| |
| |||||||
Log-Analyse und Auswertung: Trojaner TR/Sirefef.BC.57, TR/Sirefef.AG.9, TR/ATRAPS.Gen2, TR/Necurs.A.71 und SpyHunter 4 auf RechnerWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
04.05.2013, 22:20
| #1 |
| |  Trojaner TR/Sirefef.BC.57, TR/Sirefef.AG.9, TR/ATRAPS.Gen2, TR/Necurs.A.71 und SpyHunter 4 auf Rechner Hallo, ich habe bei mir laut AntiVir die oben genannten Trojaner auf dem Rechner. Wollte schlau sein und habe mir den Spy Hunter runtergeladen und erst zu spät gesehen, dass es sich hier auch um Malware handelt. Zum Löschen von SpyHunter winde ich auch nichts. Kann mir wohl jemand helfen die Trojaner vom System zu eliminieren und SpyHunter zu löschen?? Habe defogger durchlaufen lassen und dabei folgende Meldung erhalten: defogger_disable by jpshortstuff (23.02.10.1) Log created at 20:47 on 04/05/2013 (Tobias) Checking for autostart values... HKCU\~\Run values retrieved. Unable to open HKLM\~\Run key (5) HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- OTL logfile created on: 04.05.2013 21:13:50 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Dokumente und Einstellungen\Tobias\Desktop\hilfe Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1015,17 Mb Total Physical Memory | 211,64 Mb Available Physical Memory | 20,85% Memory free 2,38 Gb Paging File | 1,62 Gb Available in Paging File | 67,92% Paging File free Paging file location(s): C:\pagefile.sys 1524 3048 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 72,06 Gb Total Space | 51,32 Gb Free Space | 71,22% Space Free | Partition Type: NTFS Drive D: | 72,05 Gb Total Space | 70,59 Gb Free Space | 97,96% Space Free | Partition Type: NTFS Computer Name: NETBOOK | User Name: Tobias | NOT logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.05.04 20:57:52 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Tobias\Desktop\hilfe\OTL.exe PRC - [2013.03.31 16:43:41 | 000,345,312 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2013.03.12 09:05:50 | 029,106,336 | ---- | M] (Dropbox, Inc.) -- C:\Dokumente und Einstellungen\Tobias\Anwendungsdaten\Dropbox\bin\Dropbox.exe PRC - [2013.01.14 21:33:34 | 006,320,000 | ---- | M] (Enigma Software Group USA, LLC.) -- C:\Programme\Enigma Software Group\SpyHunter\SpyHunter4.exe PRC - [2010.08.24 11:38:16 | 000,247,144 | ---- | M] (TomTom) -- C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe PRC - [2009.09.05 17:29:06 | 000,385,024 | ---- | M] (shbox.de) -- C:\Programme\FreePDF_XP\fpassist.exe PRC - [2009.05.08 10:42:54 | 000,395,776 | ---- | M] () -- C:\Programme\ASUS\Eee Docking\Eee Docking.exe PRC - [2009.04.16 19:46:30 | 000,630,784 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Programme\EeePC\ACPI\AsAcpiSvr.exe PRC - [2009.04.16 18:58:54 | 000,118,784 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Programme\EeePC\ACPI\AsTray.exe PRC - [2009.03.25 10:43:40 | 000,376,832 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Programme\ASUS\EeePC\Super Hybrid Engine\SuperHybridEngine.exe PRC - [2009.03.13 16:15:02 | 000,098,304 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Programme\EeePC\ACPI\AsEPCMon.exe PRC - [2008.04.14 14:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe ========== Modules (No Company Name) ========== MOD - [2011.09.27 08:23:00 | 000,087,912 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\zlib1.dll MOD - [2011.09.27 08:22:40 | 001,242,472 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\libxml2.dll MOD - [2009.05.08 10:42:54 | 000,395,776 | ---- | M] () -- C:\Programme\ASUS\Eee Docking\Eee Docking.exe ========== Services (SafeList) ========== SRV - File not found [On_Demand | Unknown] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt) SRV - [2013.03.31 16:43:57 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Unknown] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2013.03.31 16:43:42 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Unknown] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2013.01.14 21:33:14 | 000,769,920 | ---- | M] (Enigma Software Group USA, LLC.) [Auto | Unknown] -- C:\Programme\Enigma Software Group\SpyHunter\SH4Service.exe -- (SpyHunter 4 Service) SRV - [2012.09.02 21:05:35 | 000,161,768 | ---- | M] (Oracle Corporation) [Auto | Unknown] -- C:\Programme\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService) SRV - [2011.10.24 22:32:00 | 000,055,144 | ---- | M] (Apple Inc.) [Auto | Unknown] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device) SRV - [2010.08.24 11:38:18 | 000,092,008 | ---- | M] (TomTom) [Auto | Unknown] -- C:\Programme\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService) SRV - [2008.04.14 14:00:00 | 000,088,576 | ---- | M] (Microsoft Corporation) [Unknown (-1) | Unknown] -- C:\WINDOWS\system32\wbem\wmiaprpl.dll -- (WmiApRpl) SRV - [2003.07.28 12:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Unknown] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose) SRV - [2003.06.19 23:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto | Unknown] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Unknown] -- -- (WDICA) DRV - File not found [Kernel | On_Demand | Unknown] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand | Unknown] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand | Unknown] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand | Unknown] -- -- (PDCOMP) DRV - File not found [Kernel | System | Unknown] -- -- (PCIDump) DRV - File not found [Kernel | System | Unknown] -- -- (lbrtfdc) DRV - File not found [Kernel | System | Unknown] -- -- (i2omgmt) DRV - File not found [Kernel | System | Unknown] -- -- (Changer) DRV - File not found [Kernel | On_Demand | Unknown] -- System32\Drivers\btwusb.sys -- (BTWUSB) DRV - File not found [Kernel | On_Demand | Unknown] -- system32\DRIVERS\btwhid.sys -- (btwhid) DRV - File not found [Kernel | On_Demand | Unknown] -- system32\DRIVERS\btwdndis.sys -- (BTWDNDIS) DRV - File not found [Kernel | On_Demand | Unknown] -- system32\DRIVERS\btport.sys -- (BTDriver) DRV - File not found [Kernel | On_Demand | Unknown] -- system32\drivers\btaudio.sys -- (btaudio) DRV - [2013.03.31 16:44:01 | 000,135,136 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Unknown] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb) DRV - [2013.03.31 16:44:01 | 000,084,744 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Unknown] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt) DRV - [2013.03.31 16:44:01 | 000,037,352 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Unknown] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr) DRV - [2013.03.11 23:56:01 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Unknown] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2012.06.22 11:01:32 | 000,019,984 | ---- | M] () [File_System | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\EsgScanner.sys -- (EsgScanner) DRV - [2011.05.06 15:57:10 | 000,013,904 | ---- | M] () [Kernel | On_Demand | Unknown] -- C:\Programme\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard) DRV - [2009.10.20 19:47:46 | 000,113,280 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\ewusbnet.sys -- (ewusbnet) DRV - [2009.10.12 16:21:54 | 000,100,736 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\ewusbdev.sys -- (hwusbdev) DRV - [2009.09.10 15:55:52 | 000,102,528 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\ewusbmdm.sys -- (hwdatacard) DRV - [2009.04.27 13:26:44 | 005,074,944 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) DRV - [2009.04.20 10:38:18 | 000,232,872 | R--- | M] () [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\SRS_PremiumSound_i386.sys -- (SRS_PremiumSound_Service) DRV - [2009.03.13 23:05:26 | 001,528,928 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\athw.sys -- (AR5416) DRV - [2009.03.02 07:03:47 | 000,038,912 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\l1c51x86.sys -- (L1c) DRV - [2009.02.06 18:08:42 | 000,055,152 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Unknown] -- C:\WINDOWS\system32\drivers\fssfltr_tdi.sys -- (fssfltr) DRV - [2008.11.19 10:21:28 | 000,039,040 | ---- | M] (GenesysLogic Technologies, Inc.) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\uvclf.sys -- (uvclf) DRV - [2008.08.05 14:10:12 | 001,684,736 | ---- | M] (Creative) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt) DRV - [2008.04.14 14:00:00 | 000,088,576 | ---- | M] (Microsoft Corporation) [Unknown (-1) | Unknown (-1) | Unknown] -- C:\WINDOWS\system32\wbem\wmiaprpl.dll -- (WmiApRpl) DRV - [2008.04.08 15:59:28 | 000,010,752 | ---- | M] (ASUSTeK Computer Inc.) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\ASUSACPI.SYS -- (AsusACPI) DRV - [2006.01.04 09:41:48 | 001,389,056 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-4167658315-3026997754-3479370961-1007\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://eeepc.asus.com/global IE - HKU\S-1-5-21-4167658315-3026997754-3479370961-1007\..\SearchScopes,DefaultScope = {F49E7BF6-FA20-4B71-8262-055E6FA0B486} IE - HKU\S-1-5-21-4167658315-3026997754-3479370961-1007\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKU\S-1-5-21-4167658315-3026997754-3479370961-1007\..\SearchScopes\{F49E7BF6-FA20-4B71-8262-055E6FA0B486}: "URL" = hxxp://www.google.de/search?q={searchTerms} IE - HKU\S-1-5-21-4167658315-3026997754-3479370961-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Programme\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Programme\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8064.0206: C:\Programme\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Programme\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.06.27 18:02:55 | 000,000,000 | ---D | M] [2011.02.06 16:12:52 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Tobias\Anwendungsdaten\Mozilla\Extensions [2011.02.06 16:12:52 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Tobias\Anwendungsdaten\Mozilla\Extensions\home2@tomtom.com O1 HOSTS File: ([2008.04.14 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Programme\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc) O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [APSDaemon] C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [AsusACPIServer] C:\Programme\EeePC\ACPI\AsAcpiSvr.exe (ASUSTeK Computer Inc.) O4 - HKLM..\Run: [AsusEPCMonitor] C:\Programme\EeePC\ACPI\AsEPCMon.exe (ASUSTeK Computer Inc.) O4 - HKLM..\Run: [AsusTray] C:\Programme\EeePC\ACPI\AsTray.exe (ASUSTeK Computer Inc.) O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de) O4 - HKLM..\Run: [SpyHunter Security Suite] C:\Programme\Enigma Software Group\SpyHunter\SpyHunter4.exe (Enigma Software Group USA, LLC.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [SynAsusAcpi] C:\Programme\Synaptics\SynTP\SynAsusAcpi.exe (Synaptics Incorporated) O4 - HKU\S-1-5-21-4167658315-3026997754-3479370961-1007..\Run: [Eee Docking] C:\Programme\ASUS\Eee Docking\Eee Docking.exe () O4 - HKU\S-1-5-21-4167658315-3026997754-3479370961-1007..\Run: [TomTomHOME.exe] C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe (TomTom) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\ SuperHybridEngine.lnk = C:\Programme\ASUS\EeePC\Super Hybrid Engine\SuperHybridEngine.exe (ASUSTeK Computer Inc.) O4 - Startup: C:\Dokumente und Einstellungen\Tobias\Startmenü\Programme\Autostart\Dropbox.lnk = C:\Dokumente und Einstellungen\Tobias\Anwendungsdaten\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-4167658315-3026997754-3479370961-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Nach Microsoft &Excel exportieren - D:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Senden an &Bluetooth-Gerät... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm File not found O8 - Extra context menu item: Senden an Bluetooth - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm File not found O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Programme\PokerStars.NET\PokerStarsUpdate.exe (PokerStars) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{29589743-3667-43D5-8F52-56729D982F02}: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Eee PC Seashell_1.bmp O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Eee PC Seashell_1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.05.13 21:41:50 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{16da6c78-2091-11e0-98b8-0026189efa41}\Shell - "" = AutoRun O33 - MountPoints2\{16da6c78-2091-11e0-98b8-0026189efa41}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{16da6c78-2091-11e0-98b8-0026189efa41}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a O33 - MountPoints2\{42b6175d-4005-11de-bdd2-806d6172696f}\Shell - "" = AutoRun O33 - MountPoints2\{42b6175d-4005-11de-bdd2-806d6172696f}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{42b6175d-4005-11de-bdd2-806d6172696f}\Shell\AutoRun\command - "" = E:\setup.exe O33 - MountPoints2\{8a712ef2-a620-11de-94a2-0026189efa41}\Shell - "" = AutoRun O33 - MountPoints2\{8a712ef2-a620-11de-94a2-0026189efa41}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{8a712ef2-a620-11de-94a2-0026189efa41}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{8a712ef5-a620-11de-94a2-0026189efa41}\Shell - "" = AutoRun O33 - MountPoints2\{8a712ef5-a620-11de-94a2-0026189efa41}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{8a712ef5-a620-11de-94a2-0026189efa41}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{ea233476-c8a3-11de-94c7-0026189efa41}\Shell - "" = AutoRun O33 - MountPoints2\{ea233476-c8a3-11de-94c7-0026189efa41}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{ea233476-c8a3-11de-94c7-0026189efa41}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{ea233477-c8a3-11de-94c7-0026189efa41}\Shell - "" = AutoRun O33 - MountPoints2\{ea233477-c8a3-11de-94c7-0026189efa41}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{ea233477-c8a3-11de-94c7-0026189efa41}\Shell\AutoRun\command - "" = E:\AutoRun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2013.05.04 20:45:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Tobias\Desktop\hilfe [2013.05.02 22:50:19 | 000,000,000 | ---D | C] -- C:\sh4ldr [2013.05.02 22:50:19 | 000,000,000 | ---D | C] -- C:\Programme\Enigma Software Group [2013.05.02 22:49:40 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013.05.04 21:20:00 | 000,000,418 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{071DEAAD-FE5F-41A5-9BDD-665C7803EC52}.job [2013.05.04 21:08:27 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2013.05.04 20:45:58 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Tobias\defogger_reenable [2013.05.04 20:22:22 | 000,000,420 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{185E1BA6-B135-4F0E-A15E-7B63732A0150}.job [2013.05.04 20:17:34 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2013.05.02 23:09:33 | 000,001,023 | ---- | M] () -- C:\Dokumente und Einstellungen\Tobias\Startmenü\Programme\Autostart\Dropbox.lnk [2013.05.02 22:55:28 | 000,001,017 | ---- | M] () -- C:\Dokumente und Einstellungen\Tobias\Desktop\Dropbox.lnk [2013.04.19 22:16:02 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job [2013.04.19 21:45:57 | 000,275,760 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2013.04.18 23:09:29 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files Created - No Company Name ========== [2013.05.04 20:45:58 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Tobias\defogger_reenable [2012.06.22 11:01:32 | 000,019,984 | ---- | C] () -- C:\WINDOWS\System32\ESGScanner.sys [2012.06.22 11:01:32 | 000,019,984 | ---- | C] () -- C:\WINDOWS\System32\drivers\EsgScanner.sys [2012.02.18 20:38:10 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll [2010.02.26 22:05:47 | 000,017,408 | ---- | C] () -- C:\Dokumente und Einstellungen\Tobias\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.09.01 23:55:03 | 000,000,141 | ---- | C] () -- C:\Dokumente und Einstellungen\Tobias\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat [2009.09.01 23:14:19 | 000,000,170 | ---- | C] () -- C:\Dokumente und Einstellungen\Tobias\Anwendungsdaten\wklnhst.dat ========== ZeroAccess Check ========== [2009.05.13 22:39:26 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] "ThreadingModel" = Both "" = C:\RECYCLER\S-1-5-21-4167658315-3026997754-3479370961-1007\$a17411a924d85ec26b63392b0c9b1d29\n. -- File not found [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shdocvw.dll -- [2009.03.03 01:10:15 | 001,499,136 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009.02.09 12:51:44 | 000,473,600 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008.04.14 14:00:00 | 000,273,920 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2012.06.20 10:25:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\elsterformular [2009.09.20 15:27:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FreePDF [2010.08.16 11:01:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MSScanAppDataDir [2011.02.06 16:13:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TomTom [2009.05.13 22:29:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Wireless LAN Card [2011.12.10 14:57:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521} [2013.05.04 21:11:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tobias\Anwendungsdaten\Dropbox [2012.06.20 10:26:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tobias\Anwendungsdaten\elsterformular [2011.01.14 21:38:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tobias\Anwendungsdaten\Template [2011.02.06 16:12:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Tobias\Anwendungsdaten\TomTom ========== Purity Check ========== < End of report > OTL Extras logfile created on: 04.05.2013 21:13:50 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Dokumente und Einstellungen\Tobias\Desktop\hilfe Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1015,17 Mb Total Physical Memory | 211,64 Mb Available Physical Memory | 20,85% Memory free 2,38 Gb Paging File | 1,62 Gb Available in Paging File | 67,92% Paging File free Paging file location(s): C:\pagefile.sys 1524 3048 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 72,06 Gb Total Space | 51,32 Gb Free Space | 71,22% Space Free | Partition Type: NTFS Drive D: | 72,05 Gb Total Space | 70,59 Gb Free Space | 97,96% Space Free | Partition Type: NTFS Computer Name: NETBOOK | User Name: Tobias | NOT logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%* ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%* exefile [open] -- "%1" %* htafile [open] -- "%1" %* htmlfile [edit] -- "D:\Programme\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [print] -- "D:\Programme\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "AntiVirusDisableNotify" = 1 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] ========== System Restore Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore] "DisableSR" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr] "Start" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService] "Start" = 2 ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List] "427:TCP" = 427:TCP:LocalSubNet:Enabled:SLP_Port(427)_TCP "427:UDP" = 427:UDP:LocalSubNet:Enabled:SLP_Port(427)_UDP [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "427:TCP" = 427:TCP:LocalSubNet:Enabled:SLP_Port(427)_TCP "427:UDP" = 427:UDP:LocalSubNet:Enabled:SLP_Port(427)_UDP ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation) "%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation) "C:\Programme\Windows Live\Messenger\wlcsdk.exe" = C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation) "C:\Programme\Windows Live\Messenger\msnmsgr.exe" = C:\Programme\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger -- (Microsoft Corporation) "C:\Programme\Windows Live\Sync\WindowsLiveSync.exe" = C:\Programme\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync -- (Microsoft Corporation) "C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Temp\7zS435C\setup\hpznui01.exe" = C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Temp\7zS435C\setup\hpznui01.exe:*:Enabled:hpznui01.exe "C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe" = C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe -- (Hewlett-Packard Co.) "C:\Programme\HP\Digital Imaging\bin\hpqste08.exe" = C:\Programme\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe -- (Hewlett-Packard Co.) "C:\Programme\HP\Digital Imaging\bin\hposid01.exe" = C:\Programme\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.) "C:\Programme\HP\Digital Imaging\bin\hpqkygrp.exe" = C:\Programme\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe -- (Hewlett-Packard Co.) "C:\Programme\HP\Digital Imaging\bin\hpfcCopy.exe" = C:\Programme\HP\Digital Imaging\bin\hpfcCopy.exe:*:Enabled:hpfccopy.exe -- (Hewlett-Packard Co.) "C:\Programme\HP\Digital Imaging\bin\hpoews01.exe" = C:\Programme\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- (Hewlett-Packard Co.) "C:\Programme\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Programme\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe -- (Hewlett-Packard Co.) "C:\Programme\HP\Digital Imaging\bin\hpqgplgtupl.exe" = C:\Programme\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe -- (Hewlett-Packard Co.) "C:\Programme\HP\Digital Imaging\bin\hpqgpc01.exe" = C:\Programme\HP\Digital Imaging\bin\hpqgpc01.exe:*:Enabled:hpqgpc01.exe -- (Hewlett-Packard) "C:\Programme\HP\Digital Imaging\bin\hpqusgm.exe" = C:\Programme\HP\Digital Imaging\bin\hpqusgm.exe:*:Enabled:hpqusgm.exe -- (Hewlett-Packard Co.) "C:\Programme\HP\Digital Imaging\bin\hpqusgh.exe" = C:\Programme\HP\Digital Imaging\bin\hpqusgh.exe:*:Enabled:hpqusgh.exe -- (Hewlett-Packard Co.) "C:\Programme\HP\HP Software Update\hpwucli.exe" = C:\Programme\HP\HP Software Update\hpwucli.exe:*:Enabled:hpwucli.exe -- (Hewlett-Packard) "C:\Programme\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe" = C:\Programme\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe:*:Enabled:smartwebprintexe.exe -- (Hewlett-Packard Co.) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation) "%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation) "C:\Programme\Windows Live\Messenger\wlcsdk.exe" = C:\Programme\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation) "C:\Programme\Windows Live\Messenger\msnmsgr.exe" = C:\Programme\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger -- (Microsoft Corporation) "C:\Programme\Windows Live\Sync\WindowsLiveSync.exe" = C:\Programme\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync -- (Microsoft Corporation) "C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Temp\7zS435C\setup\hpznui01.exe" = C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Temp\7zS435C\setup\hpznui01.exe:*:Enabled:hpznui01.exe "C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe" = C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe -- (Hewlett-Packard Co.) "C:\Programme\HP\Digital Imaging\bin\hpqste08.exe" = C:\Programme\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe -- (Hewlett-Packard Co.) "C:\Programme\HP\Digital Imaging\bin\hposid01.exe" = C:\Programme\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.) "C:\Programme\HP\Digital Imaging\bin\hpqkygrp.exe" = C:\Programme\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe -- (Hewlett-Packard Co.) "C:\Programme\HP\Digital Imaging\bin\hpfcCopy.exe" = C:\Programme\HP\Digital Imaging\bin\hpfcCopy.exe:*:Enabled:hpfccopy.exe -- (Hewlett-Packard Co.) "C:\Programme\HP\Digital Imaging\bin\hpoews01.exe" = C:\Programme\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- (Hewlett-Packard Co.) "C:\Programme\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Programme\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe -- (Hewlett-Packard Co.) "C:\Programme\HP\Digital Imaging\bin\hpqgplgtupl.exe" = C:\Programme\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe -- (Hewlett-Packard Co.) "C:\Programme\HP\Digital Imaging\bin\hpqgpc01.exe" = C:\Programme\HP\Digital Imaging\bin\hpqgpc01.exe:*:Enabled:hpqgpc01.exe -- (Hewlett-Packard) "C:\Programme\HP\Digital Imaging\bin\hpqusgm.exe" = C:\Programme\HP\Digital Imaging\bin\hpqusgm.exe:*:Enabled:hpqusgm.exe -- (Hewlett-Packard Co.) "C:\Programme\HP\Digital Imaging\bin\hpqusgh.exe" = C:\Programme\HP\Digital Imaging\bin\hpqusgh.exe:*:Enabled:hpqusgh.exe -- (Hewlett-Packard Co.) "C:\Programme\HP\HP Software Update\hpwucli.exe" = C:\Programme\HP\HP Software Update\hpwucli.exe:*:Enabled:hpwucli.exe -- (Hewlett-Packard) "C:\Programme\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe" = C:\Programme\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe:*:Enabled:smartwebprintexe.exe -- (Hewlett-Packard Co.) "C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\WebKit2WebProcess.exe" = C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit -- (Apple Inc.) "C:\Programme\Bonjour\mDNSResponder.exe" = C:\Programme\Bonjour\mDNSResponder.exe:*:Enabled  ienst "Bonjour" -- (Apple Inc.)"D:\Programme\iTunes\iTunes.exe" = D:\Programme\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.) "C:\Dokumente und Einstellungen\Tobias\Anwendungsdaten\Dropbox\bin\Dropbox.exe" = C:\Dokumente und Einstellungen\Tobias\Anwendungsdaten\Dropbox\bin\Dropbox.exe:*:Enabled ropbox -- (Dropbox, Inc.)========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{06A1D88C-E102-4527-AF70-29FFD7AF215A}" = Scan "{097CDB1E-07C9-40F1-9972-F0F9F3A287E4}" = Network "{0AC0F1B2-61C7-4B6E-ACEF-58FCC0B94835}" = SpyHunter "{0E66A3E5-0273-4574-AD5B-C54AEDC19083}" = DLRG Vereinsverwaltung - Version 12.08 "{119B7481-0216-40D2-A5CC-C3E1F461ECC1}" = Windows Live Fotogalerie "{1458BB78-1DC5-4BC0-B9A3-2B644F5A8105}" = DeviceDiscovery "{150B6201-E9E6-4DFB-960E-CCBD53FBDDED}" = HPProductAssistant "{19F5658D-92E8-4A08-8657-D38ABB1574B2}" = Asus ACPI Driver "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool "{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT "{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 7 "{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Client Installation Program "{292F0F52-B62D-4E71-921B-89A682402201}" = Toolbox "{2FB9EA69-51D4-4913-9AD5-762C034DE811}" = Status "{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver "{3127F76D-5335-4AC7-BD1E-2F5247A23C24}" = iTunes "{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works "{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform "{3FB39BED-37C8-4E60-8E02-315B8C2B07E3}" = USB2.0 UVC Camera Device "{47BACF74-5A07-48BD-BADB-A769550F0F5A}" = FontResizer "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{4DE3E3D9-AE81-45DE-9195-3015F7B1DBF3}" = Junk Mail filter update "{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent "{54B1E5A3-1B29-4582-A226-172A1FC7BA6C}" = Windows Live Family Safety "{587178E7-B1DF-494E-9838-FA4DD36E873C}" = ASUSUpdate for Eee PC "{5A166C0B-9557-4364-A057-F946D674E6AC}" = Windows Live Mail "{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}" = Skype™ 3.6 "{5DCF0E4B-F8EA-4229-A0BD-5CA6D4AFB749}" = SolutionCenter "{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call "{601F2C04-4E0A-464F-B9FE-4FD140098E21}" = PS_AIO_06_B109n-z_SW_Min "{60FFB3E0-6D5B-4D73-AE5B-07E58B83AF0C}" = 32 Bit HP CIO Components Installer "{6333FC29-BFE5-4024-AC78-958A1A7555D1}" = EeeSplendid "{70B7A167-0B88-445D-A3EA-97C73AA88CAC}" = Windows Live Toolbar "{74DC0593-6BC6-4001-AD5F-D810AFB68D86}" = HP Update "{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update "{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour "{79A72AAD-7ED4-49D8-872D-D1465061F9DB}" = HP Photosmart Wireless B109n-z All-in-One Driver Software 14.0 Rel. 6 "{8153ED9A-C94A-426E-9880-5E6775C08B62}" = Apple Mobile Device Support "{81821BF8-DA20-4F8C-AA87-F70A274828D4}" = Windows Live Writer "{837B6259-6FF5-4E66-87C1-A5A15ED36FF4}" = Windows Live Messenger "{88F08F98-12BC-4613-81A2-8F9B88CFC73E}" = Super Hybrid Engine "{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86) "{8EE94FD8-5F52-4463-A340-185D16328158}" = WebReg "{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules "{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}" = Azurewave Wireless LAN Card "{8FF6F5CA-4E30-4E3B-B951-204CAAA2716A}" = SmartWebPrinting "{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard "{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003 "{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System "{91E04CA7-0B13-4F8C-AA4D-2A573AC96D19}" = Windows Live Essentials "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 "{9C9CEB9D-53FD-49A7-85D2-FE674F72F24E}" = Microsoft Search Enhancement Pack "{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2 "{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support "{AC35A885-0F8F-4857-B7DA-6E8DFB43E6B3}" = HPSSupply "{AC76BA86-7AD7-1031-7B44-A81000000003}" = Adobe Reader 8.1.0 - Deutsch "{B9BDA46B-2E17-4F43-9D7A-9B1E09A0A4D8}" = Data Sync "{BB3447F6-9553-4AA9-960E-0DB5310C5779}" = GPBaseService2 "{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86) "{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2 "{C72CA49A-9237-4810-8449-45DA3BD26D64}" = EzMessenger "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1 "{CD31E63D-47FD-491C-8117-CF201D0AFAB5}" = TrayApp "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{D360FA88-17C8-4F14-B67F-13AAF9607B12}" = MarketResearch "{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant "{E517094C-06B6-419F-8FFD-EF4F57972130}" = QuickTransfer "{ED636101-1959-4360-8BF7-209436E7DEE4}" = Windows Live Sync "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU] "{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F428DC33-C0E4-40A8-BFC3-B59957F86FE0}" = B109n-z "{FA0FF682-CC70-4C57-93CD-E276F3E7537E}" = BufferChm "Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX "Avira AntiVir Desktop" = Avira Free Antivirus "Eee Docking_is1" = Eee Docking 1.3.1.0 "EeePC1005HA" = EeePC1005HA Screen Saver "ElsterFormular 13.2.0.8623p" = ElsterFormular "ElsterFormular für Privatanwender 12.2.2.6665p" = ElsterFormular-Update "FreePDF_XP" = FreePDF (Remove only) "GPL Ghostscript 8.70" = GPL Ghostscript 8.70 "HDMI" = Intel(R) Graphics Media Accelerator Driver "HP Imaging Device Functions" = HP Imaging Device Functions 14.0 "HP Smart Web Printing" = HP Smart Web Printing 4.60 "HP Solution Center & Imaging Support Tools" = HP Solution Center 14.0 "HPExtendedCapabilities" = HP Customer Participation Program 14.0 "IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs "ie7" = Windows Internet Explorer 7 "ie8" = Windows Internet Explorer 8 "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1 "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "Mobile Partner" = Mobile Partner "MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP "NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs "PokerStars.net" = PokerStars.net "Redirection Port Monitor" = RedMon - Redirection Port Monitor "Shop for HP Supplies" = Shop for HP Supplies "Surf & E-Mail-Stick" = Surf & E-Mail-Stick "SynTPDeinstKey" = Synaptics Pointing Device Driver "TomTom HOME" = TomTom HOME 2.7.6.2056 "Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7 "Windows Media Format Runtime" = Windows Media Format 11 runtime "Windows Media Player" = Windows Media Player 11 "WinLiveSuite_Wave3" = Windows Live Essentials "WMFDist11" = Windows Media Format 11 runtime "wmp11" = Windows Media Player 11 "Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0 "Yahoo! Companion" = Yahoo! Toolbar ========== HKEY_USERS Uninstall List ========== [HKEY_USERS\S-1-5-21-4167658315-3026997754-3479370961-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Dropbox" = Dropbox ========== Last 20 Event Log Errors ========== Error: Unable to start EventLog service! < End of report > GMER 2.1.19163 - hxxp://www.gmer.net Rootkit scan 2013-05-04 23:02:48 Windows 5.1.2600 Service Pack 3 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 Hitachi_ rev.FB2O 149,05GB Running: gmer_2.1.19163.exe; Driver: C:\DOKUME~1\Admin\LOKALE~1\Temp\uxldqpog.sys ---- System - GMER 2.1 ---- SSDT A47D806C ZwClose SSDT A47D8026 ZwCreateKey SSDT A47D8076 ZwCreateSection SSDT A47D801C ZwCreateThread SSDT A47D802B ZwDeleteKey SSDT A47D8035 ZwDeleteValueKey SSDT A47D8067 ZwDuplicateObject SSDT A47D803A ZwLoadKey SSDT A47D8008 ZwOpenProcess SSDT A47D800D ZwOpenThread SSDT A47D808F ZwQueryValueKey SSDT A47D8044 ZwReplaceKey SSDT A47D8080 ZwRequestWaitReplyPort SSDT A47D803F ZwRestoreKey SSDT A47D807B ZwSetContextThread SSDT A47D8085 ZwSetSecurityObject SSDT A47D8030 ZwSetValueKey SSDT A47D808A ZwSystemDebugControl SSDT A47D8017 ZwTerminateProcess ---- User code sections - GMER 2.1 ---- .text C:\Programme\Internet Explorer\iexplore.exe[2848] USER32.dll!DialogBoxParamW 7E3747AB 5 Bytes JMP 4119550D C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[2848] USER32.dll!CreateWindowExW 7E37D0A3 5 Bytes JMP 4126DB04 C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[2848] USER32.dll!DialogBoxIndirectParamW 7E382072 5 Bytes JMP 4136727F C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[2848] USER32.dll!MessageBoxIndirectA 7E38A082 5 Bytes JMP 413671B1 C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[2848] USER32.dll!DialogBoxParamA 7E38B144 5 Bytes JMP 4136721C C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[2848] USER32.dll!MessageBoxExW 7E3A0838 5 Bytes JMP 41367082 C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[2848] USER32.dll!MessageBoxExA 7E3A085C 5 Bytes JMP 413670E4 C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[2848] USER32.dll!DialogBoxIndirectParamA 7E3A6D7D 5 Bytes JMP 413672E2 C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[2848] USER32.dll!MessageBoxIndirectW 7E3B64D5 5 Bytes JMP 41367146 C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[3068] USER32.dll!DialogBoxParamW 7E3747AB 5 Bytes JMP 4119550D C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[3068] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 41269A95 C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[3068] USER32.dll!CallNextHookEx 7E37B3C6 5 Bytes JMP 4125D10D C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[3068] USER32.dll!CreateWindowExW 7E37D0A3 5 Bytes JMP 4126DB04 C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[3068] USER32.dll!UnhookWindowsHookEx 7E37D5F3 5 Bytes JMP 411D4674 C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[3068] USER32.dll!DialogBoxIndirectParamW 7E382072 5 Bytes JMP 4136727F C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[3068] USER32.dll!MessageBoxIndirectA 7E38A082 5 Bytes JMP 413671B1 C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[3068] USER32.dll!DialogBoxParamA 7E38B144 5 Bytes JMP 4136721C C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[3068] USER32.dll!MessageBoxExW 7E3A0838 5 Bytes JMP 41367082 C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[3068] USER32.dll!MessageBoxExA 7E3A085C 5 Bytes JMP 413670E4 C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[3068] USER32.dll!DialogBoxIndirectParamA 7E3A6D7D 5 Bytes JMP 413672E2 C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[3068] USER32.dll!MessageBoxIndirectW 7E3B64D5 5 Bytes JMP 41367146 C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[3068] ole32.dll!CoCreateInstance 774CF1BC 5 Bytes JMP 4126DB60 C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[3068] ole32.dll!OleLoadFromStream 774F983B 5 Bytes JMP 41367600 C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[3492] USER32.dll!DialogBoxParamW 7E3747AB 5 Bytes JMP 4119550D C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[3492] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 41269A95 C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[3492] USER32.dll!CallNextHookEx 7E37B3C6 5 Bytes JMP 4125D10D C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[3492] USER32.dll!CreateWindowExW 7E37D0A3 5 Bytes JMP 4126DB04 C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[3492] USER32.dll!UnhookWindowsHookEx 7E37D5F3 5 Bytes JMP 411D4674 C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[3492] USER32.dll!DialogBoxIndirectParamW 7E382072 5 Bytes JMP 4136727F C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[3492] USER32.dll!MessageBoxIndirectA 7E38A082 5 Bytes JMP 413671B1 C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[3492] USER32.dll!DialogBoxParamA 7E38B144 5 Bytes JMP 4136721C C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[3492] USER32.dll!MessageBoxExW 7E3A0838 5 Bytes JMP 41367082 C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[3492] USER32.dll!MessageBoxExA 7E3A085C 5 Bytes JMP 413670E4 C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[3492] USER32.dll!DialogBoxIndirectParamA 7E3A6D7D 5 Bytes JMP 413672E2 C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[3492] USER32.dll!MessageBoxIndirectW 7E3B64D5 5 Bytes JMP 41367146 C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[3492] ole32.dll!CoCreateInstance 774CF1BC 5 Bytes JMP 4126DB60 C:\WINDOWS\system32\IEFRAME.dll .text C:\Programme\Internet Explorer\iexplore.exe[3492] ole32.dll!OleLoadFromStream 774F983B 5 Bytes JMP 41367600 C:\WINDOWS\system32\IEFRAME.dll ---- Devices - GMER 2.1 ---- AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 wdf01000.sys AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 wdf01000.sys AttachedDevice \Driver\Tcpip \Device\Tcp fssfltr_tdi.sys Device \FileSystem\Fastfat \Fat 9C9F8D20 Device \FileSystem\Fastfat \Fat 9CA08428 AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys ---- Registry - GMER 2.1 ---- Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\HP Photosmart Wireless B109n-z@ChangeID 923062 ---- EOF - GMER 2.1 ---- |
|
05.05.2013, 10:37
| #2 |
| /// Malwareteam / Visitor  | Trojaner TR/Sirefef.BC.57, TR/Sirefef.AG.9, TR/ATRAPS.Gen2, TR/Necurs.A.71 und SpyHunter 4 auf Rechner Hallo ich bin smeenk und ich werde versuchen dir mit deinem Problem zu helfen
__________________ Systemscan mit ZOEK Bitte lade die zoek.exe von hier: http://hijackthis.nl/smeenk/
Bitte poste in deiner nächsten Antwort:
Bitte Logs in Code-Tags posten. Code-Tags macht man so:[code] Dein Log hier [/code] |
|
05.05.2013, 20:52
| #3 |
| | Trojaner TR/Sirefef.BC.57, TR/Sirefef.AG.9, TR/ATRAPS.Gen2, TR/Necurs.A.71 und SpyHunter 4 auf Rechner Hallo Smeenk,
__________________schon mal danke für die Hilfe. Hier der gewünschte Log: Code:
ATTFilter
Zoek.exe Version 4.0.0.2 Updated 03-May-2013
Tool run by Admin on 05.05.2013 at 21:25:30,90.
Microsoft Windows XP Home Edition 5.1.2600 Service Pack 3 x86
Running in: Normal Mode Internet Access Detected
==== Deleting CLSID Registry Keys ======================
==== Deleting CLSID Registry Values ======================
==== Deleting Files \ Folders ======================
"C:\RECYCLER\S-1-5-18\$a17411a924d85ec26b63392b0c9b1d29" not found
"\CONFIG.SYS" deleted
"\IO.SYS" deleted
"\MSDOS.SYS" deleted
"\pagefile.sys" not deleted
"C:\RECYCLER\S-1-5-21-4167658315-3026997754-3479370961-1007\$a17411a924d85ec26b63392b0c9b1d29\@" deleted
"C:\RECYCLER\S-1-5-21-4167658315-3026997754-3479370961-1007\$a17411a924d85ec26b63392b0c9b1d29\U\00000001.@" deleted
"C:\RECYCLER\S-1-5-21-4167658315-3026997754-3479370961-1007\$a17411a924d85ec26b63392b0c9b1d29\U\80000000.@" deleted
"C:\RECYCLER\S-1-5-21-4167658315-3026997754-3479370961-1007\$a17411a924d85ec26b63392b0c9b1d29\U\800000cb.@" deleted
"C:\RECYCLER\S-1-5-21-4167658315-3026997754-3479370961-1007\$a17411a924d85ec26b63392b0c9b1d29" deleted
"C:\RECYCLER\S-1-5-21-4167658315-3026997754-3479370961-1007\$a17411a924d85ec26b63392b0c9b1d29\L" deleted
"C:\RECYCLER\S-1-5-21-4167658315-3026997754-3479370961-1007\$a17411a924d85ec26b63392b0c9b1d29\U" deleted
==== Registry Search Results for "$a17411a924d85ec26b63392b0c9b1d29" ======================
[HKEY_USERS\S-1-5-21-4167658315-3026997754-3479370961-1007\Software\Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32]
@="C:\\RECYCLER\\S-1-5-21-4167658315-3026997754-3479370961-1007\\$a17411a924d85ec26b63392b0c9b1d29\\n."
[HKEY_USERS\S-1-5-21-4167658315-3026997754-3479370961-1007_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32]
@="C:\\RECYCLER\\S-1-5-21-4167658315-3026997754-3479370961-1007\\$a17411a924d85ec26b63392b0c9b1d29\\n."
==== Files Recently Created / Modified ======================
====== C:\WINDOWS ====
====== C:\DOKUME~1\Admin\LOKALE~1\Temp ====
2013-05-02 20:49:08 C90FFA4142A3E94EEC74FE8EB26BF794 44853328 ----a-w- C:\DOKUME~1\Admin\LOKALE~1\Temp\SHSetup.exe
====== C:\WINDOWS\system32 =====
====== C:\WINDOWS\system32\drivers =====
====== C:\WINDOWS\Tasks ======
====== C:\WINDOWS\Temp ======
======= C:\Programme =====
2013-05-02 20:50:19 -------- d-----w- C:\Programme\Enigma Software Group
2013-05-02 20:49:40 -------- d-----w- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
======= =====
====== ======
====== C:\Dokumente und Einstellungen\Admin ======
2013-05-04 18:45:58 D41D8CD98F00B204E9800998ECF8427E 0 ----a-w- C:\Dokumente und Einstellungen\Tobias\defogger_reenable
====== C: exe-files ==
2013-05-04 19:26:07 60BF4AE8CC40B0E3E28613657ED2EED8 377856 ----a-w- C:\Dokumente und Einstellungen\Tobias\Desktop\hilfe\gmer_2.1.19163.exe
2013-05-04 18:57:48 4ADCFEE16EE9978F06157634669D36FB 602112 ----a-w- C:\Dokumente und Einstellungen\Tobias\Desktop\hilfe\OTL.exe
2013-05-04 18:45:16 9146F21288AB749C4C729343F5F285A1 50477 ----a-w- C:\Dokumente und Einstellungen\Tobias\Desktop\hilfe\Defogger.exe
2013-05-02 20:50:29 36B98B8197E1BE8E7382D29C1A3628AA 110080 ----a-r- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Microsoft\Installer\{0AC0F1B2-61C7-4B6E-ACEF-58FCC0B94835}\IconF7A21AF7.exe
2013-05-02 20:50:29 36B98B8197E1BE8E7382D29C1A3628AA 110080 ----a-r- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Microsoft\Installer\{0AC0F1B2-61C7-4B6E-ACEF-58FCC0B94835}\IconD7F16134.exe
2013-05-02 20:50:29 36B98B8197E1BE8E7382D29C1A3628AA 110080 ----a-r- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Microsoft\Installer\{0AC0F1B2-61C7-4B6E-ACEF-58FCC0B94835}\IconCF33A0CE.exe
2013-05-02 20:49:49 3EA9770BD2DC4F270E00AEDA2B6D640E 180902 ----a-w- C:\WINDOWS\0AC0F1B261C74B6EACEF58FCC0B94835.TMP\WiseCustomCalla22.exe
2013-05-02 20:49:08 C90FFA4142A3E94EEC74FE8EB26BF794 44853328 ----a-w- C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Temp\SHSetup.exe
2013-05-02 20:47:17 EEA0B34B60632083F2A75352BAE365FB 726464 ----a-w- C:\RECYCLER\S-1-5-21-4167658315-3026997754-3479370961-1007\Dc43.exe
2013-05-02 20:47:03 EEA0B34B60632083F2A75352BAE365FB 726464 ----a-w- C:\Dokumente und Einstellungen\Tobias\Lokale Einstellungen\Temporary Internet Files\Content.IE5\NBZWC86F\SpyHunter-Installer[1].exe
2013-05-01 22:58:35 0BD0931ECE63833B83EE59C0D1FFE249 30730331 ----a-w- C:\Dokumente und Einstellungen\Tobias\Eigene Dateien\Dropbox\Vereinsverwaltung\vhu_verein\vhu_verein.exe
2013-05-01 22:57:34 084FEE5B5D8C3BD6271168A5078284A8 380928 ----a-w- C:\Dokumente und Einstellungen\Tobias\Eigene Dateien\Dropbox\Vereinsverwaltung\vhu_verein\llview9.exe
2013-05-01 22:56:59 D5D25B7249B962BBD7D03B1C91D57106 73728 ----a-w- C:\Dokumente und Einstellungen\Tobias\Eigene Dateien\Dropbox\Vereinsverwaltung\vhu_verein\foxhhelp9.exe
=== C: other files ==
2013-05-04 19:27:34 5D1EDDE6A0D29AE347CB667D820BD165 103680 ----a-w- C:\Dokumente und Einstellungen\Tobias\Lokale Einstellungen\Temp\uxldqpog.sys
2013-05-02 20:50:40 E0E7672DBE3AF879971DAA6F1ECA6333 6320000 ----a-w- C:\Programme\Enigma Software Group\SpyHunter\SH4.com
2013-05-01 22:58:05 515AF3EC022F18AC4450EF84D5E4770F 5068213 ----a-w- C:\Dokumente und Einstellungen\Tobias\Eigene Dateien\Dropbox\Vereinsverwaltung\vhu_verein\cmll17cv.crx
==== Startup Registry Enabled ======================
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE"
[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE"
[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE"
[HKEY_USERS\S-1-5-21-4167658315-3026997754-3479370961-1006\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe"
"Eee Docking"="C:\Programme\ASUS\Eee Docking\Eee Docking.exe"
"TomTomHOME.exe"="C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe"
[HKEY_USERS\S-1-5-21-4167658315-3026997754-3479370961-1007\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe"
"Eee Docking"="C:\Programme\ASUS\Eee Docking\Eee Docking.exe"
"TomTomHOME.exe"="C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe -s"
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe"
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe"
"Persistence"="C:\WINDOWS\system32\igfxpers.exe"
"RTHDCPL"="RTHDCPL.EXE"
"AsusACPIServer"="C:\Programme\EeePC\ACPI\AsAcpiSvr.exe"
"AsusEPCMonitor"="C:\Programme\EeePC\ACPI\AsEPCMon.exe"
"AsusTray"="C:\Programme\EeePC\ACPI\AsTray.exe"
"SynTPEnh"="C:\Programme\Synaptics\SynTP\SynTPEnh.exe"
"SynAsusAcpi"="C:\Programme\Synaptics\SynTP\SynAsusAcpi.exe"
"FreePDF Assistant"="C:\Programme\FreePDF_XP\fpassist.exe"
"HP Software Update"="C:\Programme\HP\HP Software Update\HPWuSchd2.exe"
"APSDaemon"="C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe"
"iTunesHelper"="D:\Programme\iTunes\iTunesHelper.exe"
"SunJavaUpdateSched"="C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"
"avgnt"="C:\Programme\Avira\AntiVir Desktop\avgnt.exe /min"
"SpyHunter Security Suite"="C:\Programme\Enigma Software Group\SpyHunter\SpyHunter4.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe"
"Eee Docking"="C:\Programme\ASUS\Eee Docking\Eee Docking.exe"
"TomTomHOME.exe"="C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe"
==== Startup Registry Disabled ======================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Adobe Reader Speed Launcher]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Reader_sl"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Adobe\\Reader 8.0\\Reader\\Reader_sl.exe\""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\MsnMsgr]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="MsnMsgr"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Windows Live\\Messenger\\MsnMsgr.Exe\" /background"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SRS Premium Sound]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SRSPremiumSoundBig_Small"
"hkey"="HKCU"
"command"="\"C:\\Programme\\SRS Labs\\SRS Premium Sound\\SRSPremiumSoundBig_Small.exe\" /hideme"
==== Startup Folders ======================
==== Task Scheduler Jobs ======================
C:\WINDOWS\tasks\AppleSoftwareUpdate.job --a------ C:\Programme\Apple Software Update\SoftwareUpdate.exe [01.06.2011 18:57]
C:\WINDOWS\tasks\User_Feed_Synchronization-{071DEAAD-FE5F-41A5-9BDD-665C7803EC52}.job --ah----- C:\WINDOWS\system32\msfeedssync.exe [08.03.2009 04:31]
C:\WINDOWS\tasks\User_Feed_Synchronization-{185E1BA6-B135-4F0E-A15E-7B63732A0150}.job --ah----- C:\WINDOWS\system32\msfeedssync.exe [08.03.2009 04:31]
==== Set IE to Default ======================
Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://eeepc.asus.com/global"
New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://eeepc.asus.com/global"
==== All HKCU SearchScopes ======================
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{D7B71719-6A6A-4F1B-A6F9-BB561D80F3E4}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"
{D7B71719-6A6A-4F1B-A6F9-BB561D80F3E4} Google Url="hxxp://www.google.de/search?q={searchTerms}"
==== Deleting CLSID Registry Keys ======================
HKEY_USERS\S-1-5-21-4167658315-3026997754-3479370961-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully
HKEY_USERS\S-1-5-21-4167658315-3026997754-3479370961-1007\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully
HKEY_USERS\S-1-5-21-4167658315-3026997754-3479370961-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully
HKEY_USERS\S-1-5-21-4167658315-3026997754-3479370961-1007\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4efb-9B51-7695ECA05670} deleted successfully
HKEY_USERS\S-1-5-21-4167658315-3026997754-3479370961-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4efb-9B51-7695ECA05670} deleted successfully
HKEY_USERS\S-1-5-21-4167658315-3026997754-3479370961-1007\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4efb-9B51-7695ECA05670} deleted successfully
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4efb-9B51-7695ECA05670} deleted successfully
HKEY_USERS\S-1-5-21-4167658315-3026997754-3479370961-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4efb-9B51-7695ECA05670} deleted successfully
HKEY_USERS\S-1-5-21-4167658315-3026997754-3479370961-1007\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4efb-9B51-7695ECA05670} deleted successfully
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} deleted successfully
HKEY_USERS\S-1-5-21-4167658315-3026997754-3479370961-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} deleted successfully
HKEY_USERS\S-1-5-21-4167658315-3026997754-3479370961-1007\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} deleted successfully
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} deleted successfully
HKEY_USERS\S-1-5-21-4167658315-3026997754-3479370961-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} deleted successfully
HKEY_USERS\S-1-5-21-4167658315-3026997754-3479370961-1007\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully
HKEY_CLASSES_ROOT\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4efb-9B51-7695ECA05670} deleted successfully
HKEY_CLASSES_ROOT\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670} deleted successfully
HKEY_CLASSES_ROOT\CLSID\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} deleted successfully
==== Deleting CLSID Registry Values ======================
HKEY_USERS\S-1-5-21-4167658315-3026997754-3479370961-1006\Software\Microsoft\Internet Explorer\URLSearchHooks\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully
==== Empty IE Cache ======================
C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Temporary Internet Files\Content.IE5 emptied successfully
C:\Dokumente und Einstellungen\Default User\Lokale Einstellungen\Temporary Internet Files\Content.IE5 emptied successfully
C:\Dokumente und Einstellungen\NetworkService\Lokale Einstellungen\Temporary Internet Files\Content.IE5 emptied successfully
C:\Dokumente und Einstellungen\Tobias\Lokale Einstellungen\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5 emptied successfully
C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Dokumente und Einstellungen\Tobias\Lokale Einstellungen\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
==== Empty FireFox Cache ======================
No FireFox Profiles found
==== Empty Chrome Cache ======================
No Chrome User Data found
==== Empty All Flash Cache ======================
No Flash Cache Found
==== Empty All Java Cache ======================
Java Cache cleared successfully
|
|
05.05.2013, 21:00
| #4 |
| /// Malwareteam / Visitor | Trojaner TR/Sirefef.BC.57, TR/Sirefef.AG.9, TR/ATRAPS.Gen2, TR/Necurs.A.71 und SpyHunter 4 auf Rechner Downloade Dir bitte  Malwarebytes Anti-Malware
Erzahle mir ob Du noch einige Probleme merkst? |
|
05.05.2013, 22:19
| #5 |
| | Trojaner TR/Sirefef.BC.57, TR/Sirefef.AG.9, TR/ATRAPS.Gen2, TR/Necurs.A.71 und SpyHunter 4 auf Rechner Hallo, habe Anti-Malware (Quick-Scan) drüber laufen lassen und 1 Datei entfernt. Hatte bereits vorher keine Meldungen von Antivir mehr über Trojanerfunde. Habe deshalb mal unter Quarantäne geguckt und die dort gefunden. Soll ich die in Antivir entfernen??? Ausserdem habe ich noch SpyHunter, welches ich nicht deinstalliert bekomme. Hier der Logfile von Anti-Malware: Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.05.05.05 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 Admin :: NETBOOK [Administrator] Schutz: Aktiviert 05.05.2013 22:38:25 mbam-log-2013-05-05 (22-38-25).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 255427 Laufzeit: 17 Minute(n), 9 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 1 HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bösartig: (1) Gut: (0) -> Erfolgreich ersetzt und in Quarantäne gestellt. Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) |
|
05.05.2013, 22:43
| #6 | |
| /// Malwareteam / Visitor | Trojaner TR/Sirefef.BC.57, TR/Sirefef.AG.9, TR/ATRAPS.Gen2, TR/Necurs.A.71 und SpyHunter 4 auf Rechner Mal sehen ob wir Spyhunter rauskriegen.
Zitat:
|
|
06.05.2013, 22:22
| #7 |
| | Trojaner TR/Sirefef.BC.57, TR/Sirefef.AG.9, TR/ATRAPS.Gen2, TR/Necurs.A.71 und SpyHunter 4 auf RechnerCode:
ATTFilter Zoek.exe Version 4.0.0.2 Updated 06-May-2013
Tool run by Admin on 06.05.2013 at 23:15:37,09.
Microsoft Windows XP Home Edition 5.1.2600 Service Pack 3 x86
Running in: Normal Mode Internet Access Detected
==== Older Logs ======================
C:\zoek-results06.05.2013-2314.log 15991 bytes
==== Deleting Services ======================
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EsgScanner deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\EsgScanner deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\esgiguard deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\esgiguard deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SpyHunter 4 Service deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SpyHunter 4 Service deleted successfully
==== Registry Fix Code ======================
Windows Registry Editor Version 5.00
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0AC0F1B2-61C7-4B6E-ACEF-58FCC0B94835}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpyHunter Security Suite"=-
==== Batch Command(s) Run By Tool======================
==== Deleting Files \ Folders ======================
"C:\Programme\Enigma Software Group" deleted
|
|
07.05.2013, 06:23
| #8 |
| /// Malwareteam / Visitor | Trojaner TR/Sirefef.BC.57, TR/Sirefef.AG.9, TR/ATRAPS.Gen2, TR/Necurs.A.71 und SpyHunter 4 auf Rechner Meine meinung nach ist SpyHunter jetzt futsch? Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Downloade Dir bitte  SecurityCheck und:
|
|
| Themen zu Trojaner TR/Sirefef.BC.57, TR/Sirefef.AG.9, TR/ATRAPS.Gen2, TR/Necurs.A.71 und SpyHunter 4 auf Rechner |
| 32 bit, antivir, avira, bho, bonjour, desktop, enigma, error, esgscanner.sys, excel, firefox, flash player, helper, home, homepage, iexplore.exe, installation, logfile, löschen?, malware, plug-in, realtek, registry, rundll, scan, security, senden, software, super, system, trojaner, visual studio, windows internet |
