| |
| |||||||
Log-Analyse und Auswertung: Malware in e-Mail ZIPWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
19.06.2013, 01:48
| #1 |
 |  Malware in e-Mail ZIP Hallo, ich habe etwas Dummes gemacht. Ich habe eine e-Mail von einer "Inkasso-Firma" erhalten mit einer Mahnung über eine recht hohe Geldsumme. Da ich dachte, es handele sich um eine Sache, die ich für abgeschlossen hielt (eine Inkasso-Angelegenheit), und weil ich in der Mail mit meinem richtigen Namen angesprochen wurde, habe ich den ZIP-Anhang geöffnet. Darin war wieder ein ZIP-Ordner. Als ich diesen öffnete, kam sofort die Warnung von Avira, den Zugriff zu verweigern oder in die Quarantäne zu verschieben. Habe ich gemacht und die Zip-Ordner und die Trojaner-Datei gelöscht. Mozilla arbeitete dann anders. Unter web.de poppten plötzlich Werbefenster auf. Das Wichtigste: im Task-manager war zu sehen, dass ein Prozess namens PEVZ.EXE lief. Als ich über diesen nachforschte, kam mir die Panik. Ich hoffe, Ihr könnt mir helfen; ich schäme mich richtig  Hier die log von OTL: Code:
ATTFilter OTL logfile created on: 19.06.2013 02:03:43 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\knightkrawler\Desktop Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.10.9200.16614) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,97 Gb Total Physical Memory | 1,94 Gb Available Physical Memory | 65,47% Memory free 5,93 Gb Paging File | 4,75 Gb Available in Paging File | 80,09% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 454,56 Gb Total Space | 342,77 Gb Free Space | 75,41% Space Free | Partition Type: NTFS Drive D: | 11,20 Gb Total Space | 1,32 Gb Free Space | 11,75% Space Free | Partition Type: NTFS Drive F: | 3,69 Gb Total Space | 3,68 Gb Free Space | 100,00% Space Free | Partition Type: FAT32 Computer Name: XI | User Name: knightkrawler | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.06.19 02:01:37 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\knightkrawler\Desktop\OTL.exe PRC - [2013.05.16 10:59:00 | 003,830,224 | ---- | M] (Safer-Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy 2\SDTray.exe PRC - [2013.05.16 10:56:34 | 001,033,688 | ---- | M] (Safer-Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy 2\SDUpdSvc.exe PRC - [2013.05.16 10:56:30 | 001,817,560 | ---- | M] (Safer-Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy 2\SDFSSvc.exe PRC - [2013.05.15 13:21:32 | 000,171,928 | ---- | M] (Safer-Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy 2\SDWSCSvc.exe PRC - [2013.05.11 12:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2013.01.09 18:36:06 | 000,795,208 | ---- | M] (pdfforge GbR) -- C:\Programme\PDF Architect\ConversionService.exe PRC - [2013.01.09 18:34:26 | 001,324,104 | ---- | M] (pdfforge GbR) -- C:\Programme\PDF Architect\HelperService.exe PRC - [2012.11.23 04:48:41 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe PRC - [2012.10.04 16:57:58 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe PRC - [2012.08.12 20:28:02 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2012.07.13 16:27:00 | 000,769,432 | ---- | M] (Nero AG) -- C:\Programme\Nero\Update\NASvc.exe PRC - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2012.04.24 02:11:55 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2011.01.17 19:50:34 | 011,322,880 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 3\program\soffice.exe PRC - [2011.01.17 19:50:34 | 011,314,688 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 3\program\soffice.bin PRC - [2010.11.20 23:29:49 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe PRC - [2010.11.20 23:29:20 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe ========== Modules (No Company Name) ========== MOD - [2013.05.30 17:48:31 | 000,304,976 | ---- | M] () -- C:\Users\knightkrawler\AppData\Roaming\ICQM\ICQ\dll\mramenu.dll MOD - [2013.05.16 10:55:28 | 000,161,112 | ---- | M] () -- C:\Programme\Spybot - Search & Destroy 2\snlFileFormats150.bpl MOD - [2013.05.16 10:55:26 | 000,113,496 | ---- | M] () -- C:\Programme\Spybot - Search & Destroy 2\snlThirdParty150.bpl MOD - [2013.05.16 10:55:24 | 000,416,600 | ---- | M] () -- C:\Programme\Spybot - Search & Destroy 2\DEC150.bpl MOD - [2013.05.12 00:26:24 | 003,128,728 | ---- | M] () -- C:\Programme\Mozilla Firefox\mozjs.dll MOD - [2012.02.26 19:52:14 | 000,985,088 | ---- | M] () -- C:\Programme\OpenOffice.org 3\program\libxml2.dll MOD - [2012.02.17 21:55:35 | 000,166,912 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll MOD - [2011.03.04 12:02:54 | 007,745,536 | ---- | M] () -- C:\Programme\Common Files\LightScribe\QtGui4.dll MOD - [2011.03.04 12:02:52 | 000,135,168 | ---- | M] () -- C:\Programme\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll MOD - [2011.03.04 12:02:50 | 002,121,728 | ---- | M] () -- C:\Programme\Common Files\LightScribe\QtCore4.dll ========== Services (SafeList) ========== SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SDWSCService) SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SDUpdateService) SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SDScannerService) SRV - [2013.05.12 00:26:17 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2013.05.11 12:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2013.01.09 18:36:06 | 000,795,208 | ---- | M] (pdfforge GbR) [Auto | Running] -- C:\Programme\PDF Architect\ConversionService.exe -- (PDF Architect Service) SRV - [2013.01.09 18:34:26 | 001,324,104 | ---- | M] (pdfforge GbR) [Auto | Running] -- C:\Programme\PDF Architect\HelperService.exe -- (PDF Architect Helper Service) SRV - [2012.08.01 21:40:13 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc) SRV - [2012.07.13 16:27:00 | 000,769,432 | ---- | M] (Nero AG) [Auto | Running] -- C:\Programme\Nero\Update\NASvc.exe -- (NAUpdate) SRV - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2010.11.20 23:29:49 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc) SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\rdvgkmd.sys -- (VGPU) DRV - [2012.04.27 10:20:04 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2012.04.25 00:32:27 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2012.04.16 21:17:40 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr) DRV - [2010.11.20 23:29:34 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV - [2010.11.20 23:29:24 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV - [2010.11.20 23:29:03 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus) DRV - [2010.11.20 23:29:03 | 000,112,640 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tsusbhub.sys -- (tsusbhub) DRV - [2010.11.20 23:29:03 | 000,077,184 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Synth3dVsc.sys -- (Synth3dVsc) DRV - [2010.11.20 23:29:03 | 000,062,464 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\dmvsc.sys -- (dmvsc) DRV - [2010.11.20 23:29:03 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt) DRV - [2010.11.20 23:29:03 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb) DRV - [2010.11.20 23:29:03 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc) DRV - [2010.11.20 23:29:03 | 000,027,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbGD.sys -- (TsUsbGD) DRV - [2010.11.20 23:29:03 | 000,025,600 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\terminpt.sys -- (terminpt) DRV - [2010.11.20 23:29:03 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID) DRV - [2010.11.20 23:29:03 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap) DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2010.01.13 17:36:40 | 006,755,840 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5s32.sys -- (NETw5s32) DRV - [2009.10.03 07:02:06 | 009,905,096 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2009.07.14 01:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp) DRV - [2009.07.14 00:02:51 | 004,231,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\netw5v32.sys -- (netw5v32) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 1F DA A0 29 4A E3 CC 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = localhost:21320 ========== FireFox ========== FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "en.wikipedia.org" FF - prefs.js..extensions.enabledAddons: %7Bb6f3913d-d2e8-480c-9aca-c41d3d4c1db3%7D:1.0.1.0 FF - prefs.js..extensions.enabledAddons: %7B0545b830-f0aa-4d7e-8820-50a4629a56fe%7D:18.8 FF - prefs.js..extensions.enabledAddons: printedit%40DW-dev:9.3 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.13.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@Nero.com/KM: C:\PROGRA~1\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\FFPDFArchitectConverter@pdfarchitect.com: C:\Program Files\PDF Architect\FFPDFArchitectExt [2013.02.16 17:45:41 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.06.17 23:52:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\knightkrawler\AppData\Roaming\mozilla\Extensions [2013.06.18 23:56:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\knightkrawler\AppData\Roaming\mozilla\Firefox\Profiles\uyw1a5vb.default\extensions [2013.06.18 23:56:51 | 000,000,000 | ---D | M] ("ColorfulTabs") -- C:\Users\knightkrawler\AppData\Roaming\mozilla\Firefox\Profiles\uyw1a5vb.default\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe} [2013.06.18 00:10:11 | 000,000,000 | ---D | M] (FT DeepDark) -- C:\Users\knightkrawler\AppData\Roaming\mozilla\Firefox\Profiles\uyw1a5vb.default\extensions\{77d2ed30-4cd2-11e0-b8af-0800200c9a66} [2013.06.18 23:56:51 | 000,092,735 | ---- | M] () (No name found) -- C:\Users\knightkrawler\AppData\Roaming\mozilla\firefox\profiles\uyw1a5vb.default\extensions\printedit@DW-dev.xpi [2013.06.18 23:49:51 | 000,194,628 | ---- | M] () (No name found) -- C:\Users\knightkrawler\AppData\Roaming\mozilla\firefox\profiles\uyw1a5vb.default\extensions\UIEnhancer@girishsharma.xpi [2013.06.18 23:56:51 | 000,089,408 | ---- | M] () (No name found) -- C:\Users\knightkrawler\AppData\Roaming\mozilla\firefox\profiles\uyw1a5vb.default\extensions\{b6f3913d-d2e8-480c-9aca-c41d3d4c1db3}.xpi [2013.06.18 23:14:22 | 000,001,272 | ---- | M] () -- C:\Users\knightkrawler\AppData\Roaming\mozilla\firefox\profiles\uyw1a5vb.default\searchplugins\wikipedia-en-ssl.xml [2013.05.24 19:05:18 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\browser\extensions [2013.06.17 23:51:40 | 000,000,000 | ---D | M] (Default) -- C:\Programme\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} O1 HOSTS File: ([2013.06.18 21:27:57 | 000,447,822 | R--- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 127.0.0.1 1-2005-search.com O1 - Hosts: 127.0.0.1 123fporn.info O1 - Hosts: 15376 more lines... O2 - BHO: (PDF Architect Helper) - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Programme\PDF Architect\PDFIEHelper.dll (pdfforge GbR) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [SDTray] C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - Startup: C:\Users\knightkrawler\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1 O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_13-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0017-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_13-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_13-windows-i586.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2582B6D1-196C-4ED0-B19E-8CE815261A3D}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4F286681-1643-4D1B-8F60-A8327BBA065B}: DhcpNameServer = 192.168.1.254 O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - Winlogon\Notify\SDWinLogon: DllName - (SDWinLogon.dll) - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.06.19 02:01:34 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\knightkrawler\Desktop\OTL.exe [2013.06.19 01:30:55 | 000,000,000 | ---D | C] -- C:\Users\knightkrawler\AppData\Roaming\Malwarebytes [2013.06.19 01:30:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2013.06.19 01:30:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2013.06.19 01:30:37 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2013.06.19 01:30:37 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2013.06.19 01:20:57 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe [2013.06.19 01:20:57 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe [2013.06.19 01:20:40 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2013.06.19 00:32:42 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN [2013.06.19 00:30:55 | 000,000,000 | ---D | C] -- C:\Windows\Temp [2013.06.19 00:30:55 | 000,000,000 | ---D | C] -- C:\Users\knightkrawler\AppData\Local\Temp [2013.06.18 21:14:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy [2013.06.18 21:14:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2 [2013.06.18 21:14:33 | 000,015,224 | ---- | C] (Safer Networking Limited) -- C:\Windows\System32\sdnclean.exe [2013.06.18 21:14:28 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy 2 [2013.06.17 23:53:02 | 000,000,000 | ---D | C] -- C:\Users\knightkrawler\Desktop\Neue Downloads [2013.06.17 23:51:40 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service [2013.06.17 23:05:44 | 000,000,000 | ---D | C] -- C:\Windows\System32\appmgmt [2013.06.14 13:16:57 | 000,000,000 | ---D | C] -- C:\Program Files\MSXML 4.0 [2013.06.12 21:01:51 | 000,000,000 | ---D | C] -- C:\Users\knightkrawler\Desktop\Nero [2013.06.12 20:55:25 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Nero [2013.06.12 20:55:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero [2013.06.12 20:55:13 | 000,000,000 | ---D | C] -- C:\Program Files\Nero [2013.06.12 20:54:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Nero [2013.06.12 20:52:21 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LightScribe Direct Disc Labeling [2013.06.12 20:52:21 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\LightScribe [2013.06.12 20:49:48 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET [2013.05.30 22:08:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDisplay [2013.05.30 22:08:49 | 000,000,000 | ---D | C] -- C:\Program Files\CDisplay [2013.05.30 17:48:22 | 000,000,000 | ---D | C] -- C:\Users\knightkrawler\AppData\Roaming\ICQM [2013.05.30 17:48:19 | 000,000,000 | ---D | C] -- C:\Users\knightkrawler\AppData\Roaming\ICQ-Profile [2013.05.24 19:05:12 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox ========== Files - Modified Within 30 Days ========== [2013.06.19 02:01:37 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\knightkrawler\Desktop\OTL.exe [2013.06.19 02:00:13 | 000,000,000 | ---- | M] () -- C:\Users\knightkrawler\defogger_reenable [2013.06.19 01:58:44 | 000,050,477 | ---- | M] () -- C:\Users\knightkrawler\Desktop\Defogger.exe [2013.06.19 01:47:25 | 001,271,997 | ---- | M] () -- C:\Users\knightkrawler\Desktop\zoek.exe [2013.06.19 01:21:18 | 000,001,989 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader XI.lnk [2013.06.19 01:14:37 | 000,020,496 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.06.19 01:14:37 | 000,020,496 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.06.19 01:14:29 | 000,654,166 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2013.06.19 01:14:29 | 000,616,008 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2013.06.19 01:14:29 | 000,130,006 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2013.06.19 01:14:29 | 000,106,388 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2013.06.19 01:06:50 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.06.19 01:06:44 | 2389,929,984 | -HS- | M] () -- C:\hiberfil.sys [2013.06.18 21:27:57 | 000,447,822 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts ========== Files Created - No Company Name ========== [2013.06.19 02:00:13 | 000,000,000 | ---- | C] () -- C:\Users\knightkrawler\defogger_reenable [2013.06.19 01:58:43 | 000,050,477 | ---- | C] () -- C:\Users\knightkrawler\Desktop\Defogger.exe [2013.06.19 01:47:21 | 001,271,997 | ---- | C] () -- C:\Users\knightkrawler\Desktop\zoek.exe [2013.06.19 01:21:18 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk [2013.06.19 01:21:18 | 000,001,989 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader XI.lnk [2013.06.18 21:14:37 | 000,002,131 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk [2013.06.17 23:51:44 | 000,001,117 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2012.08.08 19:04:13 | 000,081,408 | ---- | C] () -- C:\Windows\cadkasdeinst01.exe [2012.07.04 18:20:04 | 000,000,856 | ---- | C] () -- C:\Users\knightkrawler\AppData\Local\recently-used.xbel ========== ZeroAccess Check ========== [2009.07.14 06:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 23:29:20 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 03:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2012.08.08 19:04:27 | 000,000,000 | ---D | M] -- C:\Users\knightkrawler\AppData\Roaming\CAD-KAS [2013.05.30 17:52:38 | 000,000,000 | ---D | M] -- C:\Users\knightkrawler\AppData\Roaming\ICQ-Profile [2013.06.02 15:00:38 | 000,000,000 | ---D | M] -- C:\Users\knightkrawler\AppData\Roaming\ICQM [2013.06.17 23:09:39 | 000,000,000 | ---D | M] -- C:\Users\knightkrawler\AppData\Roaming\IrfanView [2012.02.26 19:52:45 | 000,000,000 | ---D | M] -- C:\Users\knightkrawler\AppData\Roaming\OpenOffice.org [2012.12.13 22:55:03 | 000,000,000 | ---D | M] -- C:\Users\knightkrawler\AppData\Roaming\Origin [2013.02.16 17:48:45 | 000,000,000 | ---D | M] -- C:\Users\knightkrawler\AppData\Roaming\PDF Architect [2013.02.20 08:48:08 | 000,000,000 | ---D | M] -- C:\Users\knightkrawler\AppData\Roaming\Scribus ========== Purity Check ========== < End of report > Code:
ATTFilter OTL Extras logfile created on: 19.06.2013 02:03:43 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\knightkrawler\Desktop
Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16614)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,97 Gb Total Physical Memory | 1,94 Gb Available Physical Memory | 65,47% Memory free
5,93 Gb Paging File | 4,75 Gb Available in Paging File | 80,09% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 454,56 Gb Total Space | 342,77 Gb Free Space | 75,41% Space Free | Partition Type: NTFS
Drive D: | 11,20 Gb Total Space | 1,32 Gb Free Space | 11,75% Space Free | Partition Type: NTFS
Drive F: | 3,69 Gb Total Space | 3,68 Gb Free Space | 100,00% Space Free | Partition Type: FAT32
Computer Name: XI | User Name: knightkrawler | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon -- (Safer-Networking Ltd.)
"C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D 2 Scanner Service -- (Safer-Networking Ltd.)
"C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater -- (Safer-Networking Ltd.)
"C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service -- (Safer-Networking Ltd.)
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{19D41BFC-19E6-40F5-BCC3-42971F5BCCC7}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{283AAC8A-A1A7-4AF8-8962-5F959C37EF30}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{346F8B5E-0CEE-4994-8913-5E9CFBD34BA7}" = rport=10243 | protocol=6 | dir=out | app=system |
"{34EEB7CD-E378-4367-A901-D1E07568BA5F}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{4DB7F1FF-EE28-4CBD-BADA-A5A80AD3FB99}" = rport=137 | protocol=17 | dir=out | app=system |
"{595C81B3-FFB8-401A-94A9-2E949FBC983D}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{6BA27C9C-C4B6-427F-B056-E8B3403BC80F}" = lport=2869 | protocol=6 | dir=in | app=system |
"{8050A0C7-ECDA-41A4-9AF6-F40F488035CA}" = rport=139 | protocol=6 | dir=out | app=system |
"{81153A0A-2E01-4243-9BE1-F4C47AFC00BD}" = lport=138 | protocol=17 | dir=in | app=system |
"{8F43F58B-3B50-449C-9EAB-A8A41A8C7D87}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{947AE6E2-EF6F-4D01-9492-9992F608978D}" = lport=137 | protocol=17 | dir=in | app=system |
"{95515D6E-4426-4776-950D-07FD315BF7C1}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{96597789-A638-4430-819F-822F1E2C3363}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{9C403967-9FA6-4068-8D7E-36F448501839}" = rport=138 | protocol=17 | dir=out | app=system |
"{A13B64A8-B2F9-4B21-A286-2BB8CBDF2B3F}" = lport=10243 | protocol=6 | dir=in | app=system |
"{AFFF9B03-3E0C-4612-99FF-01633E2F933C}" = lport=139 | protocol=6 | dir=in | app=system |
"{BFEAC1C9-C7BB-408D-9074-2EF3B6E94D51}" = rport=445 | protocol=6 | dir=out | app=system |
"{C06C0447-B198-4153-872B-021DAB3DA71C}" = lport=445 | protocol=6 | dir=in | app=system |
"{CA4A012B-4F80-4894-A685-0163311107DC}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{EA6B7275-CD0A-4D87-84D9-67501A25FDBA}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{ED15ACDD-BB9D-4E9F-B5FF-2E40A51A9116}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{FB11FF80-E22F-4F7E-95A3-1800C1A8445F}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{FE271103-8DA0-4A00-AEEA-1121CF01D6CF}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01A84D50-E71D-4596-B370-5589B065AC33}" = protocol=6 | dir=in | app=c:\users\knightkrawler\appdata\roaming\icqm\icq.exe |
"{1AB753F9-356C-443A-AC53-873D389BC6C2}" = protocol=6 | dir=in | app=c:\program files\hp\hp deskjet 2050 j510 series\bin\usbsetup.exe |
"{33DB16B3-73CD-4ED6-AEDD-3E0DBE4DF744}" = protocol=6 | dir=out | app=system |
"{3AFA43CE-B656-469F-8343-D38516BDC382}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{3CA5DC94-513E-465C-B795-3770BF4E573E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{3FAF8C89-EDB7-43CD-AECF-D6431D42075C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{4404B062-D4D8-4083-9F12-0C0C95A260FD}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{45A101A4-B712-4B66-9A9B-5F7C7F52B9A6}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{49B8E852-4136-4A0C-94A2-126883542FFF}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{72566F4C-989C-4BC3-A4B1-991005D4B633}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{8294AB71-6D8E-43F1-B13F-FC6FB46A72F1}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{84A2A199-AEA1-4DBC-AB8C-EDBE4FD19B03}" = protocol=17 | dir=in | app=c:\users\knightkrawler\appdata\roaming\icqm\icq.exe |
"{9D073A79-A6CA-4129-885A-6BAFAB51A87E}" = protocol=6 | dir=in | app=c:\program files\nero\km\kwikmedia.exe |
"{9D5770AE-E928-4AA1-AEE9-E94A5E19228A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{AEC86AA9-CD0B-418D-892A-6368A00C1CDC}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{BF465E6B-B51C-4322-B084-D82D077B4AA7}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{C0FBF5FD-D5ED-468E-9E88-56710EDDBA84}" = protocol=17 | dir=in | app=c:\program files\hp\hp deskjet 2050 j510 series\bin\usbsetup.exe |
"{C3951B8B-A7C3-407F-94C2-DF17758A6D82}" = protocol=17 | dir=in | app=c:\program files\nero\km\kwikmedia.exe |
"{C836212B-F567-4FE3-9579-334537410505}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{DAA80308-D151-4C27-8982-AF238E32F96A}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{E3BD4E40-1D4E-4387-8C0D-741621DE36FF}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{EAE60058-4FEB-4353-8B48-C0349FEAACEC}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{F077D587-1770-4581-8B80-14911812210B}" = protocol=17 | dir=in | app=c:\program files\nero\nero 12\nero backitup\backitup.exe |
"{FB7A6CAC-CD55-48B2-A7AB-E6E55EAD5460}" = protocol=6 | dir=in | app=c:\program files\nero\nero 12\nero backitup\backitup.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{0071820F-09B0-4998-8320-F89629DCBC99}" = Nero BackItUp
"{052A1E34-A54B-458C-A4E3-24C3E054754A}" = Nero Kwik Media
"{0708FF30-78C0-47B0-81F0-C84604DC769C}" = Nero Express Help (CHM)
"{1001266B-D4BB-46D9-B023-2612A8CE3A31}" = Nero BurnRights
"{172E1704-82D1-4779-852E-BA1BDB237EE2}" = Nero InfoTool
"{1B6F5E51-575E-4693-BCA2-7543570D076D}" = Nero Kwik Themes Basic
"{1DEC64C1-7F34-44CD-BC35-8E0A096300CF}" = Nero12EssTSST
"{1F16820E-D0E7-4636-939E-45CBFEFB06E1}" = Nero Kwik Media Help (CHM)
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2432E589-6256-4513-B0BF-EFA8E325D5F0}" = Nero SharedVideoCodecs
"{25DE52ED-9E51-4C50-AE16-E258836ADF83}" = HP Deskjet 2050 J510 series - Grundlegende Software für das Gerät
"{3AAB08A3-F129-4BD5-B409-AE674F93759D}" = Prerequisite installer
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{4E52D627-F326-40DB-A74F-8C91BA6D88C6}" = Nero CoverDesigner
"{509B1025-7B7D-4D85-B374-5458494CBC1D}" = Nero DiscSpeed Help (CHM)
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5C320DA5-D3D3-4312-ABF8-041078AEA54E}" = Nero DiscSpeed 11
"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update
"{80A07844-CA64-4DE4-AB61-D37DDBE8074F}" = PDF Architect
"{848A7C68-0ADC-4193-8A89-2CEA78E56A0C}" = Nero Express
"{8E7EABFA-BF37-4824-B792-4220C9E04233}" = Nero BurnRights Help (CHM)
"{9C7C04AB-4B97-49DB-88A0-454795349008}" = Nero CoverDesigner Help (CHM)
"{A2FE691E-3F8E-4E30-AA7D-FF17AC77EA87}" = Nero Blu-ray Player
"{ABC88553-8770-4B97-B43E-5A90647A5B63}" = Nero ControlCenter
"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.03) - Deutsch
"{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1" = Spybot - Search & Destroy
"{BEBEE34D-84A2-4EDD-8BEA-96CC54371263}" = Nero Core Components
"{C994C746-C6D0-4EBA-B09E-DF7B18381B69}" = Nero ControlCenter Help (CHM)
"{CB299984-1104-4225-802D-6C06CD6ED2B7}" = Nero InfoTool Help (CHM)
"{E0E55FC1-C53D-4F8D-B14B-B59C312747C8}" = LightScribe System Software
"{EF0D1292-8FC1-41BE-9740-DBC134F66415}" = Nero BackItUp Help (CHM)
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Avira AntiVir Desktop" = Avira Free Antivirus
"CDisplay_is1" = CDisplay 1.8
"GIMP-2_is1" = GIMP 2.8.0
"Heroquest Card Creator" = Heroquest Card Creator
"HeroScribe" = HeroScribe 1.0pre1
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.75.0.1300
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 21.0 (x86 de)" = Mozilla Firefox 21.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIA Drivers" = NVIDIA Drivers
"WinRAR archiver" = WinRAR 4.11 (32-Bit)
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 17.06.2013 11:32:55 | Computer Name = XI | Source = WinMgmt | ID = 10
Description =
Error - 17.06.2013 16:46:00 | Computer Name = XI | Source = WinMgmt | ID = 10
Description =
Error - 17.06.2013 17:41:48 | Computer Name = XI | Source = WinMgmt | ID = 10
Description =
Error - 18.06.2013 04:18:36 | Computer Name = XI | Source = WinMgmt | ID = 10
Description =
Error - 18.06.2013 05:08:03 | Computer Name = XI | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\Nero\Nero
12\nero backitup\NBVSSTool_x64.exe". Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 18.06.2013 13:11:44 | Computer Name = XI | Source = WinMgmt | ID = 10
Description =
Error - 18.06.2013 18:32:24 | Computer Name = XI | Source = WinMgmt | ID = 10
Description =
Error - 18.06.2013 19:07:21 | Computer Name = XI | Source = WinMgmt | ID = 10
Description =
Error - 18.06.2013 19:25:22 | Computer Name = XI | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 21.0.0.4879 kann nicht mehr unter Windows
ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 6c Startzeit: 01ce6c79ca579ba0
Endzeit:
10 Anwendungspfad: C:\Program Files\Mozilla Firefox\firefox.exe Berichts-ID: 55dc097d-d86e-11e2-812b-00235a33bf83
Error - 18.06.2013 19:26:45 | Computer Name = XI | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 21.0.0.4879 kann nicht mehr unter Windows
ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 774 Startzeit:
01ce6c7b1c6fefbc Endzeit: 16 Anwendungspfad: C:\Program Files\Mozilla Firefox\firefox.exe
Berichts-ID:
883b4afd-d86e-11e2-812b-00235a33bf83
[ System Events ]
Error - 19.10.2012 16:29:34 | Computer Name = XI | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
Fehler 0x80070643 fehlgeschlagen: Definition Update for Windows Defender - KB915597
(Definition 1.139.124.0)
Error - 23.10.2012 09:47:32 | Computer Name = XI | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?23.?10.?2012 um 15:45:54 unerwartet heruntergefahren.
Error - 23.10.2012 09:47:39 | Computer Name = XI | Source = BugCheck | ID = 1001
Description =
Error - 25.10.2012 10:33:22 | Computer Name = XI | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?25.?10.?2012 um 16:31:57 unerwartet heruntergefahren.
Error - 25.10.2012 10:33:28 | Computer Name = XI | Source = BugCheck | ID = 1001
Description =
Error - 09.11.2012 14:02:42 | Computer Name = XI | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?09.?11.?2012 um 19:01:33 unerwartet heruntergefahren.
< End of report >
Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-06-19 02:35:59
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 TOSHIBA_MK5055GSX rev.FG002C 465,76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\KNIGHT~1\AppData\Local\Temp\pxldipow.sys
---- System - GMER 2.1 ----
SSDT 908885C6 ZwCreateSection
SSDT 908885D0 ZwRequestWaitReplyPort
SSDT 908885CB ZwSetContextThread
SSDT 908885D5 ZwSetSecurityObject
SSDT 908885DA ZwSystemDebugControl
SSDT 90888567 ZwTerminateProcess
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!ZwRollbackEnlistment + 140D 82C529F5 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82C8C1F2 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!KeRemoveQueueEx + 11F7 82C9353C 4 Bytes [C6, 85, 88, 90]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1553 82C93898 4 Bytes [D0, 85, 88, 90]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1597 82C938DC 4 Bytes [CB, 85, 88, 90]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1613 82C93958 4 Bytes [D5, 85, 88, 90]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1667 82C939AC 4 Bytes JMP 8885DA82
.text ...
---- Registry - GMER 2.1 ----
Reg HKLM\SOFTWARE\Microsoft\Windows Search\UsnNotifier\Windows\Catalogs\SystemIndex@{5A52D8CA-4F37-11E1-AA10-806E6F6E6963} 8468169496
---- EOF - GMER 2.1 ----
|
|
19.06.2013, 01:53
| #2 | ||
| /// TB-Ausbilder   | Malware in e-Mail ZIP Hallo kittypryde und
__________________ Mein Name ist Leo und ich werde dich durch die Bereinigung deines Rechners begleiten. Eins vorneweg: Ich kann dir keine Garantien geben, dass ich alles finden werde. Bei schwerwiegenden Infektionen ist ein Formatieren und Neuinstallieren meist der schnellere und immer der sicherere Weg. Wenn du dich für eine Bereinigung entscheidest, dann sollten wir gründlich vorgehen. Bleib also dran, bis ich dir eindeutig mitteile, dass wir fertig sind. Auch wenn die auffälligen Symptome schon früh verschwinden, bedeutet das nicht, dass dein Rechner dann schon sauber und sicher ist.  Hinweise zum Ablauf
Los geht's: Zitat:
 Zitat:
Schritt 1 Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Schritt 2 Scan mit Combofix
Schritt 3 Starte bitte die OTL.exe.
Bitte poste in deiner nächsten Antwort:
__________________ |
|
19.06.2013, 02:03
| #3 |
| | Malware in e-Mail ZIP Dann hätte ich, bevor du dir richtig Mühe gibst, doch noch die Frage:
__________________Habe ich bei einer Formatierung meines Betriebssystems wirklich die Garantie, dass diese Malware weg ist? Ausmachen würde mir das nicht viel, alle wichtigen und selbst erstellten Dateien habe ich jetzt sowieso auf der externen Festplatte... |
|
19.06.2013, 02:10
| #4 |
| /// TB-Ausbilder | Malware in e-Mail ZIP Die Festplatte gründlich formatieren (inkl. Partitionen löschen und neu erstellen) und danach das Betriebssystem neu installieren, ist die sicherstmögliche Option, ja.
__________________ cheers, Leo |
|
19.06.2013, 16:24
| #5 |
| | Malware in e-Mail ZIP Ich habe mich für's Weitermachen entschieden. Symptome vorher: langsamer Internetseitenaufbau, vor allem Bilder und Grafiken. Als ich combofic laufen ließ, wollte es Spybot deaktiviert haben, was sich nicht machen ließ. Also habe ich es deinstalliert und dann combofix laufen lassen. Danach Internet ausprobiert, viel schnellerer Seitenaufbau. Unten in der Taskleiste fehlt aber jetzt auch das Avira Symbol, dass ich vor combofix ja deaktiviert habe, im Task Manager sieht man auch nichts von Avira. Überhaupt jetzt viel weniger Prozesse als zuvor. Ist Avira noch/wieder aktiv? Hier die log von AdwCleaner: Code:
ATTFilter # AdwCleaner v2.303 - Datei am 19/06/2013 um 16:38:20 erstellt
# Aktualisiert am 08/06/2013 von Xplode
# Betriebssystem : Windows 7 Ultimate Service Pack 1 (32 bits)
# Benutzer : knightkrawler - XI
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\knightkrawler\Desktop\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
***** [Registrierungsdatenbank] *****
***** [Internet Browser] *****
-\\ Internet Explorer v10.0.9200.16611
[OK] Die Registrierungsdatenbank ist sauber.
-\\ Mozilla Firefox v21.0 (de)
Datei : C:\Users\knightkrawler\AppData\Roaming\Mozilla\Firefox\Profiles\uyw1a5vb.default\prefs.js
[OK] Die Datei ist sauber.
*************************
AdwCleaner[S1].txt - [1837 octets] - [19/06/2013 01:05:12]
AdwCleaner[S2].txt - [798 octets] - [19/06/2013 16:38:20]
########## EOF - C:\AdwCleaner[S2].txt - [857 octets] ##########
Code:
ATTFilter ComboFix 13-06-18.02 - knightkrawler 19.06.2013 16:54:15.1.2 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.49.1031.18.3039.2170 [GMT 2:00]
ausgeführt von:: c:\users\knightkrawler\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Spybot - Search and Destroy *Disabled/Outdated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\NVIDIA
c:\programdata\NVIDIA\NvApps.xml
c:\programdata\NVIDIA\NvStarted
c:\windows\wininit.ini
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-05-19 bis 2013-06-19 ))))))))))))))))))))))))))))))
.
.
2013-06-19 15:00 . 2013-06-19 15:00 -------- d-----w- c:\users\knightkrawler\AppData\Local\temp
2013-06-19 15:00 . 2013-06-19 15:00 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-06-19 01:06 . 2013-06-12 04:18 7068072 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{36528EDC-15EE-4BEF-9DE1-1EDF77B4A0B0}\mpengine.dll
2013-06-18 23:30 . 2013-06-18 23:30 -------- d-----w- c:\users\knightkrawler\AppData\Roaming\Malwarebytes
2013-06-18 23:30 . 2013-06-18 23:30 -------- d-----w- c:\programdata\Malwarebytes
2013-06-18 23:30 . 2013-06-18 23:30 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-06-18 23:30 . 2013-04-04 12:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-06-18 23:20 . 2013-06-18 23:21 -------- d-----w- c:\program files\Common Files\Adobe
2013-06-18 19:49 . 2013-06-18 19:49 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-06-18 19:49 . 2013-06-18 19:49 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-06-18 19:14 . 2013-06-18 19:20 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2013-06-17 21:51 . 2013-06-17 21:51 -------- d-----w- c:\program files\Mozilla Maintenance Service
2013-06-14 11:16 . 2013-06-14 11:16 -------- d-----w- c:\program files\MSXML 4.0
2013-06-13 06:46 . 2013-06-08 11:41 218112 ----a-w- c:\program files\Internet Explorer\sqmapi.dll
2013-06-13 06:46 . 2013-06-08 11:13 2706432 ----a-w- c:\windows\system32\mshtml.tlb
2013-06-12 18:55 . 2013-06-12 18:57 -------- d-----w- c:\program files\Common Files\Nero
2013-06-12 18:55 . 2013-06-12 18:59 -------- d-----w- c:\program files\Nero
2013-06-12 18:54 . 2013-06-12 18:59 -------- d-----w- c:\programdata\Nero
2013-06-12 18:52 . 2013-06-12 18:52 -------- d-----w- c:\program files\Common Files\LightScribe
2013-06-12 18:49 . 2013-06-12 18:49 -------- d-----w- c:\program files\Microsoft.NET
2013-06-12 06:02 . 2013-04-26 04:55 492544 ----a-w- c:\windows\system32\win32spl.dll
2013-06-12 06:02 . 2013-05-13 04:45 140288 ----a-w- c:\windows\system32\cryptsvc.dll
2013-06-12 06:02 . 2013-05-13 04:45 1160192 ----a-w- c:\windows\system32\crypt32.dll
2013-06-12 06:02 . 2013-05-13 04:45 103936 ----a-w- c:\windows\system32\cryptnet.dll
2013-06-12 06:02 . 2013-05-13 03:08 903168 ----a-w- c:\windows\system32\certutil.exe
2013-06-12 06:02 . 2013-05-13 03:08 43008 ----a-w- c:\windows\system32\certenc.dll
2013-06-12 06:01 . 2013-05-06 05:06 3913576 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-06-12 06:01 . 2013-05-06 05:06 3968872 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-06-12 05:56 . 2013-05-08 05:38 1293672 ----a-w- c:\windows\system32\drivers\tcpip.sys
2013-05-30 20:08 . 2013-05-30 20:08 -------- d-----w- c:\program files\CDisplay
2013-05-30 15:48 . 2013-06-02 13:00 -------- d-----w- c:\users\knightkrawler\AppData\Roaming\ICQM
2013-05-30 15:48 . 2013-05-30 15:52 -------- d-----w- c:\users\knightkrawler\AppData\Roaming\ICQ-Profile
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-02 00:06 . 2012-02-04 14:46 238872 ------w- c:\windows\system32\MpSigStub.exe
2013-04-12 13:45 . 2013-04-24 15:57 1211752 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-10 05:18 . 2013-05-15 05:03 728424 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-04-10 05:18 . 2013-05-15 05:03 218984 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2013-04-10 03:14 . 2013-05-15 05:03 2347520 ----a-w- c:\windows\system32\win32k.sys
2013-04-06 19:41 . 2013-04-06 19:41 745472 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-04-06 19:41 . 2013-04-06 19:41 185344 ----a-w- c:\windows\system32\elshyph.dll
2013-04-06 19:41 . 2013-04-06 19:41 158720 ----a-w- c:\windows\system32\msls31.dll
2013-04-06 19:41 . 2013-04-06 19:41 523264 ----a-w- c:\windows\system32\vbscript.dll
2013-04-06 19:41 . 2013-04-06 19:41 38400 ----a-w- c:\windows\system32\imgutil.dll
2013-04-06 19:41 . 2013-04-06 19:41 150528 ----a-w- c:\windows\system32\iexpress.exe
2013-04-06 19:41 . 2013-04-06 19:41 138752 ----a-w- c:\windows\system32\wextract.exe
2013-04-06 19:41 . 2013-04-06 19:41 137216 ----a-w- c:\windows\system32\ieUnatt.exe
2013-04-06 19:41 . 2013-04-06 19:41 12800 ----a-w- c:\windows\system32\mshta.exe
2013-04-06 19:41 . 2013-04-06 19:41 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-04-06 19:41 . 2013-04-06 19:41 73728 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-04-06 19:41 . 2013-04-06 19:41 719360 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-04-06 19:41 . 2013-04-06 19:41 61952 ----a-w- c:\windows\system32\tdc.ocx
2013-04-06 19:41 . 2013-04-06 19:41 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-04-06 19:41 . 2013-04-06 19:41 361984 ----a-w- c:\windows\system32\html.iec
2013-04-06 19:41 . 2013-04-06 19:41 23040 ----a-w- c:\windows\system32\licmgr10.dll
2013-04-06 19:41 . 2013-04-06 19:41 1441280 ----a-w- c:\windows\system32\inetcpl.cpl
2013-04-06 19:40 . 2013-04-06 19:40 9728 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-04-06 19:40 . 2013-04-06 19:40 906240 ----a-w- c:\windows\system32\FntCache.dll
2013-04-06 19:40 . 2013-04-06 19:40 604160 ----a-w- c:\windows\system32\d3d10level9.dll
2013-04-06 19:40 . 2013-04-06 19:40 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-04-06 19:40 . 2013-04-06 19:40 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-04-06 19:40 . 2013-04-06 19:40 417792 ----a-w- c:\windows\system32\WMPhoto.dll
2013-04-06 19:40 . 2013-04-06 19:40 4096 ---ha-w- c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-04-06 19:40 . 2013-04-06 19:40 364544 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2013-04-06 19:40 . 2013-04-06 19:40 3584 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-04-06 19:40 . 2013-04-06 19:40 3419136 ----a-w- c:\windows\system32\d2d1.dll
2013-04-06 19:40 . 2013-04-06 19:40 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-04-06 19:40 . 2013-04-06 19:40 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-04-06 19:40 . 2013-04-06 19:40 293376 ----a-w- c:\windows\system32\dxgi.dll
2013-04-06 19:40 . 2013-04-06 19:40 2560 ---ha-w- c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-04-06 19:40 . 2013-04-06 19:40 249856 ----a-w- c:\windows\system32\d3d10_1core.dll
2013-04-06 19:40 . 2013-04-06 19:40 2284544 ----a-w- c:\windows\system32\msmpeg2vdec.dll
2013-04-06 19:40 . 2013-04-06 19:40 220160 ----a-w- c:\windows\system32\d3d10core.dll
2013-04-06 19:40 . 2013-04-06 19:40 207872 ----a-w- c:\windows\system32\WindowsCodecsExt.dll
2013-04-06 19:40 . 2013-04-06 19:40 1988096 ----a-w- c:\windows\system32\d3d10warp.dll
2013-04-06 19:40 . 2013-04-06 19:40 187392 ----a-w- c:\windows\system32\UIAnimation.dll
2013-04-06 19:40 . 2013-04-06 19:40 161792 ----a-w- c:\windows\system32\d3d10_1.dll
2013-04-06 19:40 . 2013-04-06 19:40 1504768 ----a-w- c:\windows\system32\d3d11.dll
2013-04-06 19:40 . 2013-04-06 19:40 1247744 ----a-w- c:\windows\system32\DWrite.dll
2013-04-06 19:40 . 2013-04-06 19:40 1230336 ----a-w- c:\windows\system32\WindowsCodecs.dll
2013-04-06 19:40 . 2013-04-06 19:40 1158144 ----a-w- c:\windows\system32\XpsPrint.dll
2013-04-06 19:40 . 2013-04-06 19:40 1080832 ----a-w- c:\windows\system32\d3d10.dll
2013-04-06 19:40 . 2013-04-06 19:40 10752 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2011-03-04 2741616]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-10-03 13826664]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-08-12 348664]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-05-11 958576]
.
c:\users\knightkrawler\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean.exe
.
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000-Serie - Adaptertreiber für Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [2010-11-20 77184]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [2010-11-20 25600]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [2010-11-20 112640]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2012-08-01 1343400]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2012-04-16 36000]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2012-05-01 86224]
S2 NAUpdate;Nero Update;c:\program files\Nero\Update\NASvc.exe [2012-07-13 769432]
S2 PDF Architect Helper Service;PDF Architect Helper Service;c:\program files\PDF Architect\HelperService.exe [2013-01-09 1324104]
S2 PDF Architect Service;PDF Architect Service;c:\program files\PDF Architect\ConversionService.exe [2013-01-09 795208]
S3 NETw5s32;Intel(R) Wireless WiFi Link Adaptertreiber für Windows 7 32-Bit;c:\windows\system32\DRIVERS\NETw5s32.sys [2010-01-13 6755840]
S3 RTL8167;Realtek 8167 NT-Treiber;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2011-03-04 10:29 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\knightkrawler\AppData\Roaming\Mozilla\Firefox\Profiles\uyw1a5vb.default\
FF - prefs.js: browser.search.selectedEngine - LEO Eng-Deu
FF - prefs.js: browser.startup.homepage - en.wikipedia.org
FF - ExtSQL: 2013-06-18 23:49; UIEnhancer@girishsharma; c:\users\knightkrawler\AppData\Roaming\Mozilla\Firefox\Profiles\uyw1a5vb.default\extensions\UIEnhancer@girishsharma.xpi
FF - ExtSQL: 2013-06-18 23:56; {b6f3913d-d2e8-480c-9aca-c41d3d4c1db3}; c:\users\knightkrawler\AppData\Roaming\Mozilla\Firefox\Profiles\uyw1a5vb.default\extensions\{b6f3913d-d2e8-480c-9aca-c41d3d4c1db3}.xpi
FF - ExtSQL: 2013-06-18 23:56; {0545b830-f0aa-4d7e-8820-50a4629a56fe}; c:\users\knightkrawler\AppData\Roaming\Mozilla\Firefox\Profiles\uyw1a5vb.default\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe}
FF - ExtSQL: 2013-06-18 23:56; printedit@DW-dev; c:\users\knightkrawler\AppData\Roaming\Mozilla\Firefox\Profiles\uyw1a5vb.default\extensions\printedit@DW-dev.xpi
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-06-19 17:03:25
ComboFix-quarantined-files.txt 2013-06-19 15:03
.
Vor Suchlauf: 12 Verzeichnis(se), 365.010.157.568 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 364.925.427.712 Bytes frei
.
- - End Of File - - 301863970CAFC812CB52277EC57297BC
A36C5E4F47E84449FF07ED3517B43A31
Code:
ATTFilter OTL logfile created on: 19.06.2013 17:14:20 - Run 2 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\knightkrawler\Desktop Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.10.9200.16614) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,97 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 67,52% Memory free 5,93 Gb Paging File | 4,95 Gb Available in Paging File | 83,39% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 454,56 Gb Total Space | 339,95 Gb Free Space | 74,79% Space Free | Partition Type: NTFS Drive D: | 11,20 Gb Total Space | 1,32 Gb Free Space | 11,80% Space Free | Partition Type: NTFS Drive F: | 3,69 Gb Total Space | 3,68 Gb Free Space | 100,00% Space Free | Partition Type: FAT32 Computer Name: XI | User Name: knightkrawler | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.06.19 02:01:37 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\knightkrawler\Desktop\OTL.exe PRC - [2013.05.11 12:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2013.01.09 18:36:06 | 000,795,208 | ---- | M] (pdfforge GbR) -- C:\Programme\PDF Architect\ConversionService.exe PRC - [2013.01.09 18:34:26 | 001,324,104 | ---- | M] (pdfforge GbR) -- C:\Programme\PDF Architect\HelperService.exe PRC - [2012.11.23 04:48:41 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe PRC - [2012.10.04 16:57:58 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe PRC - [2012.08.12 20:28:02 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2012.07.13 16:27:00 | 000,769,432 | ---- | M] (Nero AG) -- C:\Programme\Nero\Update\NASvc.exe PRC - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2012.04.24 02:11:55 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2011.01.17 19:50:34 | 011,322,880 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 3\program\soffice.exe PRC - [2011.01.17 19:50:34 | 011,314,688 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 3\program\soffice.bin PRC - [2010.11.20 23:29:49 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe PRC - [2010.11.20 23:29:20 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe ========== Modules (No Company Name) ========== MOD - [2012.02.26 19:52:14 | 000,985,088 | ---- | M] () -- C:\Programme\OpenOffice.org 3\program\libxml2.dll MOD - [2011.03.04 12:02:54 | 007,745,536 | ---- | M] () -- C:\Programme\Common Files\LightScribe\QtGui4.dll MOD - [2011.03.04 12:02:52 | 000,135,168 | ---- | M] () -- C:\Programme\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll MOD - [2011.03.04 12:02:50 | 002,121,728 | ---- | M] () -- C:\Programme\Common Files\LightScribe\QtCore4.dll ========== Services (SafeList) ========== SRV - [2013.05.12 00:26:17 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2013.05.11 12:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2013.01.09 18:36:06 | 000,795,208 | ---- | M] (pdfforge GbR) [Auto | Running] -- C:\Programme\PDF Architect\ConversionService.exe -- (PDF Architect Service) SRV - [2013.01.09 18:34:26 | 001,324,104 | ---- | M] (pdfforge GbR) [Auto | Running] -- C:\Programme\PDF Architect\HelperService.exe -- (PDF Architect Helper Service) SRV - [2012.08.01 21:40:13 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc) SRV - [2012.07.13 16:27:00 | 000,769,432 | ---- | M] (Nero AG) [Auto | Running] -- C:\Programme\Nero\Update\NASvc.exe -- (NAUpdate) SRV - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2010.11.20 23:29:49 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc) SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\rdvgkmd.sys -- (VGPU) DRV - File not found [Kernel | On_Demand | Unknown] -- C:\ComboFix\mbr.sys -- (mbr) DRV - File not found [Kernel | On_Demand | Unknown] -- C:\Users\KNIGHT~1\AppData\Local\Temp\catchme.sys -- (catchme) DRV - [2012.04.27 10:20:04 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2012.04.25 00:32:27 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2012.04.16 21:17:40 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr) DRV - [2010.11.20 23:29:34 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV - [2010.11.20 23:29:24 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV - [2010.11.20 23:29:03 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus) DRV - [2010.11.20 23:29:03 | 000,112,640 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tsusbhub.sys -- (tsusbhub) DRV - [2010.11.20 23:29:03 | 000,077,184 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Synth3dVsc.sys -- (Synth3dVsc) DRV - [2010.11.20 23:29:03 | 000,062,464 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\dmvsc.sys -- (dmvsc) DRV - [2010.11.20 23:29:03 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt) DRV - [2010.11.20 23:29:03 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb) DRV - [2010.11.20 23:29:03 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc) DRV - [2010.11.20 23:29:03 | 000,027,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbGD.sys -- (TsUsbGD) DRV - [2010.11.20 23:29:03 | 000,025,600 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\terminpt.sys -- (terminpt) DRV - [2010.11.20 23:29:03 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID) DRV - [2010.11.20 23:29:03 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap) DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2010.01.13 17:36:40 | 006,755,840 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5s32.sys -- (NETw5s32) DRV - [2009.10.03 07:02:06 | 009,905,096 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2009.07.14 01:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp) DRV - [2009.07.14 00:02:51 | 004,231,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\netw5v32.sys -- (netw5v32) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-478049982-3793223590-585868218-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com IE - HKU\S-1-5-21-478049982-3793223590-585868218-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKU\S-1-5-21-478049982-3793223590-585868218-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 1F DA A0 29 4A E3 CC 01 [binary data] IE - HKU\S-1-5-21-478049982-3793223590-585868218-1000\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-478049982-3793223590-585868218-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR IE - HKU\S-1-5-21-478049982-3793223590-585868218-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\S-1-5-21-478049982-3793223590-585868218-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-478049982-3793223590-585868218-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = :0 ========== FireFox ========== FF - prefs.js..browser.search.selectedEngine: "LEO Eng-Deu" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "en.wikipedia.org" FF - prefs.js..extensions.enabledAddons: %7Bb6f3913d-d2e8-480c-9aca-c41d3d4c1db3%7D:1.0.1.0 FF - prefs.js..extensions.enabledAddons: %7B0545b830-f0aa-4d7e-8820-50a4629a56fe%7D:18.8 FF - prefs.js..extensions.enabledAddons: printedit%40DW-dev:9.3 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:21.0 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.13.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@Nero.com/KM: C:\PROGRA~1\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\FFPDFArchitectConverter@pdfarchitect.com: C:\Program Files\PDF Architect\FFPDFArchitectExt [2013.02.16 17:45:41 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013.06.17 23:52:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\knightkrawler\AppData\Roaming\mozilla\Extensions [2013.06.18 23:56:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\knightkrawler\AppData\Roaming\mozilla\Firefox\Profiles\uyw1a5vb.default\extensions [2013.06.18 23:56:51 | 000,000,000 | ---D | M] ("ColorfulTabs") -- C:\Users\knightkrawler\AppData\Roaming\mozilla\Firefox\Profiles\uyw1a5vb.default\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe} [2013.06.18 00:10:11 | 000,000,000 | ---D | M] (FT DeepDark) -- C:\Users\knightkrawler\AppData\Roaming\mozilla\Firefox\Profiles\uyw1a5vb.default\extensions\{77d2ed30-4cd2-11e0-b8af-0800200c9a66} [2013.06.18 23:56:51 | 000,092,735 | ---- | M] () (No name found) -- C:\Users\knightkrawler\AppData\Roaming\mozilla\firefox\profiles\uyw1a5vb.default\extensions\printedit@DW-dev.xpi [2013.06.18 23:49:51 | 000,194,628 | ---- | M] () (No name found) -- C:\Users\knightkrawler\AppData\Roaming\mozilla\firefox\profiles\uyw1a5vb.default\extensions\UIEnhancer@girishsharma.xpi [2013.06.18 23:56:51 | 000,089,408 | ---- | M] () (No name found) -- C:\Users\knightkrawler\AppData\Roaming\mozilla\firefox\profiles\uyw1a5vb.default\extensions\{b6f3913d-d2e8-480c-9aca-c41d3d4c1db3}.xpi [2013.06.18 23:14:22 | 000,001,272 | ---- | M] () -- C:\Users\knightkrawler\AppData\Roaming\mozilla\firefox\profiles\uyw1a5vb.default\searchplugins\wikipedia-en-ssl.xml [2013.05.24 19:05:18 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\browser\extensions [2013.06.17 23:51:40 | 000,000,000 | ---D | M] (Default) -- C:\Programme\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} O1 HOSTS File: ([2013.06.19 17:00:38 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (PDF Architect Helper) - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Programme\PDF Architect\PDFIEHelper.dll (pdfforge GbR) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKU\@1..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - Startup: C:\Users\knightkrawler\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe () O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\@1\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\@4\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-478049982-3793223590-585868218-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-478049982-3793223590-585868218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_13-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0017-0000-0013-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_13-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_13-windows-i586.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2582B6D1-196C-4ED0-B19E-8CE815261A3D}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4F286681-1643-4D1B-8F60-A8327BBA065B}: DhcpNameServer = 192.168.1.254 O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.06.19 17:15:03 | 000,000,000 | ---D | C] -- C:\Users\knightkrawler\Desktop\schritt 1 [2013.06.19 17:03:28 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN [2013.06.19 17:03:27 | 000,000,000 | ---D | C] -- C:\Users\knightkrawler\AppData\Local\temp [2013.06.19 17:00:37 | 000,000,000 | ---D | C] -- C:\Windows\temp [2013.06.19 16:52:06 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe [2013.06.19 16:52:06 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe [2013.06.19 16:52:06 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe [2013.06.19 16:45:40 | 000,000,000 | ---D | C] -- C:\Qoobox [2013.06.19 16:45:20 | 000,000,000 | ---D | C] -- C:\Windows\erdnt [2013.06.19 16:44:23 | 000,000,000 | ---D | C] -- C:\Users\knightkrawler\Desktop\Dateien [2013.06.19 16:43:36 | 005,081,021 | R--- | C] (Swearware) -- C:\Users\knightkrawler\Desktop\ComboFix.exe [2013.06.19 02:01:34 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\knightkrawler\Desktop\OTL.exe [2013.06.19 01:30:55 | 000,000,000 | ---D | C] -- C:\Users\knightkrawler\AppData\Roaming\Malwarebytes [2013.06.19 01:30:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2013.06.19 01:30:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2013.06.19 01:30:37 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2013.06.19 01:30:37 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2013.06.19 01:20:57 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe [2013.06.19 01:20:57 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe [2013.06.19 01:20:40 | 000,000,000 | ---D | C] -- C:\Config.Msi [2013.06.18 21:14:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy [2013.06.17 23:53:02 | 000,000,000 | ---D | C] -- C:\Users\knightkrawler\Desktop\Neue Downloads [2013.06.17 23:51:40 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service [2013.06.17 23:05:44 | 000,000,000 | ---D | C] -- C:\Windows\System32\appmgmt [2013.06.14 13:16:57 | 000,000,000 | ---D | C] -- C:\Program Files\MSXML 4.0 [2013.06.12 21:01:51 | 000,000,000 | ---D | C] -- C:\Users\knightkrawler\Desktop\Nero [2013.06.12 20:55:25 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Nero [2013.06.12 20:55:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero [2013.06.12 20:55:13 | 000,000,000 | ---D | C] -- C:\Program Files\Nero [2013.06.12 20:54:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Nero [2013.06.12 20:52:21 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LightScribe Direct Disc Labeling [2013.06.12 20:52:21 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\LightScribe [2013.06.12 20:49:48 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET [2013.05.30 22:08:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDisplay [2013.05.30 22:08:49 | 000,000,000 | ---D | C] -- C:\Program Files\CDisplay [2013.05.30 17:48:22 | 000,000,000 | ---D | C] -- C:\Users\knightkrawler\AppData\Roaming\ICQM [2013.05.30 17:48:19 | 000,000,000 | ---D | C] -- C:\Users\knightkrawler\AppData\Roaming\ICQ-Profile [2013.05.24 19:05:12 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox ========== Files - Modified Within 30 Days ========== [2013.06.19 17:00:38 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts [2013.06.19 16:59:17 | 000,020,496 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.06.19 16:59:17 | 000,020,496 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.06.19 16:56:08 | 000,654,166 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2013.06.19 16:56:08 | 000,616,008 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2013.06.19 16:56:08 | 000,130,006 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2013.06.19 16:56:08 | 000,106,388 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2013.06.19 16:50:44 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.06.19 16:50:38 | 2389,929,984 | -HS- | M] () -- C:\hiberfil.sys [2013.06.19 16:43:56 | 005,081,021 | R--- | M] (Swearware) -- C:\Users\knightkrawler\Desktop\ComboFix.exe [2013.06.19 02:16:10 | 000,377,856 | ---- | M] () -- C:\Users\knightkrawler\Desktop\gmer_2.1.19163.exe [2013.06.19 02:01:37 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\knightkrawler\Desktop\OTL.exe [2013.06.19 02:00:13 | 000,000,000 | ---- | M] () -- C:\Users\knightkrawler\defogger_reenable [2013.06.19 01:58:44 | 000,050,477 | ---- | M] () -- C:\Users\knightkrawler\Desktop\Defogger.exe [2013.06.19 01:47:25 | 001,271,997 | ---- | M] () -- C:\Users\knightkrawler\Desktop\zoek.exe [2013.06.19 01:21:18 | 000,001,989 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader XI.lnk [2013.06.19 01:04:11 | 000,648,201 | ---- | M] () -- C:\Users\knightkrawler\Desktop\adwcleaner.exe ========== Files Created - No Company Name ========== [2013.06.19 16:52:06 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe [2013.06.19 16:52:06 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe [2013.06.19 16:52:06 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe [2013.06.19 16:52:06 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe [2013.06.19 16:52:06 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe [2013.06.19 02:16:09 | 000,377,856 | ---- | C] () -- C:\Users\knightkrawler\Desktop\gmer_2.1.19163.exe [2013.06.19 02:00:13 | 000,000,000 | ---- | C] () -- C:\Users\knightkrawler\defogger_reenable [2013.06.19 01:58:43 | 000,050,477 | ---- | C] () -- C:\Users\knightkrawler\Desktop\Defogger.exe [2013.06.19 01:47:21 | 001,271,997 | ---- | C] () -- C:\Users\knightkrawler\Desktop\zoek.exe [2013.06.19 01:21:18 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk [2013.06.19 01:21:18 | 000,001,989 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader XI.lnk [2013.06.19 01:04:01 | 000,648,201 | ---- | C] () -- C:\Users\knightkrawler\Desktop\adwcleaner.exe [2013.06.17 23:51:44 | 000,001,117 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2012.08.08 19:04:13 | 000,081,408 | ---- | C] () -- C:\Windows\cadkasdeinst01.exe [2012.07.04 18:20:04 | 000,000,856 | ---- | C] () -- C:\Users\knightkrawler\AppData\Local\recently-used.xbel ========== ZeroAccess Check ========== [2009.07.14 06:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 23:29:20 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 03:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2012.08.08 19:04:27 | 000,000,000 | ---D | M] -- C:\Users\knightkrawler\AppData\Roaming\CAD-KAS [2013.05.30 17:52:38 | 000,000,000 | ---D | M] -- C:\Users\knightkrawler\AppData\Roaming\ICQ-Profile [2013.06.02 15:00:38 | 000,000,000 | ---D | M] -- C:\Users\knightkrawler\AppData\Roaming\ICQM [2013.06.17 23:09:39 | 000,000,000 | ---D | M] -- C:\Users\knightkrawler\AppData\Roaming\IrfanView [2012.02.26 19:52:45 | 000,000,000 | ---D | M] -- C:\Users\knightkrawler\AppData\Roaming\OpenOffice.org [2012.12.13 22:55:03 | 000,000,000 | ---D | M] -- C:\Users\knightkrawler\AppData\Roaming\Origin [2013.02.16 17:48:45 | 000,000,000 | ---D | M] -- C:\Users\knightkrawler\AppData\Roaming\PDF Architect [2013.02.20 08:48:08 | 000,000,000 | ---D | M] -- C:\Users\knightkrawler\AppData\Roaming\Scribus ========== Purity Check ========== < End of report > |
|
19.06.2013, 16:49
| #6 |
| /// TB-Ausbilder | Malware in e-Mail ZIP Hallo, also laut OTL-Log läuft dein Avira.. Ist denn jetzt wieder alles normal mit dem Rechner? Schritt 1 Fixen mit OTL
Code:
ATTFilter :commands
[emptytemp]
Schritt 2
Schritt 3 ESET Online Scanner
Schritt 4 Downloade Dir bitte  SecurityCheck und:
Bitte poste in deiner nächsten Antwort:
__________________ --> Malware in e-Mail ZIP |
|
19.06.2013, 20:36
| #7 |
| | Malware in e-Mail ZIP Avira läuft, Firewall ist ein, Seitenaufbau sehr schnell, bin jetzt erstmal sehr zufrieden. OTL log: Code:
ATTFilter All processes killed
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: knightkrawler
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 1490720 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 20915575 bytes
->Flash cache emptied: 492 bytes
User: Public
->Temp folder emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 21,00 mb
OTL by OldTimer - Version 3.2.69.0 log created on 06192013_175354
Files\Folders moved on Reboot...
PendingFileRenameOperations files...
Registry entries deleted on Reboot...
Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.06.19.06 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 10.0.9200.16618 knightkrawler :: XI [Administrator] 19.06.2013 17:59:40 mbam-log-2013-06-19 (17-59-40).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 198822 Laufzeit: 7 Minute(n), 9 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=b8c1033d1aa30a4cbb6f647f3a04e8ef
# engine=14111
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-06-19 07:20:46
# local_time=2013-06-19 09:20:46 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 99 74934 237092936 76371 0
# compatibility_mode=5893 16776573 100 94 0 123300837 0 0
# scanned=382900
# found=0
# cleaned=0
# scan_time=10771
Code:
ATTFilter Results of screen317's Security Check version 0.99.64 Windows 7 Service Pack 1 x86 Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 Adobe Flash Player 11.7.700.224 Adobe Reader XI Mozilla Firefox (21.0) ````````Process Check: objlist.exe by Laurent```````` Avira Antivir avgnt.exe Avira Antivir avguard.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` |
|
19.06.2013, 20:38
| #8 |
| /// TB-Ausbilder | Malware in e-Mail ZIP Hi, und auch die Logs sehen alle gut aus. Wir räumen auf: Cleanup Zum Schluss werden wir jetzt noch unsere Tools (inklusive der Quarantäne-Ordner) wegräumen, die verseuchten Systemwiederherstellungspunkte löschen und alle Einstellungen wieder herrichten. Auch diese Schritte sind noch wichtig und sollten in der angegebenen Reihenfolge ausgeführt werden.
>> OK << Wir sind durch, deine Logs sehen für mich im Moment sauber aus.  Ich habe dir nachfolgend ein paar Hinweise und Tipps zusammengestellt, die dazu beitragen sollen, dass du in Zukunft unsere Hilfe nicht mehr brauchen wirst. Bitte gib mir danach noch eine kurze Rückmeldung, wenn auch von deiner Seite keine Probleme oder Fragen mehr offen sind, damit ich dieses Thema als erledigt betrachten kann. Epilog: Tipps, Dos & Don'ts Aktualität von System und SoftwareDas Betriebsystem Windows muss zwingend immer auf dem neusten Stand sein. Stelle sicher, dass die automatischen Updates aktiviert sind:
Auch die installierte Software sollte immer in der aktuellsten Version vorliegen. Speziell gilt das für den Browser, Java, Flash-Player und PDF-Reader, denn bekannte Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim blossen Besuch einer präparierten Website per Drive-by Download Malware zu installieren. Das kann sogar auf normalerweise legitimen Websites geschehen, wenn es einem Angreifer gelungen ist, seinen Code in die Seite einzuschleusen, und ist deshalb relativ unberechenbar.
Sicherheits-SoftwareEine Bemerkung vorneweg: Jede Softwarelösung hat ihre Schwächen. Die gesamte Verantwortung für die Sicherheit auf Software zu übertragen und einen Rundum-Schutz zu erwarten, wäre eine gefährliche Illusion. Bei unbedachtem oder bewusst risikoreichem Verhalten wird auch das beste Programm früher oder später seinen Dienst versagen (z.B. ein Virenscanner, der eine verseuchte Datei nicht erkennt). Trotzdem ist entsprechende Software natürlich wichtig und hilft dir in Kombination mit einem gut gewarteten (up-to-date) System und durchdachtem Verhalten, deinen Rechner sauber zu halten.
Es liegt in der Natur der Sache, dass die am weitesten verbreitete Anwendungs-Software auch am häufigsten von Malware-Autoren attackiert wird. Es kann daher bereits einen kleinen Sicherheitsgewinn darstellen, wenn man alternative Software (z.B. einen alternativen PDF Reader) benutzt. Anstelle des Internet Explorers kann man beispielsweise den Mozilla Firefox einsetzen, für welchen es zwei nützliche Addons zur Empfehlung gibt:
(Un-)Sicheres Verhalten im InternetNebst unbemerkten Drive-by Installationen wird Malware aber auch oft mehr oder weniger aktiv vom Benutzer selbst installiert. Der Besuch zwielichtiger Websites kann bereits Risiken bergen. Und Downloads aus dubiosen Quellen sind immer russisches Roulette. Auch wenn der Virenscanner im Moment darin keine Bedrohung erkennt, muss das nichts bedeuten.
Oft wird auch versucht, den Benutzer mit mehr oder weniger trickreichen Methoden dazu zu bringen, eine für ihn verhängnisvolle Handlung selbst auszuführen (Überbegriff Social Engineering).
Nervige Adware (Werbung) und unnötige Toolbars werden auch meist durch den Benutzer selbst mitinstalliert.
Allgemeine HinweiseAbschliessend noch ein paar grundsätzliche Bemerkungen:
Wenn du möchtest, kannst du das Forum mit einer kleinen Spende unterstützen. Es bleibt mir nur noch, dir unbeschwertes und sicheres Surfen zu wünschen und dass wir uns hier so bald nicht wiedersehen. 
__________________ cheers, Leo |
|
19.06.2013, 21:08
| #9 |
| | Malware in e-Mail ZIP Ich bedanke mich recht herzlich. Nur zwei Sachen noch: der Plugin-Check funktioniert bei mir nicht. Wenn ich den link klicke, hängt sich firefox auf (Keine Rückmeldung). Dann muss ich den browser schließen und erneut öffnen. und zum Zweiten: Schon VOR dem Entstehen meines Problems durch eigene Dummheit meldet sich nach dem bewussten Schließens von Firefox ein Popup-Fenster, das mir mitteilt, dass Firefox geschlossen werden musste. Kannst du mir dazu noch was sagen? |
|
| Themen zu Malware in e-Mail ZIP |
| antivir, autorun, avg, avira, bho, converter, defender, e-mail, error, fehler, firefox, flash player, format, install.exe, logfile, malware, prozess, registry, rundll, safer networking, scan, security, software, svchost.exe, warnung, werbefenster, windows |
Textbox. 
Linear-Darstellung
