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.07.23 18:27:43 | 000,013,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.23 18:27:43 | 000,013,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.23 18:27:19 | 001,505,390 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.07.23 18:27:19 | 000,656,278 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.07.23 18:27:19 | 000,618,160 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.07.23 18:27:19 | 000,131,050 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.07.23 18:27:19 | 000,107,440 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.07.23 18:20:13 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.23 18:19:43 | 1609,863,168 | -HS- | M] () -- C:\hiberfil.sys
[2012.07.23 18:10:58 | 004,503,728 | ---- | M] () -- C:\ProgramData\piz_0ef.pad
[2012.07.23 15:50:02 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.07.21 15:52:43 | 000,000,218 | ---- | M] () -- C:\Users\Ich Selbst\.recently-used.xbel
[2012.07.21 15:38:05 | 000,001,354 | ---- | M] () -- C:\Users\Ich Selbst\Desktop\20120721-113585319-umsatz.csv
[2012.07.18 22:47:11 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Ich Selbst\Desktop\OTL.exe
[2012.07.18 22:41:52 | 000,001,105 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.18 22:41:35 | 010,652,120 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\Ich Selbst\Desktop\mbam-setup-1.62.0.1300.exe
[2012.07.18 21:13:29 | 000,002,062 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2012.07.18 21:06:27 | 000,292,872 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.07.18 20:37:58 | 004,503,728 | ---- | M] () -- C:\ProgramData\pmt_0piot.pad
[2012.07.18 20:32:28 | 000,000,034 | ---- | M] () -- C:\Users\Ich Selbst\AppData\Roaming\blckdom.res
[2012.07.17 20:14:49 | 000,477,705 | ---- | M] () -- C:\Users\Ich Selbst\Desktop\7953296.jpg
[2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.06.24 22:31:50 | 000,001,088 | ---- | M] () -- C:\Users\Ich Selbst\Desktop\Easy TM Forever.lnk
[1 C:\Users\Ich Selbst\AppData\Roaming\*.tmp files -> C:\Users\Ich Selbst\AppData\Roaming\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.07.23 15:48:02 | 004,503,728 | ---- | C] () -- C:\ProgramData\piz_0ef.pad
[2012.07.21 15:52:43 | 000,000,218 | ---- | C] () -- C:\Users\Ich Selbst\.recently-used.xbel
[2012.07.21 15:38:03 | 000,001,354 | ---- | C] () -- C:\Users\Ich Selbst\Desktop\20120721-113585319-umsatz.csv
[2012.07.18 22:41:52 | 000,001,105 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.07.18 21:13:29 | 000,002,062 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2012.07.18 20:25:23 | 004,503,728 | ---- | C] () -- C:\ProgramData\pmt_0piot.pad
[2012.07.17 21:34:33 | 000,000,034 | ---- | C] () -- C:\Users\Ich Selbst\AppData\Roaming\blckdom.res
[2012.07.17 20:14:43 | 000,477,705 | ---- | C] () -- C:\Users\Ich Selbst\Desktop\7953296.jpg
[2012.06.24 22:31:50 | 000,001,088 | ---- | C] () -- C:\Users\Ich Selbst\Desktop\Easy TM Forever.lnk
[2012.02.29 15:06:28 | 000,338,432 | ---- | C] () -- C:\Windows\SysWow64\sqlite36_engine.dll
[2012.02.29 15:03:35 | 000,000,218 | ---- | C] () -- C:\Users\Ich Selbst\AppData\Local\recently-used.xbel
[2012.02.09 21:05:44 | 000,416,064 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2011.12.22 14:08:47 | 000,003,584 | ---- | C] () -- C:\Users\Ich Selbst\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.10.08 23:14:37 | 000,281,152 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011.10.08 23:14:34 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2011.09.16 11:54:48 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2011.09.16 11:54:44 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2011.09.16 11:54:44 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2011.09.16 11:54:44 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2011.09.16 11:54:44 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2011.09.03 23:55:43 | 001,526,976 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.09.03 21:28:11 | 000,166,912 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2011.09.03 21:28:11 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
 
========== LOP Check ==========
 
[2012.07.18 20:49:58 | 000,000,000 | ---D | M] -- C:\Users\Ich Selbst\AppData\Roaming\13001.026
[2012.07.18 20:49:58 | 000,000,000 | ---D | M] -- C:\Users\Ich Selbst\AppData\Roaming\13001.027
[2012.07.21 16:16:57 | 000,000,000 | ---D | M] -- C:\Users\Ich Selbst\AppData\Roaming\ALFBanCo4
[2012.03.27 13:16:52 | 000,000,000 | ---D | M] -- C:\Users\Ich Selbst\AppData\Roaming\com.Rhapsody.Napster5
[2012.05.10 00:11:35 | 000,000,000 | ---D | M] -- C:\Users\Ich Selbst\AppData\Roaming\freac
[2011.11.05 11:40:31 | 000,000,000 | ---D | M] -- C:\Users\Ich Selbst\AppData\Roaming\Garmin
[2012.07.21 15:52:43 | 000,000,000 | ---D | M] -- C:\Users\Ich Selbst\AppData\Roaming\Grisbi
[2012.07.21 15:52:21 | 000,000,000 | ---D | M] -- C:\Users\Ich Selbst\AppData\Roaming\gtk-2.0
[2012.07.17 21:34:17 | 000,000,000 | ---D | M] -- C:\Users\Ich Selbst\AppData\Roaming\kock
[2012.05.10 00:04:12 | 000,000,000 | ---D | M] -- C:\Users\Ich Selbst\AppData\Roaming\MusicBrainz
[2011.09.25 16:12:43 | 000,000,000 | ---D | M] -- C:\Users\Ich Selbst\AppData\Roaming\OpenOffice.org
[2011.10.17 20:44:24 | 000,000,000 | ---D | M] -- C:\Users\Ich Selbst\AppData\Roaming\Samsung
[2012.03.02 12:05:17 | 000,000,000 | ---D | M] -- C:\Users\Ich Selbst\AppData\Roaming\Temp
[2011.09.03 21:49:22 | 000,000,000 | ---D | M] -- C:\Users\Ich Selbst\AppData\Roaming\Thunderbird
[2012.02.20 16:37:26 | 000,000,000 | ---D | M] -- C:\Users\Ich Selbst\AppData\Roaming\Tunebite
[2012.07.18 20:25:25 | 000,000,000 | ---D | M] -- C:\Users\Ich Selbst\AppData\Roaming\UAs
[2011.12.22 14:09:29 | 000,000,000 | ---D | M] -- C:\Users\Ich Selbst\AppData\Roaming\videotogif
[2012.07.18 20:25:52 | 000,000,000 | ---D | M] -- C:\Users\Ich Selbst\AppData\Roaming\xmldm
[2012.05.20 10:21:18 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >
Ich hoffe ihr könnt damit was anfangen. Im vorraus schonmal Danke für eure bemühungen.

Alt 23.07.2012, 18:34   #2
t'john
/// Helfer-Team
 
GVU Trojaner Win7 64bit - Standard

GVU Trojaner Win7 64bit




Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

  • Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
  • Starte die OTL.exe.
    Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
  • Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:


Code:
ATTFilter
:OTL
MOD - [2012.03.03 14:20:55 | 000,115,137 | ---- | M] () -- C:\Users\Ich Selbst\AppData\Local\Temp\85e80529-e4f2-4f39-a0f4-8e660bf7f00d\CliSecureRT.dll 
MOD - [2009.07.10 09:07:18 | 000,166,912 | ---- | M] () -- C:\Windows\SysWOW64\APOMngr.DLL 
MOD - [2009.02.06 18:52:24 | 000,073,728 | ---- | M] () -- C:\Windows\SysWOW64\CmdRtr.DLL 
SRV - [2012.07.20 16:28:00 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 
IE - HKLM\..\URLSearchHook: {7e111a5c-3d11-4f56-9463-5310c3c69025} - C:\Program Files (x86)\Freeware.de\prxtbFree.dll (Conduit Ltd.) 
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b} 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2736476 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT2736476 
IE - HKCU\..\URLSearchHook: {7e111a5c-3d11-4f56-9463-5310c3c69025} - C:\Program Files (x86)\Freeware.de\prxtbFree.dll (Conduit Ltd.) 
IE - HKCU\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b} 
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC 
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2736476 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
FF - prefs.js..browser.startup.homepage: "http://www.shortnews.de/" 
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.9 
FF - prefs.js..extensions.enabledItems: {e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.2.5 
FF - prefs.js..extensions.enabledItems: {FFB96CC1-7EB3-449D-B827-DB661701C6BB}:1.5.265.2 
FF - prefs.js..extensions.enabledItems: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}:3.6.0.10 
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 
FF - prefs.js..extensions.enabledItems: quickstores@quickstores.de:1.2.0 
FF - prefs.js..extensions.enabledItems: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E}:3.0.1 
FF - prefs.js..extensions.enabledItems: foxyproxy@eric.h.jung:3.1.2 
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 
FF - prefs.js..extensions.enabledItems: battlefieldplay4free@ea.com:1.0.53.2 
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26 
FF - prefs.js..network.proxy.backup.ftp: "24.159.189.101" 
FF - prefs.js..network.proxy.backup.ftp_port: 36081 
FF - prefs.js..network.proxy.backup.socks: "24.159.189.101" 
FF - prefs.js..network.proxy.backup.socks_port: 36081 
FF - prefs.js..network.proxy.backup.ssl: "24.159.189.101" 
FF - prefs.js..network.proxy.backup.ssl_port: 36081 
FF - prefs.js..network.proxy.ftp: "24.159.189.101" 
FF - prefs.js..network.proxy.ftp_port: 36081 
FF - prefs.js..network.proxy.http: "24.159.189.101" 
FF - prefs.js..network.proxy.http_port: 36081 
FF - prefs.js..network.proxy.share_proxy_settings: true 
FF - prefs.js..network.proxy.socks: "24.159.189.101" 
FF - prefs.js..network.proxy.socks_port: 36081 
FF - prefs.js..network.proxy.ssl: "24.159.189.101" 
FF - prefs.js..network.proxy.ssl_port: 36081 
FF - prefs.js..network.proxy.type: 0 
FF - user.js - File not found 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_265.dll File not found 
O2 - BHO: (Freeware.de Toolbar) - {7e111a5c-3d11-4f56-9463-5310c3c69025} - C:\Program Files (x86)\Freeware.de\prxtbFree.dll (Conduit Ltd.) 
O3 - HKLM\..\Toolbar: (Freeware.de Toolbar) - {7e111a5c-3d11-4f56-9463-5310c3c69025} - C:\Program Files (x86)\Freeware.de\prxtbFree.dll (Conduit Ltd.) 
O3 - HKCU\..\Toolbar\WebBrowser: (Freeware.de Toolbar) - {7E111A5C-3D11-4F56-9463-5310C3C69025} - C:\Program Files (x86)\Freeware.de\prxtbFree.dll (Conduit Ltd.) 
O4 - HKLM..\Run: [NapsterShell] C:\Program Files (x86)\Napster\napster.exe /systray File not found 
O4 - HKCU..\Run: [Tunebite] C:\Program Files (x86)\RapidSolution\Tunebite\Tunebite.exe -tray File not found 
O4 - Startup: C:\Users\Ich Selbst\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O32 - HKLM CDRom: AutoRun - 1 
O33 - MountPoints2\{f76ef869-d660-11e0-ba73-806e6f6e6963}\Shell - "" = AutoRun 
O33 - MountPoints2\{f76ef869-d660-11e0-ba73-806e6f6e6963}\Shell\AutoRun\command - "" = H:\CdAutoRun.exe -- [2006.10.30 17:54:10 | 000,049,152 | R--- | M] () 
[2012.07.23 18:10:58 | 004,503,728 | ---- | M] () -- C:\ProgramData\piz_0ef.pad 
[2012.07.18 20:37:58 | 004,503,728 | ---- | M] () -- C:\ProgramData\pmt_0piot.pad 
[2012.07.23 15:48:02 | 004,503,728 | ---- | C] () -- C:\ProgramData\piz_0ef.pad 
[2012.07.18 20:25:23 | 004,503,728 | ---- | C] () -- C:\ProgramData\pmt_0piot.pad 

[2012.07.18 20:25:25 | 000,000,000 | ---D | C] -- C:\Users\Ich Selbst\AppData\Roaming\UAs 
[2012.07.18 20:25:23 | 004,503,728 | ---- | C] () -- C:\ProgramData\pmt_0piot.pad 
[2012.07.18 20:25:25 | 000,000,000 | ---D | M] -- C:\Users\Ich Selbst\AppData\Roaming\UAs 
[2012.07.18 20:25:52 | 000,000,000 | ---D | M] -- C:\Users\Ich Selbst\AppData\Roaming\xmldm 
[2012.07.17 21:34:42 | 000,000,000 | ---D | C] -- C:\Users\Ich Selbst\AppData\Roaming\13001.026 
[2012.07.17 21:34:22 | 000,000,000 | ---D | C] -- C:\Users\Ich Selbst\AppData\Roaming\xmldm 
[2012.07.17 21:34:17 | 000,000,000 | ---D | C] -- C:\Users\Ich Selbst\AppData\Roaming\kock 

[2012.07.23 15:50:02 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job 
 
[2011.09.03 21:28:11 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL 
:Files

ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]
  • Schließe alle Programme.
  • Klicke auf den Fix Button.
  • Wenn OTL einen Neustart verlangt, bitte zulassen.
  • Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
    Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!
__________________

__________________
Alt 23.07.2012, 18:52   #3
gutschge
 
GVU Trojaner Win7 64bit - Standard

GVU Trojaner Win7 64bit


Danke für die schnelle Antwort.

Hier das Fix Log:

Code:
ATTFilter
All processes killed
========== OTL ==========
Releasing module C:\Windows\SysWOW64\APOMngr.DLL
C:\Windows\SysWOW64\APOMngr.DLL moved successfully.
Releasing module C:\Windows\SysWOW64\CmdRtr.DLL
C:\Windows\SysWOW64\CmdRtr.DLL moved successfully.
Service MozillaMaintenance stopped successfully!
Service MozillaMaintenance deleted successfully!
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe moved successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{7e111a5c-3d11-4f56-9463-5310c3c69025} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7e111a5c-3d11-4f56-9463-5310c3c69025}\ deleted successfully.
C:\Program Files (x86)\Freeware.de\prxtbFree.dll moved successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{7e111a5c-3d11-4f56-9463-5310c3c69025} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7e111a5c-3d11-4f56-9463-5310c3c69025}\ not found.
File C:\Program Files (x86)\Freeware.de\prxtbFree.dll not found.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
Prefs.js: "hxxp://www.shortnews.de/" removed from browser.startup.homepage
Prefs.js: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.9 removed from extensions.enabledItems
Prefs.js: {e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.2.5 removed from extensions.enabledItems
Prefs.js: {FFB96CC1-7EB3-449D-B827-DB661701C6BB}:1.5.265.2 removed from extensions.enabledItems
Prefs.js: {fc2b76fc-2132-4d80-a9a3-1f5c6e49066b}:3.6.0.10 removed from extensions.enabledItems
Prefs.js: jqs@sun.com:1.0 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 removed from extensions.enabledItems
Prefs.js: quickstores@quickstores.de:1.2.0 removed from extensions.enabledItems
Prefs.js: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E}:3.0.1 removed from extensions.enabledItems
Prefs.js: foxyproxy@eric.h.jung:3.1.2 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 removed from extensions.enabledItems
Prefs.js: battlefieldplay4free@ea.com:1.0.53.2 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26 removed from extensions.enabledItems
Prefs.js: "24.159.189.101" removed from network.proxy.backup.ftp
Prefs.js: 36081 removed from network.proxy.backup.ftp_port
Prefs.js: "24.159.189.101" removed from network.proxy.backup.socks
Prefs.js: 36081 removed from network.proxy.backup.socks_port
Prefs.js: "24.159.189.101" removed from network.proxy.backup.ssl
Prefs.js: 36081 removed from network.proxy.backup.ssl_port
Prefs.js: "24.159.189.101" removed from network.proxy.ftp
Prefs.js: 36081 removed from network.proxy.ftp_port
Prefs.js: "24.159.189.101" removed from network.proxy.http
Prefs.js: 36081 removed from network.proxy.http_port
Prefs.js: true removed from network.proxy.share_proxy_settings
Prefs.js: "24.159.189.101" removed from network.proxy.socks
Prefs.js: 36081 removed from network.proxy.socks_port
Prefs.js: "24.159.189.101" removed from network.proxy.ssl
Prefs.js: 36081 removed from network.proxy.ssl_port
Prefs.js: 0 removed from network.proxy.type
64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@adobe.com/FlashPlayer\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7e111a5c-3d11-4f56-9463-5310c3c69025}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7e111a5c-3d11-4f56-9463-5310c3c69025}\ not found.
File C:\Program Files (x86)\Freeware.de\prxtbFree.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{7e111a5c-3d11-4f56-9463-5310c3c69025} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7e111a5c-3d11-4f56-9463-5310c3c69025}\ not found.
File C:\Program Files (x86)\Freeware.de\prxtbFree.dll not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7E111A5C-3D11-4F56-9463-5310C3C69025} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7E111A5C-3D11-4F56-9463-5310C3C69025}\ not found.
File C:\Program Files (x86)\Freeware.de\prxtbFree.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\NapsterShell deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Tunebite deleted successfully.
C:\Users\Ich Selbst\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk moved successfully.
C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f76ef869-d660-11e0-ba73-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f76ef869-d660-11e0-ba73-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f76ef869-d660-11e0-ba73-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f76ef869-d660-11e0-ba73-806e6f6e6963}\ not found.
File move failed. H:\CdAutoRun.exe scheduled to be moved on reboot.
C:\ProgramData\piz_0ef.pad moved successfully.
C:\ProgramData\pmt_0piot.pad moved successfully.
File C:\ProgramData\piz_0ef.pad not found.
File C:\ProgramData\pmt_0piot.pad not found.
C:\Users\Ich Selbst\AppData\Roaming\UAs folder moved successfully.
File C:\ProgramData\pmt_0piot.pad not found.
Folder C:\Users\Ich Selbst\AppData\Roaming\UAs\ not found.
C:\Users\Ich Selbst\AppData\Roaming\xmldm folder moved successfully.
C:\Users\Ich Selbst\AppData\Roaming\13001.026\components folder moved successfully.
C:\Users\Ich Selbst\AppData\Roaming\13001.026 folder moved successfully.
Folder C:\Users\Ich Selbst\AppData\Roaming\xmldm\ not found.
C:\Users\Ich Selbst\AppData\Roaming\kock folder moved successfully.
C:\Windows\Tasks\Adobe Flash Player Updater.job moved successfully.
File C:\Windows\SysWow64\CmdRtr.DLL not found.
========== FILES ==========
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\Ich Selbst\Desktop\cmd.bat deleted successfully.
C:\Users\Ich Selbst\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56478 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Ich Selbst
->Temp folder emptied: 260410615 bytes
->Temporary Internet Files folder emptied: 43674724 bytes
->Java cache emptied: 7915359 bytes
->FireFox cache emptied: 780665084 bytes
->Flash cache emptied: 73520 bytes
 
User: Public
 
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 334189092 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes
RecycleBin emptied: 17370908 bytes
 
Total Files Cleaned = 1.377,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
->Flash cache emptied: 0 bytes
 
User: Default User
->Flash cache emptied: 0 bytes
 
User: Ich Selbst
->Flash cache emptied: 0 bytes
 
User: Public
 
User: UpdatusUser
 
Total Flash Files Cleaned = 0,00 mb
 
 
OTL by OldTimer - Version 3.2.54.0 log created on 07232012_193914

Files\Folders moved on Reboot...
File move failed. H:\CdAutoRun.exe scheduled to be moved on reboot.
C:\Users\Ich Selbst\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...
[2006.10.30 17:54:10 | 000,049,152 | R--- | M] () H:\CdAutoRun.exe : MD5=47071EF25262E05884B8869E0E5D85D5
File C:\Users\Ich Selbst\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!

Registry entries deleted on Reboot...
__________________
Alt 23.07.2012, 21:37   #4
t'john
/// Helfer-Team
 
GVU Trojaner Win7 64bit - Standard

GVU Trojaner Win7 64bit


Sehr gut!

Wie laeuft der Rechner?

1. Schritt
Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".
danach:

2. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Search.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.
__________________
Mfg, t'john
Das TB unterstützen

Alt 24.07.2012, 13:52   #5
gutschge
 
GVU Trojaner Win7 64bit - Standard

GVU Trojaner Win7 64bit


Hallo,

der Rechner läuft bis jetzt ohne Probleme.

Hier das Log vom Malwarebytes Vollscan

Code:
ATTFilter
Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.24.02

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
Ich Selbst :: ICHSELBST-PC [Administrator]

24.07.2012 07:20:03
mbam-log-2012-07-24 (07-20-03).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 385777
Laufzeit: 1 Stunde(n), 6 Minute(n), 44 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Und das Log vom AdwCleaner

Code:
ATTFilter
# AdwCleaner v1.703 - Logfile created 07/24/2012 at 14:44:58
# Updated 20/07/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Ich Selbst - ICHSELBST-PC
# Running from : C:\Users\Ich Selbst\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

Folder Found : C:\Users\Ich Selbst\AppData\Local\Conduit
Folder Found : C:\Users\Ich Selbst\AppData\LocalLow\Conduit
Folder Found : C:\Users\Ich Selbst\AppData\LocalLow\Freeware.de
Folder Found : C:\Users\Ich Selbst\AppData\Roaming\Mozilla\Firefox\Profiles\ad9lm4uu.default\Conduit
Folder Found : C:\Users\Ich Selbst\AppData\Roaming\Mozilla\Firefox\Profiles\ad9lm4uu.default\ConduitCommon
Folder Found : C:\Program Files (x86)\Conduit
Folder Found : C:\Program Files (x86)\Freeware.de
File Found : C:\Users\Ich Selbst\AppData\Roaming\Mozilla\Firefox\Profiles\ad9lm4uu.default\searchplugins\Conduit.xml

***** [Registry] *****
[*] Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2736476
Key Found : HKCU\Software\AppDataLow\Software\Conduit
Key Found : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Found : HKCU\Software\AppDataLow\Toolbar
Key Found : HKLM\SOFTWARE\Conduit
Key Found : HKLM\SOFTWARE\Freeware.de
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Freeware.de Toolbar
[x64] Key Found : HKCU\Software\AppDataLow\Software\Conduit
[x64] Key Found : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
[x64] Key Found : HKCU\Software\AppDataLow\Toolbar

***** [Registre - GUID] *****

Key Found : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{50BA0FF5-8CF4-4A36-8DF0-BDA26616252F}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Key Found : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{50BA0FF5-8CF4-4A36-8DF0-BDA26616252F}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{7E111A5C-3D11-4F56-9463-5310C3C69025}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7E111A5C-3D11-4F56-9463-5310C3C69025}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{7E111A5C-3D11-4F56-9463-5310C3C69025}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7E111A5C-3D11-4F56-9463-5310C3C69025}

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.7601.17514

[OK] Registry is clean.

-\\ Mozilla Firefox v14.0.1 (de)

Profile name : default 
File : C:\Users\Ich Selbst\AppData\Roaming\Mozilla\Firefox\Profiles\ad9lm4uu.default\prefs.js

Found : user_pref("CT2613550..clientLogIsEnabled", false);
Found : user_pref("CT2613550..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]
Found : user_pref("CT2613550..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]
Found : user_pref("CT2613550.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);
Found : user_pref("CT2613550.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Found : user_pref("CT2613550.CTID", "ct2613550");
Found : user_pref("CT2613550.CurrentServerDate", "22-4-2012");
Found : user_pref("CT2613550.DialogsAlignMode", "LTR");
Found : user_pref("CT2613550.DialogsGetterLastCheckTime", "Sat Apr 21 2012 13:12:10 GMT+0200");
Found : user_pref("CT2613550.DownloadReferralCookieData", "");
Found : user_pref("CT2613550.EMailNotifierPollDate", "Tue Oct 05 2010 17:01:14 GMT+0200");
Found : user_pref("CT2613550.FeedPollDate129254982599602533", "Tue Oct 05 2010 16:42:48 GMT+0200");
Found : user_pref("CT2613550.FeedPollDate129254982599602539", "Tue Oct 05 2010 16:42:48 GMT+0200");
Found : user_pref("CT2613550.FeedPollDate129254982599602545", "Tue Oct 05 2010 16:42:48 GMT+0200");
Found : user_pref("CT2613550.FeedPollDate129254982599602551", "Tue Oct 05 2010 16:42:48 GMT+0200");
Found : user_pref("CT2613550.FeedPollDate129254982599602557", "Tue Oct 05 2010 16:42:48 GMT+0200");
Found : user_pref("CT2613550.FeedPollDate129254982599602563", "Tue Oct 05 2010 16:42:48 GMT+0200");
Found : user_pref("CT2613550.FeedPollDate129254982599602569", "Tue Oct 05 2010 16:42:48 GMT+0200");
Found : user_pref("CT2613550.FeedPollDate129254982599602575", "Tue Oct 05 2010 16:42:48 GMT+0200");
Found : user_pref("CT2613550.FeedPollDate129254982599602581", "Tue Oct 05 2010 16:42:48 GMT+0200");
Found : user_pref("CT2613550.FeedPollDate129254982599602587", "Tue Oct 05 2010 16:42:48 GMT+0200");
Found : user_pref("CT2613550.FeedPollDate129254982599602593", "Tue Oct 05 2010 16:42:48 GMT+0200");
Found : user_pref("CT2613550.FeedPollDate129254982599602599", "Tue Oct 05 2010 16:42:48 GMT+0200");
Found : user_pref("CT2613550.FeedPollDate129254982599602605", "Tue Oct 05 2010 16:42:48 GMT+0200");
Found : user_pref("CT2613550.FeedPollDate129254982599602611", "Tue Oct 05 2010 16:42:48 GMT+0200");
Found : user_pref("CT2613550.FeedPollDate129254982599602617", "Tue Oct 05 2010 16:42:48 GMT+0200");
Found : user_pref("CT2613550.FeedPollDate129254982599602623", "Tue Oct 05 2010 16:42:48 GMT+0200");
Found : user_pref("CT2613550.FeedPollDate129254982599602629", "Tue Oct 05 2010 16:42:48 GMT+0200");
Found : user_pref("CT2613550.FeedTTL129254982599602545", 5);
Found : user_pref("CT2613550.FeedTTL129254982599602551", 5);
Found : user_pref("CT2613550.FeedTTL129254982599602575", 2);
Found : user_pref("CT2613550.FeedTTL129254982599602605", 5);
Found : user_pref("CT2613550.FeedTTL129254982599602617", 30);
Found : user_pref("CT2613550.FirstServerDate", "5-10-2010");
Found : user_pref("CT2613550.FirstTime", true);
Found : user_pref("CT2613550.FirstTimeFF3", true);
Found : user_pref("CT2613550.FirstTimeSettingsDone", true);
Found : user_pref("CT2613550.FixPageNotFoundErrors", true);
Found : user_pref("CT2613550.GroupingServerCheckInterval", 1440);
Found : user_pref("CT2613550.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Found : user_pref("CT2613550.HasUserGlobalKeys", true);
Found : user_pref("CT2613550.Initialize", true);
Found : user_pref("CT2613550.InitializeCommonPrefs", true);
Found : user_pref("CT2613550.InstallationAndCookieDataSentCount", 3);
Found : user_pref("CT2613550.InstallationType", "UnknownIntegration");
Found : user_pref("CT2613550.InstalledDate", "Tue Oct 05 2010 16:42:33 GMT+0200");
Found : user_pref("CT2613550.IsGrouping", false);
Found : user_pref("CT2613550.IsMulticommunity", false);
Found : user_pref("CT2613550.IsOpenThankYouPage", false);
Found : user_pref("CT2613550.IsOpenUninstallPage", true);
Found : user_pref("CT2613550.LanguagePackLastCheckTime", "Tue Oct 05 2010 16:42:33 GMT+0200");
Found : user_pref("CT2613550.LanguagePackReloadIntervalMM", 1440);
Found : user_pref("CT2613550.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Found : user_pref("CT2613550.LastLogin_2.7.1.3", "Tue Oct 05 2010 16:42:49 GMT+0200");
Found : user_pref("CT2613550.LastLogin_3.12.0.7", "Sun Apr 22 2012 15:53:57 GMT+0200");
Found : user_pref("CT2613550.LatestVersion", "3.12.0.7");
Found : user_pref("CT2613550.Locale", "de-de");
Found : user_pref("CT2613550.LoginCache", 4);
Found : user_pref("CT2613550.MCDetectTooltipHeight", "83");
Found : user_pref("CT2613550.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Found : user_pref("CT2613550.MCDetectTooltipWidth", "295");
Found : user_pref("CT2613550.MyStuffEnabledAtInstallation", true);
Found : user_pref("CT2613550.SHRINK_TOOLBAR", 1);
Found : user_pref("CT2613550.SearchEngine", "Suchen||hxxp://search.conduit.com/Results.aspx?q=UCM_SEARCH_TER[...]
Found : user_pref("CT2613550.SearchFromAddressBarIsInit", true);
Found : user_pref("CT2613550.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT261[...]
Found : user_pref("CT2613550.SearchInNewTabEnabled", true);
Found : user_pref("CT2613550.SearchInNewTabIntervalMM", 1440);
Found : user_pref("CT2613550.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Found : user_pref("CT2613550.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageServic[...]
Found : user_pref("CT2613550.ServiceMapLastCheckTime", "Sun Apr 22 2012 18:19:44 GMT+0200");
Found : user_pref("CT2613550.SettingsCheckIntervalMin", 120);
Found : user_pref("CT2613550.SettingsLastCheckTime", "Tue Oct 05 2010 16:36:51 GMT+0200");
Found : user_pref("CT2613550.SettingsLastUpdate", "1285580322");
Found : user_pref("CT2613550.ThirdPartyComponentsInterval", 504);
Found : user_pref("CT2613550.ThirdPartyComponentsLastCheck", "Tue Oct 05 2010 16:36:51 GMT+0200");
Found : user_pref("CT2613550.ThirdPartyComponentsLastUpdate", "1255348257");
Found : user_pref("CT2613550.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2613550");
Found : user_pref("CT2613550.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...]
Found : user_pref("CT2613550.Uninstall", true);
Found : user_pref("CT2613550.UserID", "UN17349322164049985");
Found : user_pref("CT2613550.ValidationData_Toolbar", 2);
Found : user_pref("CT2613550.alertChannelId", "1006347");
Found : user_pref("CT2613550.clientLogIsEnabled", false);
Found : user_pref("CT2613550.clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asm[...]
Found : user_pref("CT2613550.components.1000082", false);
Found : user_pref("CT2613550.components.1000234", false);
Found : user_pref("CT2613550.ct2613550.DialogsAlignMode", "LTR");
Found : user_pref("CT2613550.ct2613550.FeedLastCount3082739963941193807", 353);
Found : user_pref("CT2613550.ct2613550.FirstTimeSettingsDone", true);
Found : user_pref("CT2613550.ct2613550.LanguagePackLastCheckTime", "Sun Apr 22 2012 15:53:56 GMT+0200");
Found : user_pref("CT2613550.ct2613550.Locale", "de-de");
Found : user_pref("CT2613550.ct2613550.SearchEngine", "Suchen||hxxp://search.conduit.com/Results.aspx?q=UCM_[...]
Found : user_pref("CT2613550.ct2613550.SearchInNewTabLastCheckTime", "Sun Apr 22 2012 15:53:56 GMT+0200");
Found : user_pref("CT2613550.ct2613550.SettingsCheckIntervalMin", 120);
Found : user_pref("CT2613550.ct2613550.SettingsLastCheckTime", "Sun Apr 22 2012 15:53:56 GMT+0200");
Found : user_pref("CT2613550.ct2613550.SettingsLastUpdate", "1334650619");
Found : user_pref("CT2613550.ct2613550.ThirdPartyComponentsLastCheck", "Tue Oct 05 2010 16:42:48 GMT+0200");
Found : user_pref("CT2613550.ct2613550.ThirdPartyComponentsLastUpdate", "1255348257");
Found : user_pref("CT2613550.ct2613550.toolbarAppMetaDataLastCheckTime", "Sun Apr 22 2012 15:53:56 GMT+0200"[...]
Found : user_pref("CT2613550.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...]
Found : user_pref("CT2613550.homepageProtectorEnableByLogin", true);
Found : user_pref("CT2613550.initDone", true);
Found : user_pref("CT2613550.myStuffEnabled", true);
Found : user_pref("CT2613550.myStuffPublihserMinWidth", 400);
Found : user_pref("CT2613550.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Found : user_pref("CT2613550.myStuffServiceIntervalMM", 1440);
Found : user_pref("CT2613550.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Found : user_pref("CT2613550.revertSettingsEnabled", true);
Found : user_pref("CT2613550.searchProtectorDialogDelayInSec", 10);
Found : user_pref("CT2613550.searchProtectorEnableByLogin", true);
Found : user_pref("CT2613550.testingCtid", "");
Found : user_pref("CT2613550.uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Reg[...]
Found : user_pref("CT2613550.usagesFlag", 2);
Found : user_pref("CT2736476..clientLogIsEnabled", false);
Found : user_pref("CT2736476..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]
Found : user_pref("CT2736476..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]
Found : user_pref("CT2736476.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);
Found : user_pref("CT2736476.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Found : user_pref("CT2736476.CTID", "CT2736476");
Found : user_pref("CT2736476.CurrentServerDate", "21-4-2012");
Found : user_pref("CT2736476.DSInstall", true);
Found : user_pref("CT2736476.DialogsAlignMode", "LTR");
Found : user_pref("CT2736476.DialogsGetterLastCheckTime", "Sat Apr 21 2012 14:36:54 GMT+0200");
Found : user_pref("CT2736476.DownloadReferralCookieData", "");
Found : user_pref("CT2736476.FeedLastCount129257621460541612", 20);
Found : user_pref("CT2736476.FeedLastCount129257621968979554", 20);
Found : user_pref("CT2736476.FeedLastCount129258323135539557", 20);
Found : user_pref("CT2736476.FeedPollDate129257621460541612", "Sat Apr 21 2012 14:36:56 GMT+0200");
Found : user_pref("CT2736476.FeedPollDate129257621968979554", "Sat Apr 21 2012 14:36:56 GMT+0200");
Found : user_pref("CT2736476.FeedPollDate129258323135539557", "Sat Apr 21 2012 14:36:56 GMT+0200");
Found : user_pref("CT2736476.FirstServerDate", "29-2-2012");
Found : user_pref("CT2736476.FirstTime", true);
Found : user_pref("CT2736476.FirstTimeFF3", true);
Found : user_pref("CT2736476.FixPageNotFoundErrors", true);
Found : user_pref("CT2736476.GroupingServerCheckInterval", 1440);
Found : user_pref("CT2736476.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Found : user_pref("CT2736476.HPInstall", true);
Found : user_pref("CT2736476.HasUserGlobalKeys", true);
Found : user_pref("CT2736476.HomePageProtectorEnabled", true);
Found : user_pref("CT2736476.HomepageBeforeUnload", "hxxp://search.conduit.com/?ctid=CT2736476&SearchSource=[...]
Found : user_pref("CT2736476.Initialize", true);
Found : user_pref("CT2736476.InitializeCommonPrefs", true);
Found : user_pref("CT2736476.InstallationAndCookieDataSentCount", 3);
Found : user_pref("CT2736476.InstallationId", "ConduitNSISIntegration");
Found : user_pref("CT2736476.InstallationType", "ConduitXPEIntegration");
Found : user_pref("CT2736476.InstalledDate", "Wed Feb 29 2012 14:08:26 GMT+0100");
Found : user_pref("CT2736476.InvalidateCache", false);
Found : user_pref("CT2736476.IsGrouping", false);
Found : user_pref("CT2736476.IsInitSetupIni", true);
Found : user_pref("CT2736476.IsMulticommunity", false);
Found : user_pref("CT2736476.IsOpenThankYouPage", false);
Found : user_pref("CT2736476.IsOpenUninstallPage", true);
Found : user_pref("CT2736476.IsProtectorsInit", true);
Found : user_pref("CT2736476.LanguagePackLastCheckTime", "Sat Apr 21 2012 14:36:54 GMT+0200");
Found : user_pref("CT2736476.LanguagePackReloadIntervalMM", 1440);
Found : user_pref("CT2736476.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Found : user_pref("CT2736476.LastLogin_3.10.0.1", "Sat Apr 21 2012 14:36:54 GMT+0200");
Found : user_pref("CT2736476.LatestVersion", "3.12.0.7");
Found : user_pref("CT2736476.Locale", "de");
Found : user_pref("CT2736476.MCDetectTooltipHeight", "83");
Found : user_pref("CT2736476.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Found : user_pref("CT2736476.MCDetectTooltipWidth", "295");
Found : user_pref("CT2736476.MyStuffEnabledAtInstallation", true);
Found : user_pref("CT2736476.OriginalFirstVersion", "3.10.0.1");
Found : user_pref("CT2736476.RadioIsPodcast", false);
Found : user_pref("CT2736476.RadioLastCheckTime", "Sat Apr 21 2012 14:36:56 GMT+0200");
Found : user_pref("CT2736476.RadioLastUpdateIPServer", "3");
Found : user_pref("CT2736476.RadioLastUpdateServer", "129570411865130000");
Found : user_pref("CT2736476.RadioMediaID", "21930450");
Found : user_pref("CT2736476.RadioMediaType", "Media Player");
Found : user_pref("CT2736476.RadioMenuSelectedID", "EBRadioMenu_CT273647621930450");
Found : user_pref("CT2736476.RadioShrinkedFromSetup", false);
Found : user_pref("CT2736476.RadioStationName", "California%20Rock%20-%20Rock");
Found : user_pref("CT2736476.RadioStationURL", "hxxp://www.feedlive.net/california.asx");
Found : user_pref("CT2736476.SavedHomepage", "hxxp://www.shortnews.de/");
Found : user_pref("CT2736476.SearchCaption", "Freeware.de Customized Web Search");
Found : user_pref("CT2736476.SearchEngineBeforeUnload", "Freeware.de Customized Web Search");
Found : user_pref("CT2736476.SearchFromAddressBarIsInit", true);
Found : user_pref("CT2736476.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT273[...]
Found : user_pref("CT2736476.SearchInNewTabEnabled", true);
Found : user_pref("CT2736476.SearchInNewTabIntervalMM", 1440);
Found : user_pref("CT2736476.SearchInNewTabLastCheckTime", "Sat Apr 21 2012 14:36:53 GMT+0200");
Found : user_pref("CT2736476.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Found : user_pref("CT2736476.SearchProtectorEnabled", true);
Found : user_pref("CT2736476.SearchProtectorToolbarDisabled", false);
Found : user_pref("CT2736476.SendProtectorDataViaLogin", true);
Found : user_pref("CT2736476.ServiceMapLastCheckTime", "Sat Apr 21 2012 14:36:53 GMT+0200");
Found : user_pref("CT2736476.SettingsLastCheckTime", "Sat Apr 21 2012 14:36:53 GMT+0200");
Found : user_pref("CT2736476.SettingsLastUpdate", "1334746574");
Found : user_pref("CT2736476.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT2736476&SearchSource=13");
Found : user_pref("CT2736476.ThirdPartyComponentsInterval", 504);
Found : user_pref("CT2736476.ThirdPartyComponentsLastCheck", "Sat Apr 21 2012 14:36:53 GMT+0200");
Found : user_pref("CT2736476.ThirdPartyComponentsLastUpdate", "1255344657");
Found : user_pref("CT2736476.ToolbarShrinkedFromSetup", false);
Found : user_pref("CT2736476.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2736476");
Found : user_pref("CT2736476.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...]
Found : user_pref("CT2736476.Uninstall", true);
Found : user_pref("CT2736476.UserID", "UN62097962760378375");
Found : user_pref("CT2736476.alertChannelId", "1128724");
Found : user_pref("CT2736476.autoDisableScopes", -1);
Found : user_pref("CT2736476.backendstorage.2736476a129652188678262596000000paramsgk1", "7B22757064617465526[...]
Found : user_pref("CT2736476.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...]
Found : user_pref("CT2736476.globalFirstTimeInfoLastCheckTime", "Sat Apr 21 2012 14:36:54 GMT+0200");
Found : user_pref("CT2736476.homepageProtectorEnableByLogin", true);
Found : user_pref("CT2736476.initDone", true);
Found : user_pref("CT2736476.isAppTrackingManagerOn", true);
Found : user_pref("CT2736476.isFirstRadioInstallation", false);
Found : user_pref("CT2736476.myStuffEnabled", true);
Found : user_pref("CT2736476.myStuffPublihserMinWidth", 400);
Found : user_pref("CT2736476.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Found : user_pref("CT2736476.myStuffServiceIntervalMM", 1440);
Found : user_pref("CT2736476.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Found : user_pref("CT2736476.navigateToUrlOnSearch", false);
Found : user_pref("CT2736476.oldAppsList", "129257551953509225,129257551953665476,111,129257617514448028,129[...]
Found : user_pref("CT2736476.revertSettingsEnabled", true);
Found : user_pref("CT2736476.searchProtectorDialogDelayInSec", 10);
Found : user_pref("CT2736476.searchProtectorEnableByLogin", true);
Found : user_pref("CT2736476.testingCtid", "");
Found : user_pref("CT2736476.toolbarAppMetaDataLastCheckTime", "Sat Apr 21 2012 14:36:54 GMT+0200");
Found : user_pref("CT2736476.toolbarContextMenuLastCheckTime", "Sat Apr 21 2012 14:36:54 GMT+0200");
Found : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/ct2613550/CT2613550[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1128724/1124413/DE", "\"0\"[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2736476", [...]
Found : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=ct2613550", [...]
Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.10[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2613550",[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2736476",[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/50/261/CT2613550/Images/6340849712463612[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=de", "\"b5f[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=de-de", "\"[...]
Found : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\Ich Selbst\\AppData\\Roaming\\Mozil[...]
Found : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.10.0.1");
Found : user_pref("CommunityToolbar.ToolbarsList", "CT2613550,CT2736476");
Found : user_pref("CommunityToolbar.ToolbarsList2", "CT2613550,CT2736476");
Found : user_pref("CommunityToolbar.ToolbarsList4", "CT2736476");
Found : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Tue Oct 05 2010 16:42:34 GMT+0200");
Found : user_pref("CommunityToolbar.globalUserId", "4923c7de-7ef2-496b-a83b-0832e080e693");
Found : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);
Found : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);
Found : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2736476");
Found : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Wed Feb 29 2012 14:08:2[...]
Found : user_pref("CommunityToolbar.notifications.alertInfoInterval", 60);
Found : user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Wed Feb 29 2012 14:08:36 GMT+010[...]
Found : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com");
Found : user_pref("CommunityToolbar.notifications.locale", "en");
Found : user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440);
Found : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Wed Feb 29 2012 14:08:26 GMT+0100");
Found : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1313487611");
Found : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20);
Found : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com");
Found : user_pref("CommunityToolbar.notifications.showTrayIcon", false);
Found : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300);
Found : user_pref("CommunityToolbar.notifications.userId", "4519897a-4a73-4c2a-a291-2278bc00a606");
Found : user_pref("CommunityToolbar.originalHomepage", "hxxp://www.shortnews.de/");

*************************

AdwCleaner[R1].txt - [24259 octets] - [24/07/2012 14:44:58]

########## EOF - C:\AdwCleaner[R1].txt - [24388 octets] ##########


Alt 24.07.2012, 23:48   #6
t'john
/// Helfer-Team
 
GVU Trojaner Win7 64bit - Standard

GVU Trojaner Win7 64bit


Sehr gut!


  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Delete.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.




danach:


Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html
__________________
--> GVU Trojaner Win7 64bit

Alt 25.07.2012, 13:48   #7
gutschge
 
GVU Trojaner Win7 64bit - Standard

GVU Trojaner Win7 64bit


Hallo, hier nun der Log von AdwCleaner:

Code:
ATTFilter
# AdwCleaner v1.703 - Logfile created 07/25/2012 at 06:37:27
# Updated 20/07/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Ich Selbst - ICHSELBST-PC
# Running from : C:\Users\Ich Selbst\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Folder Deleted : C:\Users\Ich Selbst\AppData\Local\Conduit
Folder Deleted : C:\Users\Ich Selbst\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\Ich Selbst\AppData\LocalLow\Freeware.de
Folder Deleted : C:\Users\Ich Selbst\AppData\Roaming\Mozilla\Firefox\Profiles\ad9lm4uu.default\Conduit
Folder Deleted : C:\Users\Ich Selbst\AppData\Roaming\Mozilla\Firefox\Profiles\ad9lm4uu.default\ConduitCommon
Folder Deleted : C:\Program Files (x86)\Conduit
Folder Deleted : C:\Program Files (x86)\Freeware.de
File Deleted : C:\Users\Ich Selbst\AppData\Roaming\Mozilla\Firefox\Profiles\ad9lm4uu.default\searchplugins\Conduit.xml

***** [Registry] *****
[*] Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2736476
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Deleted : HKCU\Software\AppDataLow\Toolbar
Key Deleted : HKLM\SOFTWARE\Conduit
Key Deleted : HKLM\SOFTWARE\Freeware.de
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Freeware.de Toolbar

***** [Registre - GUID] *****

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{50BA0FF5-8CF4-4A36-8DF0-BDA26616252F}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{50BA0FF5-8CF4-4A36-8DF0-BDA26616252F}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{7E111A5C-3D11-4F56-9463-5310C3C69025}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7E111A5C-3D11-4F56-9463-5310C3C69025}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.7601.17514

[OK] Registry is clean.

-\\ Mozilla Firefox v14.0.1 (de)

Profile name : default 
File : C:\Users\Ich Selbst\AppData\Roaming\Mozilla\Firefox\Profiles\ad9lm4uu.default\prefs.js

Deleted : user_pref("CT2613550..clientLogIsEnabled", false);
Deleted : user_pref("CT2613550..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]
Deleted : user_pref("CT2613550..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]
Deleted : user_pref("CT2613550.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);
Deleted : user_pref("CT2613550.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Deleted : user_pref("CT2613550.CTID", "ct2613550");
Deleted : user_pref("CT2613550.CurrentServerDate", "22-4-2012");
Deleted : user_pref("CT2613550.DialogsAlignMode", "LTR");
Deleted : user_pref("CT2613550.DialogsGetterLastCheckTime", "Sat Apr 21 2012 13:12:10 GMT+0200");
Deleted : user_pref("CT2613550.DownloadReferralCookieData", "");
Deleted : user_pref("CT2613550.EMailNotifierPollDate", "Tue Oct 05 2010 17:01:14 GMT+0200");
Deleted : user_pref("CT2613550.FeedPollDate129254982599602533", "Tue Oct 05 2010 16:42:48 GMT+0200");
Deleted : user_pref("CT2613550.FeedPollDate129254982599602539", "Tue Oct 05 2010 16:42:48 GMT+0200");
Deleted : user_pref("CT2613550.FeedPollDate129254982599602545", "Tue Oct 05 2010 16:42:48 GMT+0200");
Deleted : user_pref("CT2613550.FeedPollDate129254982599602551", "Tue Oct 05 2010 16:42:48 GMT+0200");
Deleted : user_pref("CT2613550.FeedPollDate129254982599602557", "Tue Oct 05 2010 16:42:48 GMT+0200");
Deleted : user_pref("CT2613550.FeedPollDate129254982599602563", "Tue Oct 05 2010 16:42:48 GMT+0200");
Deleted : user_pref("CT2613550.FeedPollDate129254982599602569", "Tue Oct 05 2010 16:42:48 GMT+0200");
Deleted : user_pref("CT2613550.FeedPollDate129254982599602575", "Tue Oct 05 2010 16:42:48 GMT+0200");
Deleted : user_pref("CT2613550.FeedPollDate129254982599602581", "Tue Oct 05 2010 16:42:48 GMT+0200");
Deleted : user_pref("CT2613550.FeedPollDate129254982599602587", "Tue Oct 05 2010 16:42:48 GMT+0200");
Deleted : user_pref("CT2613550.FeedPollDate129254982599602593", "Tue Oct 05 2010 16:42:48 GMT+0200");
Deleted : user_pref("CT2613550.FeedPollDate129254982599602599", "Tue Oct 05 2010 16:42:48 GMT+0200");
Deleted : user_pref("CT2613550.FeedPollDate129254982599602605", "Tue Oct 05 2010 16:42:48 GMT+0200");
Deleted : user_pref("CT2613550.FeedPollDate129254982599602611", "Tue Oct 05 2010 16:42:48 GMT+0200");
Deleted : user_pref("CT2613550.FeedPollDate129254982599602617", "Tue Oct 05 2010 16:42:48 GMT+0200");
Deleted : user_pref("CT2613550.FeedPollDate129254982599602623", "Tue Oct 05 2010 16:42:48 GMT+0200");
Deleted : user_pref("CT2613550.FeedPollDate129254982599602629", "Tue Oct 05 2010 16:42:48 GMT+0200");
Deleted : user_pref("CT2613550.FeedTTL129254982599602545", 5);
Deleted : user_pref("CT2613550.FeedTTL129254982599602551", 5);
Deleted : user_pref("CT2613550.FeedTTL129254982599602575", 2);
Deleted : user_pref("CT2613550.FeedTTL129254982599602605", 5);
Deleted : user_pref("CT2613550.FeedTTL129254982599602617", 30);
Deleted : user_pref("CT2613550.FirstServerDate", "5-10-2010");
Deleted : user_pref("CT2613550.FirstTime", true);
Deleted : user_pref("CT2613550.FirstTimeFF3", true);
Deleted : user_pref("CT2613550.FirstTimeSettingsDone", true);
Deleted : user_pref("CT2613550.FixPageNotFoundErrors", true);
Deleted : user_pref("CT2613550.GroupingServerCheckInterval", 1440);
Deleted : user_pref("CT2613550.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Deleted : user_pref("CT2613550.HasUserGlobalKeys", true);
Deleted : user_pref("CT2613550.Initialize", true);
Deleted : user_pref("CT2613550.InitializeCommonPrefs", true);
Deleted : user_pref("CT2613550.InstallationAndCookieDataSentCount", 3);
Deleted : user_pref("CT2613550.InstallationType", "UnknownIntegration");
Deleted : user_pref("CT2613550.InstalledDate", "Tue Oct 05 2010 16:42:33 GMT+0200");
Deleted : user_pref("CT2613550.IsGrouping", false);
Deleted : user_pref("CT2613550.IsMulticommunity", false);
Deleted : user_pref("CT2613550.IsOpenThankYouPage", false);
Deleted : user_pref("CT2613550.IsOpenUninstallPage", true);
Deleted : user_pref("CT2613550.LanguagePackLastCheckTime", "Tue Oct 05 2010 16:42:33 GMT+0200");
Deleted : user_pref("CT2613550.LanguagePackReloadIntervalMM", 1440);
Deleted : user_pref("CT2613550.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Deleted : user_pref("CT2613550.LastLogin_2.7.1.3", "Tue Oct 05 2010 16:42:49 GMT+0200");
Deleted : user_pref("CT2613550.LastLogin_3.12.0.7", "Sun Apr 22 2012 15:53:57 GMT+0200");
Deleted : user_pref("CT2613550.LatestVersion", "3.12.0.7");
Deleted : user_pref("CT2613550.Locale", "de-de");
Deleted : user_pref("CT2613550.LoginCache", 4);
Deleted : user_pref("CT2613550.MCDetectTooltipHeight", "83");
Deleted : user_pref("CT2613550.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Deleted : user_pref("CT2613550.MCDetectTooltipWidth", "295");
Deleted : user_pref("CT2613550.MyStuffEnabledAtInstallation", true);
Deleted : user_pref("CT2613550.SHRINK_TOOLBAR", 1);
Deleted : user_pref("CT2613550.SearchEngine", "Suchen||hxxp://search.conduit.com/Results.aspx?q=UCM_SEARCH_TER[...]
Deleted : user_pref("CT2613550.SearchFromAddressBarIsInit", true);
Deleted : user_pref("CT2613550.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT261[...]
Deleted : user_pref("CT2613550.SearchInNewTabEnabled", true);
Deleted : user_pref("CT2613550.SearchInNewTabIntervalMM", 1440);
Deleted : user_pref("CT2613550.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Deleted : user_pref("CT2613550.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageServic[...]
Deleted : user_pref("CT2613550.ServiceMapLastCheckTime", "Sun Apr 22 2012 18:19:44 GMT+0200");
Deleted : user_pref("CT2613550.SettingsCheckIntervalMin", 120);
Deleted : user_pref("CT2613550.SettingsLastCheckTime", "Tue Oct 05 2010 16:36:51 GMT+0200");
Deleted : user_pref("CT2613550.SettingsLastUpdate", "1285580322");
Deleted : user_pref("CT2613550.ThirdPartyComponentsInterval", 504);
Deleted : user_pref("CT2613550.ThirdPartyComponentsLastCheck", "Tue Oct 05 2010 16:36:51 GMT+0200");
Deleted : user_pref("CT2613550.ThirdPartyComponentsLastUpdate", "1255348257");
Deleted : user_pref("CT2613550.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2613550");
Deleted : user_pref("CT2613550.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...]
Deleted : user_pref("CT2613550.Uninstall", true);
Deleted : user_pref("CT2613550.UserID", "UN17349322164049985");
Deleted : user_pref("CT2613550.ValidationData_Toolbar", 2);
Deleted : user_pref("CT2613550.alertChannelId", "1006347");
Deleted : user_pref("CT2613550.clientLogIsEnabled", false);
Deleted : user_pref("CT2613550.clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asm[...]
Deleted : user_pref("CT2613550.components.1000082", false);
Deleted : user_pref("CT2613550.components.1000234", false);
Deleted : user_pref("CT2613550.ct2613550.DialogsAlignMode", "LTR");
Deleted : user_pref("CT2613550.ct2613550.FeedLastCount3082739963941193807", 353);
Deleted : user_pref("CT2613550.ct2613550.FirstTimeSettingsDone", true);
Deleted : user_pref("CT2613550.ct2613550.LanguagePackLastCheckTime", "Sun Apr 22 2012 15:53:56 GMT+0200");
Deleted : user_pref("CT2613550.ct2613550.Locale", "de-de");
Deleted : user_pref("CT2613550.ct2613550.SearchEngine", "Suchen||hxxp://search.conduit.com/Results.aspx?q=UCM_[...]
Deleted : user_pref("CT2613550.ct2613550.SearchInNewTabLastCheckTime", "Sun Apr 22 2012 15:53:56 GMT+0200");
Deleted : user_pref("CT2613550.ct2613550.SettingsCheckIntervalMin", 120);
Deleted : user_pref("CT2613550.ct2613550.SettingsLastCheckTime", "Sun Apr 22 2012 15:53:56 GMT+0200");
Deleted : user_pref("CT2613550.ct2613550.SettingsLastUpdate", "1334650619");
Deleted : user_pref("CT2613550.ct2613550.ThirdPartyComponentsLastCheck", "Tue Oct 05 2010 16:42:48 GMT+0200");
Deleted : user_pref("CT2613550.ct2613550.ThirdPartyComponentsLastUpdate", "1255348257");
Deleted : user_pref("CT2613550.ct2613550.toolbarAppMetaDataLastCheckTime", "Sun Apr 22 2012 15:53:56 GMT+0200"[...]
Deleted : user_pref("CT2613550.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...]
Deleted : user_pref("CT2613550.homepageProtectorEnableByLogin", true);
Deleted : user_pref("CT2613550.initDone", true);
Deleted : user_pref("CT2613550.myStuffEnabled", true);
Deleted : user_pref("CT2613550.myStuffPublihserMinWidth", 400);
Deleted : user_pref("CT2613550.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Deleted : user_pref("CT2613550.myStuffServiceIntervalMM", 1440);
Deleted : user_pref("CT2613550.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Deleted : user_pref("CT2613550.revertSettingsEnabled", true);
Deleted : user_pref("CT2613550.searchProtectorDialogDelayInSec", 10);
Deleted : user_pref("CT2613550.searchProtectorEnableByLogin", true);
Deleted : user_pref("CT2613550.testingCtid", "");
Deleted : user_pref("CT2613550.uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Reg[...]
Deleted : user_pref("CT2613550.usagesFlag", 2);
Deleted : user_pref("CT2736476..clientLogIsEnabled", false);
Deleted : user_pref("CT2736476..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]
Deleted : user_pref("CT2736476..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]
Deleted : user_pref("CT2736476.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);
Deleted : user_pref("CT2736476.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Deleted : user_pref("CT2736476.CTID", "CT2736476");
Deleted : user_pref("CT2736476.CurrentServerDate", "21-4-2012");
Deleted : user_pref("CT2736476.DSInstall", true);
Deleted : user_pref("CT2736476.DialogsAlignMode", "LTR");
Deleted : user_pref("CT2736476.DialogsGetterLastCheckTime", "Sat Apr 21 2012 14:36:54 GMT+0200");
Deleted : user_pref("CT2736476.DownloadReferralCookieData", "");
Deleted : user_pref("CT2736476.FeedLastCount129257621460541612", 20);
Deleted : user_pref("CT2736476.FeedLastCount129257621968979554", 20);
Deleted : user_pref("CT2736476.FeedLastCount129258323135539557", 20);
Deleted : user_pref("CT2736476.FeedPollDate129257621460541612", "Sat Apr 21 2012 14:36:56 GMT+0200");
Deleted : user_pref("CT2736476.FeedPollDate129257621968979554", "Sat Apr 21 2012 14:36:56 GMT+0200");
Deleted : user_pref("CT2736476.FeedPollDate129258323135539557", "Sat Apr 21 2012 14:36:56 GMT+0200");
Deleted : user_pref("CT2736476.FirstServerDate", "29-2-2012");
Deleted : user_pref("CT2736476.FirstTime", true);
Deleted : user_pref("CT2736476.FirstTimeFF3", true);
Deleted : user_pref("CT2736476.FixPageNotFoundErrors", true);
Deleted : user_pref("CT2736476.GroupingServerCheckInterval", 1440);
Deleted : user_pref("CT2736476.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Deleted : user_pref("CT2736476.HPInstall", true);
Deleted : user_pref("CT2736476.HasUserGlobalKeys", true);
Deleted : user_pref("CT2736476.HomePageProtectorEnabled", true);
Deleted : user_pref("CT2736476.HomepageBeforeUnload", "hxxp://search.conduit.com/?ctid=CT2736476&SearchSource=[...]
Deleted : user_pref("CT2736476.Initialize", true);
Deleted : user_pref("CT2736476.InitializeCommonPrefs", true);
Deleted : user_pref("CT2736476.InstallationAndCookieDataSentCount", 3);
Deleted : user_pref("CT2736476.InstallationId", "ConduitNSISIntegration");
Deleted : user_pref("CT2736476.InstallationType", "ConduitXPEIntegration");
Deleted : user_pref("CT2736476.InstalledDate", "Wed Feb 29 2012 14:08:26 GMT+0100");
Deleted : user_pref("CT2736476.InvalidateCache", false);
Deleted : user_pref("CT2736476.IsGrouping", false);
Deleted : user_pref("CT2736476.IsInitSetupIni", true);
Deleted : user_pref("CT2736476.IsMulticommunity", false);
Deleted : user_pref("CT2736476.IsOpenThankYouPage", false);
Deleted : user_pref("CT2736476.IsOpenUninstallPage", true);
Deleted : user_pref("CT2736476.IsProtectorsInit", true);
Deleted : user_pref("CT2736476.LanguagePackLastCheckTime", "Sat Apr 21 2012 14:36:54 GMT+0200");
Deleted : user_pref("CT2736476.LanguagePackReloadIntervalMM", 1440);
Deleted : user_pref("CT2736476.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Deleted : user_pref("CT2736476.LastLogin_3.10.0.1", "Sat Apr 21 2012 14:36:54 GMT+0200");
Deleted : user_pref("CT2736476.LatestVersion", "3.12.0.7");
Deleted : user_pref("CT2736476.Locale", "de");
Deleted : user_pref("CT2736476.MCDetectTooltipHeight", "83");
Deleted : user_pref("CT2736476.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Deleted : user_pref("CT2736476.MCDetectTooltipWidth", "295");
Deleted : user_pref("CT2736476.MyStuffEnabledAtInstallation", true);
Deleted : user_pref("CT2736476.OriginalFirstVersion", "3.10.0.1");
Deleted : user_pref("CT2736476.RadioIsPodcast", false);
Deleted : user_pref("CT2736476.RadioLastCheckTime", "Sat Apr 21 2012 14:36:56 GMT+0200");
Deleted : user_pref("CT2736476.RadioLastUpdateIPServer", "3");
Deleted : user_pref("CT2736476.RadioLastUpdateServer", "129570411865130000");
Deleted : user_pref("CT2736476.RadioMediaID", "21930450");
Deleted : user_pref("CT2736476.RadioMediaType", "Media Player");
Deleted : user_pref("CT2736476.RadioMenuSelectedID", "EBRadioMenu_CT273647621930450");
Deleted : user_pref("CT2736476.RadioShrinkedFromSetup", false);
Deleted : user_pref("CT2736476.RadioStationName", "California%20Rock%20-%20Rock");
Deleted : user_pref("CT2736476.RadioStationURL", "hxxp://www.feedlive.net/california.asx");
Deleted : user_pref("CT2736476.SavedHomepage", "hxxp://www.shortnews.de/");
Deleted : user_pref("CT2736476.SearchCaption", "Freeware.de Customized Web Search");
Deleted : user_pref("CT2736476.SearchEngineBeforeUnload", "Freeware.de Customized Web Search");
Deleted : user_pref("CT2736476.SearchFromAddressBarIsInit", true);
Deleted : user_pref("CT2736476.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT273[...]
Deleted : user_pref("CT2736476.SearchInNewTabEnabled", true);
Deleted : user_pref("CT2736476.SearchInNewTabIntervalMM", 1440);
Deleted : user_pref("CT2736476.SearchInNewTabLastCheckTime", "Sat Apr 21 2012 14:36:53 GMT+0200");
Deleted : user_pref("CT2736476.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Deleted : user_pref("CT2736476.SearchProtectorEnabled", true);
Deleted : user_pref("CT2736476.SearchProtectorToolbarDisabled", false);
Deleted : user_pref("CT2736476.SendProtectorDataViaLogin", true);
Deleted : user_pref("CT2736476.ServiceMapLastCheckTime", "Sat Apr 21 2012 14:36:53 GMT+0200");
Deleted : user_pref("CT2736476.SettingsLastCheckTime", "Sat Apr 21 2012 14:36:53 GMT+0200");
Deleted : user_pref("CT2736476.SettingsLastUpdate", "1334746574");
Deleted : user_pref("CT2736476.TBHomePageUrl", "hxxp://search.conduit.com/?ctid=CT2736476&SearchSource=13");
Deleted : user_pref("CT2736476.ThirdPartyComponentsInterval", 504);
Deleted : user_pref("CT2736476.ThirdPartyComponentsLastCheck", "Sat Apr 21 2012 14:36:53 GMT+0200");
Deleted : user_pref("CT2736476.ThirdPartyComponentsLastUpdate", "1255344657");
Deleted : user_pref("CT2736476.ToolbarShrinkedFromSetup", false);
Deleted : user_pref("CT2736476.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2736476");
Deleted : user_pref("CT2736476.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...]
Deleted : user_pref("CT2736476.Uninstall", true);
Deleted : user_pref("CT2736476.UserID", "UN62097962760378375");
Deleted : user_pref("CT2736476.alertChannelId", "1128724");
Deleted : user_pref("CT2736476.autoDisableScopes", -1);
Deleted : user_pref("CT2736476.backendstorage.2736476a129652188678262596000000paramsgk1", "7B22757064617465526[...]
Deleted : user_pref("CT2736476.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...]
Deleted : user_pref("CT2736476.globalFirstTimeInfoLastCheckTime", "Sat Apr 21 2012 14:36:54 GMT+0200");
Deleted : user_pref("CT2736476.homepageProtectorEnableByLogin", true);
Deleted : user_pref("CT2736476.initDone", true);
Deleted : user_pref("CT2736476.isAppTrackingManagerOn", true);
Deleted : user_pref("CT2736476.isFirstRadioInstallation", false);
Deleted : user_pref("CT2736476.myStuffEnabled", true);
Deleted : user_pref("CT2736476.myStuffPublihserMinWidth", 400);
Deleted : user_pref("CT2736476.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Deleted : user_pref("CT2736476.myStuffServiceIntervalMM", 1440);
Deleted : user_pref("CT2736476.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Deleted : user_pref("CT2736476.navigateToUrlOnSearch", false);
Deleted : user_pref("CT2736476.oldAppsList", "129257551953509225,129257551953665476,111,129257617514448028,129[...]
Deleted : user_pref("CT2736476.revertSettingsEnabled", true);
Deleted : user_pref("CT2736476.searchProtectorDialogDelayInSec", 10);
Deleted : user_pref("CT2736476.searchProtectorEnableByLogin", true);
Deleted : user_pref("CT2736476.testingCtid", "");
Deleted : user_pref("CT2736476.toolbarAppMetaDataLastCheckTime", "Sat Apr 21 2012 14:36:54 GMT+0200");
Deleted : user_pref("CT2736476.toolbarContextMenuLastCheckTime", "Sat Apr 21 2012 14:36:54 GMT+0200");
Deleted : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/ct2613550/CT2613550[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1128724/1124413/DE", "\"0\"[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2736476", [...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=ct2613550", [...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.10[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2613550",[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2736476",[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/50/261/CT2613550/Images/6340849712463612[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=de", "\"b5f[...]
Deleted : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=de-de", "\"[...]
Deleted : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\Ich Selbst\\AppData\\Roaming\\Mozil[...]
Deleted : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.10.0.1");
Deleted : user_pref("CommunityToolbar.ToolbarsList", "CT2613550,CT2736476");
Deleted : user_pref("CommunityToolbar.ToolbarsList2", "CT2613550,CT2736476");
Deleted : user_pref("CommunityToolbar.ToolbarsList4", "CT2736476");
Deleted : user_pref("CommunityToolbar.facebook.settingsLastCheckTime", "Tue Oct 05 2010 16:42:34 GMT+0200");
Deleted : user_pref("CommunityToolbar.globalUserId", "4923c7de-7ef2-496b-a83b-0832e080e693");
Deleted : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);
Deleted : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);
Deleted : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2736476");
Deleted : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Wed Feb 29 2012 14:08:2[...]
Deleted : user_pref("CommunityToolbar.notifications.alertInfoInterval", 60);
Deleted : user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Wed Feb 29 2012 14:08:36 GMT+010[...]
Deleted : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com");
Deleted : user_pref("CommunityToolbar.notifications.locale", "en");
Deleted : user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440);
Deleted : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Wed Feb 29 2012 14:08:26 GMT+0100");
Deleted : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1313487611");
Deleted : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20);
Deleted : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com");
Deleted : user_pref("CommunityToolbar.notifications.showTrayIcon", false);
Deleted : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300);
Deleted : user_pref("CommunityToolbar.notifications.userId", "4519897a-4a73-4c2a-a291-2278bc00a606");
Deleted : user_pref("CommunityToolbar.originalHomepage", "hxxp://www.shortnews.de/");

*************************

AdwCleaner[R1].txt - [24376 octets] - [24/07/2012 14:44:58]
AdwCleaner[S1].txt - [24373 octets] - [25/07/2012 06:37:27]

########## EOF - C:\AdwCleaner[S1].txt - [24502 octets] ##########

Und das Log vom Emsisoft:

Code:
ATTFilter
Emsisoft Anti-Malware - Version 6.6
Letztes Update: 25.07.2012 06:47:33

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\, D:\, E:\, F:\, G:\
Archiv Scan: An
ADS Scan: An

Scan Beginn:	25.07.2012 13:23:57

C:\Users\Ich Selbst\Desktop\VideotoGIF.exe 	gefunden: Riskware.Win32.Keylogger!E1
C:\Users\Ich Selbst\AppData\Local\Mozilla\Firefox\Profiles\ad9lm4uu.default\Cache\2\A4\A66D9d01 	gefunden: Attached PE/Script!E2
E:\Eigene Dateien\mirc616.exe 	gefunden: Riskware.Client-IRC.Win32.mIRC!E2
E:\Eigene Dateien\mirc621.exe -> $INSTDIR\mirc.exe 	gefunden: not-a-virus:Client-IRC.Win32.mIRC!E2
E:\Eigene Dateien\mirc631.exe -> $TEMP\mirc631.exe -> $INSTDIR\mirc.exe 	gefunden: not-a-virus:Client-IRC.Win32.mIRC!E2
E:\Eigene Dateien\mirc631.exe -> $TEMP\mirc631.exe 	gefunden: not-a-virus:Client-IRC.Win32.mIRC!E2
E:\Eigene Dateien\News.File.Grabber.4.6.0.1.keygen-SND\News File Grabber 4.6.0.1.Keygen.exe 	gefunden: Trojan.Crypt!E2

Gescannt	666201
Gefunden	7

Scan Ende:	25.07.2012 14:32:31
Scan Zeit:	1:08:34

E:\Eigene Dateien\News.File.Grabber.4.6.0.1.keygen-SND\News File Grabber 4.6.0.1.Keygen.exe	Quarantäne Trojan.Crypt!E2
E:\Eigene Dateien\mirc621.exe -> $INSTDIR\mirc.exe	Quarantäne not-a-virus:Client-IRC.Win32.mIRC!E2
E:\Eigene Dateien\mirc631.exe -> $TEMP\mirc631.exe -> $INSTDIR\mirc.exe	Quarantäne not-a-virus:Client-IRC.Win32.mIRC!E2
E:\Eigene Dateien\mirc616.exe	Quarantäne Riskware.Client-IRC.Win32.mIRC!E2
C:\Users\Ich Selbst\AppData\Local\Mozilla\Firefox\Profiles\ad9lm4uu.default\Cache\2\A4\A66D9d01	Quarantäne Attached PE/Script!E2
C:\Users\Ich Selbst\Desktop\VideotoGIF.exe	Quarantäne Riskware.Win32.Keylogger!E1

Quarantäne	6
Während des Scans mit Emsisoft bekam ich noch folgende Meldung (wohl ein Fehlalarm) :



Ich finde es schon komisch, das nach zig Scans mit verschiedenen Antivirus und Anti-Malware Programmen jetzt immer noch befallene Dateien auf dem Rechner sind. Das spricht nicht gerade für die Qualität der verwendeten Programme.

Alt 25.07.2012, 13:50   #8
t'john
/// Helfer-Team
 
GVU Trojaner Win7 64bit - Standard

GVU Trojaner Win7 64bit


Zitat:
C:\Users\Ich Selbst\Desktop\VideotoGIF.exe gefunden: Riskware.Win32.Keylogger!E1
Was ist das?




Deinstalliere:
Emsisoft Anti-Malware


ESET Online Scanner

Vorbereitung

  • Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
  • Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren.
  • Vista/Win7-User: Bitte den Browser unbedingt als Administrator starten.
Los geht's

  • Lade und starte Eset Smartinstaller
  • Haken setzen bei YES, I accept the Terms of Use.
  • Klick auf Start.
  • Haken setzen bei Remove found threads und Scan archives.
  • Klick auf Start.
  • Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Finish drücken.
  • Browser schließen.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (manchmal auch C:\Programme\Eset\log.txt) suchen und mit Deinem Editor öffnen.
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset
__________________
Mfg, t'john
Das TB unterstützen

Alt 25.07.2012, 17:27   #9
gutschge
 
GVU Trojaner Win7 64bit - Standard

GVU Trojaner Win7 64bit


Zitat:
Zitat von t'john Beitrag anzeigen
Was ist das?
hxxp://videotogif.net/
Ein Programm um Videosequenzen in Animated Gif umzuwandeln.


Hier das Log vom EsetOnlineScanner:

Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=387ffa445ccb7345a267d505609e0a29
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-07-25 04:12:45
# local_time=2012-07-25 06:12:45 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 588706 588706 0 0
# compatibility_mode=5893 16776574 100 94 26634183 94857354 0 0
# compatibility_mode=8192 67108863 100 0 5484 5484 0 0
# scanned=192358
# found=0
# cleaned=0
# scan_time=5260

Alt 25.07.2012, 17:32   #10
t'john
/// Helfer-Team
 
GVU Trojaner Win7 64bit - Standard

GVU Trojaner Win7 64bit


Java aktualisieren

Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
  • Downloade dir bitte die neueste Java-Version von hier
  • Speichere die jxpiinstall.exe
  • Schließe alle laufenden Programme. Speziell deinen Browser.
  • Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 5 ) herunter laden.
  • Wenn die Installation beendet wurde
    Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
  • Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.
Nach dem Neustart
  • Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
  • Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
  • Klicke auf Dateien löschen....
  • Gehe sicher das überall ein Hacken gesetzt ist und klicke OK.
  • Klicke erneut OK.


Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html
__________________
Mfg, t'john
Das TB unterstützen

Alt 25.07.2012, 18:25   #11
gutschge
 
GVU Trojaner Win7 64bit - Standard

GVU Trojaner Win7 64bit


Hallo, habe alle Java Einstellungen vorgenommen. Ist Mein Rechner jetzt sauber?
Welche Programme sollte ich verwenden um bestmögllich geschützt zu sein?
Avira Free Antivirus hats ja nicht gebracht wie mann sieht.

Schönen Dank für deine Hilfe, ihr macht echt nen tollen Job hier. Danke!

Alt 25.07.2012, 19:48   #12
t'john
/// Helfer-Team
 
GVU Trojaner Win7 64bit - Standard

GVU Trojaner Win7 64bit


Meine Epfehlung:Microsoft Security Essentials - Kostenloser Virenschutz für Windows

Sehr gut!

damit bist Du sauber und entlassen!


Tool-Bereinigung mit OTL


Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.
  • Bitte lade Dir (falls noch nicht vorhanden) OTL von OldTimer herunter.
  • Speichere es auf Deinem Desktop.
  • Doppelklick auf OTL.exe um das Programm auszuführen.
    Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
  • Klicke auf den Button "Bereinigung"
  • OTL fragt eventuell nach einem Neustart.
    Sollte es dies tun, so lasse dies bitte zu.
Anmerkung: Nach dem Neustart werden OTL und andere Helferprogramme, die Du im Laufe der Bereinigung heruntergeladen hast, nicht mehr vorhanden sein. Sie wurden entfernt. Es ist daher Ok, wenn diese Programme nicht mehr vorhanden sind. Sollten noch welche übrig geblieben sein, lösche sie manuell.


Zurücksetzen der Sicherheitszonen

Lasse die Sicherheitszonen wieder zurücksetzen, da diese manipuliert wurden um den Browser für weitere Angriffe zu öffnen.
Gehe dabei so vor: http://www.trojaner-board.de/111805-...ecksetzen.html


Aufräumen mit CCleaner

Lasse mit CCleaner (Download) (Anleitung) Fehler in der

  • Registry beheben (mehrmals, solange bis keine Fehler mehr gefunden werden) und
  • temporäre Dateien löschen.




Lektuere zum abarbeiten:
http://www.trojaner-board.de/90880-d...tallation.html
http://www.trojaner-board.de/105213-...tellungen.html
PluginCheck
http://www.trojaner-board.de/96344-a...-rechners.html
Secunia Online Software Inspector
http://www.trojaner-board.de/71715-k...iendungen.html
http://www.trojaner-board.de/83238-a...sschalten.html
__________________
Mfg, t'john
Das TB unterstützen

Antwort

Themen zu GVU Trojaner Win7 64bit
administrator, adobe, antivir, autorun, avira, bho, conduit, ctfmon.lnk, device driver, explorer, firefox, flash player, format, helper, heuristiks/extra, heuristiks/shuriken, home, kaspersky, locker, logfile, mozilla, nvidia, nvidia update, opera, plug-in, programme, registry, searchscopes, security, software, temp, trojaner, usb, win7 64bit, windows, windows unlocker


« Bundespolizei- Ihr Computer ist gesperrt | Internet extrem langsam - sonst alles normal »


Ähnliche Themen: GVU Trojaner Win7 64bit


  1. GVU-Trojaner auf Win7/64bit
    Plagegeister aller Art und deren Bekämpfung - 30.05.2013 (11)
  2. GVU Trojaner 2.07 Win7 64bit
    Log-Analyse und Auswertung - 22.01.2013 (3)
  3. GVU Trojaner - WIN7 Pro 64bit
    Log-Analyse und Auswertung - 16.01.2013 (14)
  4. Bundespolizei Trojaner Win7 64bit
    Plagegeister aller Art und deren Bekämpfung - 19.11.2012 (2)
  5. GVU Trojaner 2.07 Win7 64bit
    Plagegeister aller Art und deren Bekämpfung - 01.11.2012 (12)
  6. BKA-Trojaner Win7 64bit
    Plagegeister aller Art und deren Bekämpfung - 26.10.2012 (12)
  7. GVU-Trojaner, Win7, 64bit
    Log-Analyse und Auswertung - 28.09.2012 (13)
  8. GVU-Trojaner Win7 64bit
    Plagegeister aller Art und deren Bekämpfung - 12.09.2012 (9)
  9. Polizei 5.2 Trojaner auf Win7 64Bit
    Plagegeister aller Art und deren Bekämpfung - 06.09.2012 (9)
  10. GVU 2.07 Trojaner, win7 64bit
    Plagegeister aller Art und deren Bekämpfung - 04.09.2012 (3)
  11. GVU Trojaner Win7 64bit
    Plagegeister aller Art und deren Bekämpfung - 04.09.2012 (9)
  12. GVU Trojaner Win7 64bit
    Plagegeister aller Art und deren Bekämpfung - 21.08.2012 (12)
  13. GVU Trojaner Win7 64Bit
    Log-Analyse und Auswertung - 19.08.2012 (10)
  14. BKA Trojaner - Win7 64bit
    Plagegeister aller Art und deren Bekämpfung - 11.08.2012 (13)
  15. GVU Trojaner auf Win7 64bit - Logfiles
    Log-Analyse und Auswertung - 02.08.2012 (17)
  16. GVU Trojaner, 100 Euro, Win7 64Bit
    Plagegeister aller Art und deren Bekämpfung - 02.08.2012 (9)
  17. GVU Trojaner Win7 64bit
    Log-Analyse und Auswertung - 26.07.2012 (21)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema GVU Trojaner Win7 64bit - Hallo, Ich habe mir den GVU Trojaner eingefangen (den neuen mit Webcam). Ich habe zunächst versucht eine Systemwiederherstellung zu machen, was aber nicht funktionierte. Anschliesend habe ich Kaspersky Windows Unlocker - GVU Trojaner Win7 64bit...
Archiv
Du betrachtest: GVU Trojaner Win7 64bit auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54