Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
Antispy Soft Virus

Antispy Soft Virus


Plagegeister aller Art und deren Bekämpfung: Antispy Soft Virus

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 20.05.2010, 20:12   #1
Marcus81
 
Antispy Soft Virus - Standard

Antispy Soft Virus


Nabend euch allen

Ich habe seit gestern Probleme mit dem aufgetauchten "Antispy soft Virus".
Das Thema ist ja hier bekannt und ich habe auch gelesen was nötig ist zur Entfernung dessen.

Ich möchte in nachfolgenden posts nun Log-Dateien von MWB, OTL und evtl. Combofix einstellen und wäre sehr froh wenn mir einer der erfahrenen Leute hier diese Logs beurteilen könnte ob das System nun wirklich Frei ist.

Danke und gruß

Hier die Log von MWB:
---------------------



Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4119

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18904

20.05.2010 21:02:36
mbam-log-2010-05-20 (21-02-36).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 123553
Laufzeit: 3 Minute(n), 6 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)



erklärt sich ehrlich gesagt für mich von selbst, nur zur übersicht.

Alt 20.05.2010, 20:15   #2
Marcus81
 
Antispy Soft Virus - Standard

Antispy Soft Virus


Und nun OTL Logfile:
--------------------



Code:
ATTFilter
OTL logfile created on: 20.05.2010 21:08:24 - Run 3
OTL by OldTimer - Version 3.2.5.0     Folder = C:\Users\Iguana\Desktop
64bit-Windows Vista Ultimate Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 67,00% Memory free
8,00 Gb Paging File | 7,00 Gb Available in Paging File | 83,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 48,83 Gb Total Space | 14,46 Gb Free Space | 29,60% Space Free | Partition Type: NTFS
Drive D: | 277,51 Gb Total Space | 164,78 Gb Free Space | 59,38% Space Free | Partition Type: NTFS
Drive E: | 308,23 Gb Total Space | 159,05 Gb Free Space | 51,60% Space Free | Partition Type: NTFS
Drive F: | 100,00 Mb Total Space | 71,69 Mb Free Space | 71,69% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
Drive H: | 20,58 Gb Total Space | 17,76 Gb Free Space | 86,30% Space Free | Partition Type: NTFS
I: Drive not present or media not loaded
 
Computer Name: IGUANA-PC
Current User Name: Iguana
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
 
========== Processes (SafeList) ==========
 
PRC - [2010.05.20 20:58:44 | 000,571,904 | ---- | M] (OldTimer Tools) -- C:\Users\Iguana\Desktop\OTL.exe
PRC - [2010.04.07 17:38:20 | 000,908,248 | ---- | M] (Mozilla Corporation) -- E:\Mozilla Firefox\firefox.exe
PRC - [2010.03.28 14:39:17 | 000,133,368 | ---- | M] (ICQ, LLC.) -- E:\ICQ7.0\ICQ.exe
PRC - [2007.01.09 09:48:58 | 000,147,456 | ---- | M] (Razer Inc.) -- C:\Program Files (x86)\Razer\Copperhead\razerofa.exe
PRC - [2005.11.25 10:54:32 | 000,147,456 | ---- | M] () -- C:\Program Files (x86)\Razer\Copperhead\razertra.exe
PRC - [2005.11.25 10:53:40 | 000,155,648 | ---- | M] () -- C:\Program Files (x86)\Razer\Copperhead\razerhid.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2010.05.20 20:58:44 | 000,571,904 | ---- | M] (OldTimer Tools) -- C:\Users\Iguana\Desktop\OTL.exe
MOD - [2009.04.10 23:28:20 | 000,450,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\comdlg32.dll
MOD - [2008.01.21 04:49:08 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\msscript.ocx
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2009.12.09 20:30:34 | 000,017,416 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Essentials\MsMpEng.exe -- (MsMpSvc)
SRV:64bit: - [2009.09.25 03:26:26 | 001,142,272 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\FntCache.dll -- (FontCache)
SRV:64bit: - [2009.08.06 18:55:00 | 001,038,088 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe -- (FLEXnet Licensing Service 64)
SRV:64bit: - [2009.07.02 19:16:05 | 000,203,264 | ---- | M] (AMD) [Disabled | Stopped] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009.04.11 00:11:28 | 000,252,928 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\umrdp.dll -- (UmRdpService)
SRV:64bit: - [2009.04.11 00:11:16 | 000,604,672 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\cscsvc.dll -- (CscService)
SRV:64bit: - [2009.04.11 00:11:06 | 001,149,440 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wbengine.exe -- (wbengine)
SRV:64bit: - [2008.01.21 04:50:23 | 000,195,584 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV:64bit: - [2008.01.21 04:47:07 | 000,689,152 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\fxssvc.exe -- (Fax)
SRV:64bit: - [2007.11.26 15:13:06 | 000,025,600 | ---- | M] (E-MU Systems) [Auto | Running] -- C:\Windows\SysNative\emaudsv.exe -- (emaudsv)
SRV:64bit: - [2006.11.02 13:17:42 | 000,022,016 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\irmon.dll -- (Irmon)
SRV - [2009.08.06 18:54:54 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2009.07.20 11:51:52 | 000,935,208 | ---- | M] (Nero AG) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2009.05.05 05:45:50 | 000,124,256 | ---- | M] () [Auto | Stopped] -- E:\AMD\OverDrive\AODAssist.exe -- (AODService)
SRV - [2009.03.29 21:39:56 | 000,089,920 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_64)
SRV - [2008.04.07 09:17:30 | 000,430,592 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2006.11.02 15:34:14 | 000,000,000 | ---D | M] [Unknown | Stopped] -- C:\Windows\SysWOW64\Msdtc -- (MSDTC)
SRV - [2006.11.02 08:35:15 | 000,060,994 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\SysWOW64\wbem\vds.mof -- (vds)
SRV - [2006.11.02 08:35:15 | 000,055,846 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\SysWOW64\wbem\vss.mof -- (VSS)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2009.11.06 03:20:33 | 000,314,016 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\atksgt.sys -- (atksgt)
DRV:64bit: - [2009.11.06 03:20:33 | 000,043,680 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\lirsgt.sys -- (lirsgt)
DRV:64bit: - [2009.10.01 02:51:42 | 000,046,592 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\wpdusb.sys -- (WpdUsb)
DRV:64bit: - [2009.09.23 11:42:58 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\hamachi.sys -- (hamachi)
DRV:64bit: - [2009.07.19 11:06:00 | 000,019,912 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\pwdrvio.sys -- (pwdrvio)
DRV:64bit: - [2009.07.19 11:05:58 | 000,013,264 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\pwdspio.sys -- (pwdspio)
DRV:64bit: - [2009.07.02 19:51:28 | 006,036,480 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2009.05.23 01:08:37 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\VClone.sys -- (VClone)
DRV:64bit: - [2009.04.11 00:15:32 | 000,160,744 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\fvevol.sys -- (fvevol)
DRV:64bit: - [2009.04.10 22:39:52 | 000,275,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HdAudio.sys -- (HdAudAddService)
DRV:64bit: - [2009.04.10 22:39:36 | 000,098,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaudio.sys -- (usbaudio) USB-Audiotreiber (WDM)
DRV:64bit: - [2009.04.10 21:56:26 | 000,460,800 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\csc.sys -- (CSC)
DRV:64bit: - [2009.03.20 10:01:30 | 000,157,696 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ss_bmdm.sys -- (ss_bmdm)
DRV:64bit: - [2009.03.20 10:01:30 | 000,116,224 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ss_bbus.sys -- (ss_bbus) SAMSUNG USB Mobile Device (WDM)
DRV:64bit: - [2009.03.20 10:01:30 | 000,018,944 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ss_bmdfl.sys -- (ss_bmdfl) SAMSUNG USB Mobile Modem (Filter)
DRV:64bit: - [2009.02.17 19:11:25 | 000,031,400 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\ElbyCDIO.sys -- (ElbyCDIO)
DRV:64bit: - [2008.08.06 10:26:08 | 000,174,592 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\Rtlh64.sys -- (RTL8169)
DRV:64bit: - [2008.06.27 07:51:10 | 000,088,632 | ---- | M] (Adobe Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\adfs.sys -- (adfs)
DRV:64bit: - [2008.04.28 15:25:06 | 000,016,400 | ---- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\AtiPcie.sys -- (AtiPcie) ATI PCI Express (3GIO)
DRV:64bit: - [2008.01.21 04:48:11 | 000,119,296 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\irda.sys -- (irda)
DRV:64bit: - [2008.01.21 04:46:08 | 000,027,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\irsir.sys -- (irsir)
DRV:64bit: - [2007.11.26 15:15:06 | 000,213,272 | ---- | M] (E-MU Systems) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\emusba10.sys -- (emusba10)
DRV:64bit: - [2007.09.17 15:53:34 | 000,029,184 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\pccsmcfdx64.sys -- (pccsmcfd)
DRV:64bit: - [2007.08.15 23:50:06 | 000,688,640 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\netr28ux.sys -- (netr28ux)
DRV:64bit: - [2006.11.16 16:58:46 | 000,031,248 | ---- | M] (SIA Syncrosoft) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SynUSB64.sys -- (SynasUSB)
DRV:64bit: - [2006.05.24 11:51:14 | 000,013,824 | ---- | M] (Razer (Asia-Pacific) Pte Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\copperhd.sys -- (copperhd)
DRV:64bit: - [2005.10.21 17:01:22 | 000,019,200 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\usbicp.sys -- (uisp)
DRV:64bit: - [2005.09.23 23:18:34 | 000,261,120 | ---- | M] (Pinnacle Systems GmbH) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\MarvinBus64.sys -- (MarvinBus)
DRV - [2009.08.06 00:34:21 | 000,000,000 | ---D | M] [Kernel | System | Running] -- C:\Windows\CSC -- (CSC)
DRV - [2009.05.25 14:01:38 | 000,089,256 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysWOW64\ElbyCDIO.dll -- (ElbyCDIO)
DRV - [2009.03.31 09:39:36 | 000,016,392 | ---- | M] (Teruten Inc) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys -- (TFsExDisk)
DRV - [2008.08.14 07:57:42 | 000,074,720 | ---- | M] (Adobe Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysWOW64\drivers\adfs.sys -- (adfs)
DRV - [2006.09.18 23:36:40 | 000,003,066 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysWOW64\wbem\tcpip.mof -- (Tcpip)
DRV - [2006.09.18 23:35:23 | 000,001,088 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\wbem\mpsdrv.mof -- (mpsdrv)
DRV - [2004.08.31 18:47:34 | 000,021,888 | ---- | M] (Syncrosoft GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\synUSB64.sys -- (SynasUSB)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555
 
========== FireFox ==========
 
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: hidemenubar@moztw.org:1.0.20090705
FF - prefs.js..extensions.enabledItems: myfxva@Merci.chao:1.2.1
FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.5.2
FF - prefs.js..extensions.enabledItems: {e213bb8f-8ebd-11db-96b7-005056c00008}:3.0.0.56
FF - prefs.js..extensions.enabledItems: nasanightlaunch@example.com:0.6.20090630
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.2\extensions\\Components: E:\Mozilla Firefox\components [2010.04.07 17:38:21 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.2\extensions\\Plugins: E:\Mozilla Firefox\plugins [2010.04.07 17:38:21 | 000,000,000 | ---D | M]
 
[2009.08.09 19:08:06 | 000,000,000 | ---D | M] -- C:\Users\Iguana\AppData\Roaming\mozilla\Extensions
[2010.05.20 12:32:32 | 000,000,000 | ---D | M] -- C:\Users\Iguana\AppData\Roaming\mozilla\Firefox\Profiles\ds2tdsh8.default\extensions
[2009.08.12 22:18:29 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Iguana\AppData\Roaming\mozilla\Firefox\Profiles\ds2tdsh8.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009.08.09 20:10:18 | 000,000,000 | ---D | M] (myFireFox) -- C:\Users\Iguana\AppData\Roaming\mozilla\Firefox\Profiles\ds2tdsh8.default\extensions\{e213bb8f-8ebd-11db-96b7-005056c00008}
[2009.08.25 01:16:13 | 000,000,000 | ---D | M] -- C:\Users\Iguana\AppData\Roaming\mozilla\Firefox\Profiles\ds2tdsh8.default\extensions\hidemenubar@moztw.org
[2009.08.24 15:33:28 | 000,000,000 | ---D | M] -- C:\Users\Iguana\AppData\Roaming\mozilla\Firefox\Profiles\ds2tdsh8.default\extensions\myfxva@Merci.chao
[2009.08.09 20:15:49 | 000,000,000 | ---D | M] -- C:\Users\Iguana\AppData\Roaming\mozilla\Firefox\Profiles\ds2tdsh8.default\extensions\nasanightlaunch@example.com
[2010.04.12 11:40:14 | 000,000,000 | ---D | M] -- C:\Users\Iguana\AppData\Roaming\mozilla\Firefox\Profiles\ds2tdsh8.default\extensions\personas@christopher.beard
 
O1 HOSTS File: ([2010.05.20 13:39:39 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1       localhost
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [MSSE] C:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Copperhead] C:\Program Files (x86)\Razer\Copperhead\razerhid.exe ()
O4 - HKLM..\Run: [NPSStartup]  File not found
O4 - HKCU..\Run: [AdobeBridge]  File not found
O4 - HKCU..\Run: [PlayNC Launcher]  File not found
O4 - HKCU..\Run: [zASRockInstantBoot]  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O8:64bit: - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9 - Extra Button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - E:\ICQ7.0\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - E:\ICQ7.0\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~3\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (acaptuser64.dll) - C:\Windows\SysNative\acaptuser64.dll (Adobe Systems, Inc.)
O20 - AppInit_DLLs: (acaptuser32.dll) - C:\Windows\SysWow64\acaptuser32.dll (Adobe Systems, Inc.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Iguana\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Iguana\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.08.29 20:59:27 | 000,000,000 | ---- | M] () - D:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{d9fb5593-8227-11de-9714-001966d12233}\Shell - "" = AutoRun
O33 - MountPoints2\{d9fb5593-8227-11de-9714-001966d12233}\Shell\AutoRun\command - "" = I:\Autorun.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.05.20 20:58:40 | 000,571,904 | ---- | C] (OldTimer Tools) -- C:\Users\Iguana\Desktop\OTL.exe
[2010.05.20 14:09:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Antimalware
[2010.05.20 14:09:55 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Security Essentials
[2010.05.20 12:01:06 | 000,000,000 | ---D | C] -- C:\Users\Iguana\AppData\Roaming\Malwarebytes
[2010.05.20 12:00:56 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010.05.20 12:00:56 | 000,024,664 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2010.05.20 12:00:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2010.05.20 12:00:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.05.20 02:36:37 | 000,000,000 | ---D | C] -- C:\Users\Iguana\AppData\Local\pmaignyxo
[2010.05.12 19:17:51 | 000,000,000 | ---D | C] -- C:\Users\Iguana\Documents\EVE
[2010.05.12 19:17:47 | 000,000,000 | ---D | C] -- C:\Users\Iguana\AppData\Local\CCP
[2010.05.12 16:59:43 | 000,000,000 | ---D | C] -- C:\ProgramData\CCP
 
========== Files - Modified Within 30 Days ==========
 
[2010.05.20 21:08:38 | 003,670,016 | -HS- | M] () -- C:\Users\Iguana\NTUSER.DAT
[2010.05.20 20:58:44 | 000,571,904 | ---- | M] (OldTimer Tools) -- C:\Users\Iguana\Desktop\OTL.exe
[2010.05.20 20:33:16 | 003,692,419 | ---- | M] () -- C:\Users\Iguana\Desktop\ComboFix.exe
[2010.05.20 20:22:56 | 001,447,804 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2010.05.20 20:22:56 | 000,628,672 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2010.05.20 20:22:56 | 000,595,748 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2010.05.20 20:22:56 | 000,127,400 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2010.05.20 20:22:56 | 000,105,078 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2010.05.20 20:16:41 | 000,004,144 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.05.20 20:16:41 | 000,004,144 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.05.20 20:16:38 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.05.20 20:16:34 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.05.20 14:47:00 | 000,524,288 | -HS- | M] () -- C:\Users\Iguana\NTUSER.DAT{a7bdf3ed-6a85-11db-b5ae-f1534be43d84}.TMContainer00000000000000000001.regtrans-ms
[2010.05.20 14:47:00 | 000,065,536 | -HS- | M] () -- C:\Users\Iguana\NTUSER.DAT{a7bdf3ed-6a85-11db-b5ae-f1534be43d84}.TM.blf
[2010.05.20 14:46:58 | 004,332,211 | -H-- | M] () -- C:\Users\Iguana\AppData\Local\IconCache.db
[2010.05.20 14:23:03 | 003,023,896 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2010.05.20 13:56:22 | 000,130,768 | ---- | M] () -- C:\Users\Iguana\AppData\Local\GDIPFONTCACHEV1.DAT
[2010.05.20 12:00:59 | 000,000,856 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.05.20 00:54:22 | 000,000,420 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{7AFB0474-E6FD-4B7F-88FF-908D2A6DD9AD}.job
[2010.05.19 23:34:36 | 000,000,116 | ---- | M] () -- C:\Users\Iguana\Documents\aionmemo_3badb7c3.dat
[2010.05.12 17:31:23 | 000,000,576 | ---- | M] () -- C:\Users\Iguana\Desktop\EVE.lnk
[2010.05.11 21:08:19 | 000,002,225 | ---- | M] () -- C:\Users\Iguana\Desktop\freenet SMS.lnk
[2010.05.05 12:44:09 | 002,346,401 | ---- | M] () -- C:\Users\Iguana\Desktop\Bhagavad-Gita.pdf
[2010.05.05 00:27:49 | 000,227,960 | ---- | M] () -- C:\Users\Iguana\Desktop\raumakustik.pdf
[2010.04.29 12:19:24 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010.04.29 12:19:14 | 000,024,664 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
 
========== Files Created - No Company Name ==========
 
[2010.05.20 20:33:12 | 003,692,419 | ---- | C] () -- C:\Users\Iguana\Desktop\ComboFix.exe
[2010.05.20 12:00:59 | 000,000,856 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.05.12 17:31:23 | 000,000,576 | ---- | C] () -- C:\Users\Iguana\Desktop\EVE.lnk
[2010.05.05 12:44:09 | 002,346,401 | ---- | C] () -- C:\Users\Iguana\Desktop\Bhagavad-Gita.pdf
[2010.05.05 00:27:49 | 000,227,960 | ---- | C] () -- C:\Users\Iguana\Desktop\raumakustik.pdf
[2010.04.24 00:46:30 | 000,432,036 | ---- | C] () -- C:\Users\Iguana\AppData\Local\dd_vcredistMSI57E0.txt
[2010.04.24 00:46:30 | 000,011,450 | ---- | C] () -- C:\Users\Iguana\AppData\Local\dd_vcredistUI57E0.txt
[2010.02.04 01:18:44 | 000,011,910 | ---- | C] () -- C:\Windows\SysWow64\Genmidi.dll
[2010.02.04 01:18:44 | 000,011,910 | ---- | C] () -- C:\Windows\Genmidi.dll
[2009.11.06 11:58:04 | 000,178,975 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2009.10.21 18:21:09 | 000,000,272 | ---- | C] () -- C:\Windows\_delis32.ini
[2009.09.30 13:52:56 | 009,916,928 | ---- | C] () -- C:\Windows\SysWow64\tliadjust34.dll
[2009.08.10 04:03:14 | 000,237,568 | R--- | C] () -- C:\Windows\SysWow64\qtmlClient.dll
[2009.08.10 04:03:14 | 000,000,000 | ---- | C] () -- C:\Windows\Graffiti5.2Pin.ini
[2009.08.07 16:45:33 | 001,475,582 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2009.08.06 03:05:48 | 000,368,640 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.08.06 03:05:41 | 000,117,248 | ---- | C] () -- C:\Windows\SysWow64\EhStorAuthn.dll
[2009.08.06 00:54:44 | 000,004,801 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
[2009.03.02 12:33:32 | 000,067,584 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2009.03.02 12:33:32 | 000,000,547 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll.manifest
[2008.10.07 09:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelTraditionalChinese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSwedish.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSpanish.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelPortugese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelKorean.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelJapanese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelGerman.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelFrench.dll
[2008.06.05 08:58:26 | 000,197,912 | ---- | C] () -- C:\Windows\SysWow64\physxcudart_20.dll
[2008.02.08 17:13:44 | 000,319,488 | ---- | C] () -- C:\Windows\SysWow64\LS3Renderer.dll
[2008.01.21 04:49:10 | 000,060,124 | ---- | C] () -- C:\Windows\SysWow64\tcpmon.ini
[2007.10.25 17:26:10 | 000,005,632 | ---- | C] () -- C:\Windows\SysWow64\drivers\StarOpen.sys
[2007.01.26 02:04:12 | 000,138,752 | ---- | C] () -- C:\Windows\SysWow64\mase32.dll
[2007.01.26 02:04:12 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\ma32.dll
[2006.10.11 05:33:58 | 000,010,288 | ---- | C] () -- C:\Windows\SysWow64\drivers\ASUSHWIO.SYS
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 853 bytes -> C:\Users\Iguana\Musikhaus Thomann Kundencenter.eml:OECustomProperty
< End of report >




--- combofix folgt im anschluß
__________________
Alt 20.05.2010, 20:17   #3
Marcus81
 
Antispy Soft Virus - Standard

Antispy Soft Virus


Ich musste grad feststellen das Cofi. nur win32 - Xp oder 2000 fähig ist.

Werd mal schauen ob es da was für vista 64 gibt...

Logfile OTL
__________________
Geändert von Marcus81 (20.05.2010 um 20:27 Uhr) Grund: nachtrag

Alt 20.05.2010, 21:24   #4
Marcus81
 
Antispy Soft Virus - Standard

Antispy Soft Virus


Nachdem ich mich grade schlau gemacht habe, musste ich feststellen das es combofix nicht als 64bit v. gibt.

Es wäre trotzdem sehr nett wenn jemand meine Logs beurteilen könnte ob das System nun frei ist. Der PC macht soweit keine probleme mehr aber ich weiss es halt nicht genau.

Gruß

Alt 21.05.2010, 23:59   #5
Marcus81
 
Antispy Soft Virus - Standard

Antispy Soft Virus


Ich muss noch hinzufügen das bei manchen progs und online-spielen kein autoupdate mehr funktioniert, was die die nutzung teils unmöglich macht.

Mit den gängigen Tools wie Mbam, Ccleaner, Otl, und MD essentials hab ich soweit alles sauber bekommen.

Dennoch bleiben die update probleme da sich die progs nicht mit den update servern verbinden können.

Ist das prob vllt. in einer Netzwerk config zu suchen die der Antispysoft zurück gelassen hat?

gruß und immer noch um Hilfe bittend...


Alt 22.05.2010, 02:01   #6
Marcus81
 
Antispy Soft Virus - Standard

Antispy Soft Virus


HIJACK THIS Logfile
-------------------
Code:
ATTFilter
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 02:54:01, on 22.05.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18904)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Razer\Copperhead\razerhid.exe
C:\Program Files (x86)\Razer\Copperhead\razertra.exe
C:\Program Files (x86)\Razer\Copperhead\razerofa.exe
C:\Program Files (x86)\Internet Explorer\IELowutil.exe
C:\Users\Iguana\Downloads\HiJackThis204.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5555
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ÿþ127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 206.127.155.35 aion.patcher.ncsoft.com
O1 - Hosts: 206.127.155.36 aion.patcher.ncsoft.com
O1 - Hosts: 206.127.155.37 aion.patcher.ncsoft.com
O1 - Hosts: 206.127.155.38 aion.patcher.ncsoft.com
O1 - Hosts: 206.127.155.39 aion.patcher.ncsoft.com
O1 - Hosts: 206.127.155.40 aion.patcher.ncsoft.com
O1 - Hosts: 206.127.155.41 aion.patcher.ncsoft.com
O1 - Hosts: 206.127.155.42 aion.patcher.ncsoft.com
O1 - Hosts: 206.127.155.43 aion.patcher.ncsoft.com
O1 - Hosts: 206.127.155.44 aion.patcher.ncsoft.com
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Copperhead] "C:\Program Files (x86)\Razer\Copperhead\razerhid.exe"
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - E:\ICQ7.0\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - E:\ICQ7.0\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~3\Office12\REFIEBAR.DLL
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: acaptuser32.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AODService - Unknown owner - E:\AMD\OverDrive\AODAssist.exe
O23 - Service: ASP.NET-Zustandsdienst (aspnet_state) - Unknown owner - C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: E-MU Audio Service (emaudsv) - Unknown owner - C:\Windows\system32\emaudsv.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FLEXnet Licensing Service 64 - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

--
End of file - 7986 bytes





BMAM - Letzter Log
-------------------
Code:
ATTFilter
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4119

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18904

20.05.2010 21:02:36
mbam-log-2010-05-20 (21-02-36).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 123553
Laufzeit: 3 Minute(n), 6 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)




OTL - Letzter Log
-----------------
Code:
ATTFilter
OTL logfile created on: 20.05.2010 21:08:24 - Run 3
OTL by OldTimer - Version 3.2.5.0     Folder = C:\Users\Iguana\Desktop
64bit-Windows Vista Ultimate Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 67,00% Memory free
8,00 Gb Paging File | 7,00 Gb Available in Paging File | 83,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 48,83 Gb Total Space | 14,46 Gb Free Space | 29,60% Space Free | Partition Type: NTFS
Drive D: | 277,51 Gb Total Space | 164,78 Gb Free Space | 59,38% Space Free | Partition Type: NTFS
Drive E: | 308,23 Gb Total Space | 159,05 Gb Free Space | 51,60% Space Free | Partition Type: NTFS
Drive F: | 100,00 Mb Total Space | 71,69 Mb Free Space | 71,69% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
Drive H: | 20,58 Gb Total Space | 17,76 Gb Free Space | 86,30% Space Free | Partition Type: NTFS
I: Drive not present or media not loaded
 
Computer Name: IGUANA-PC
Current User Name: Iguana
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
 
========== Processes (SafeList) ==========
 
PRC - [2010.05.20 20:58:44 | 000,571,904 | ---- | M] (OldTimer Tools) -- C:\Users\Iguana\Desktop\OTL.exe
PRC - [2010.04.07 17:38:20 | 000,908,248 | ---- | M] (Mozilla Corporation) -- E:\Mozilla Firefox\firefox.exe
PRC - [2010.03.28 14:39:17 | 000,133,368 | ---- | M] (ICQ, LLC.) -- E:\ICQ7.0\ICQ.exe
PRC - [2007.01.09 09:48:58 | 000,147,456 | ---- | M] (Razer Inc.) -- C:\Program Files (x86)\Razer\Copperhead\razerofa.exe
PRC - [2005.11.25 10:54:32 | 000,147,456 | ---- | M] () -- C:\Program Files (x86)\Razer\Copperhead\razertra.exe
PRC - [2005.11.25 10:53:40 | 000,155,648 | ---- | M] () -- C:\Program Files (x86)\Razer\Copperhead\razerhid.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2010.05.20 20:58:44 | 000,571,904 | ---- | M] (OldTimer Tools) -- C:\Users\Iguana\Desktop\OTL.exe
MOD - [2009.04.10 23:28:20 | 000,450,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\comdlg32.dll
MOD - [2008.01.21 04:49:08 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\msscript.ocx
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2009.12.09 20:30:34 | 000,017,416 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Essentials\MsMpEng.exe -- (MsMpSvc)
SRV:64bit: - [2009.09.25 03:26:26 | 001,142,272 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\FntCache.dll -- (FontCache)
SRV:64bit: - [2009.08.06 18:55:00 | 001,038,088 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe -- (FLEXnet Licensing Service 64)
SRV:64bit: - [2009.07.02 19:16:05 | 000,203,264 | ---- | M] (AMD) [Disabled | Stopped] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2009.04.11 00:11:28 | 000,252,928 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\umrdp.dll -- (UmRdpService)
SRV:64bit: - [2009.04.11 00:11:16 | 000,604,672 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\cscsvc.dll -- (CscService)
SRV:64bit: - [2009.04.11 00:11:06 | 001,149,440 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wbengine.exe -- (wbengine)
SRV:64bit: - [2008.01.21 04:50:23 | 000,195,584 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV:64bit: - [2008.01.21 04:47:07 | 000,689,152 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\fxssvc.exe -- (Fax)
SRV:64bit: - [2007.11.26 15:13:06 | 000,025,600 | ---- | M] (E-MU Systems) [Auto | Running] -- C:\Windows\SysNative\emaudsv.exe -- (emaudsv)
SRV:64bit: - [2006.11.02 13:17:42 | 000,022,016 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\irmon.dll -- (Irmon)
SRV - [2009.08.06 18:54:54 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2009.07.20 11:51:52 | 000,935,208 | ---- | M] (Nero AG) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2009.05.05 05:45:50 | 000,124,256 | ---- | M] () [Auto | Stopped] -- E:\AMD\OverDrive\AODAssist.exe -- (AODService)
SRV - [2009.03.29 21:39:56 | 000,089,920 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_64)
SRV - [2008.04.07 09:17:30 | 000,430,592 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2006.11.02 15:34:14 | 000,000,000 | ---D | M] [Unknown | Stopped] -- C:\Windows\SysWOW64\Msdtc -- (MSDTC)
SRV - [2006.11.02 08:35:15 | 000,060,994 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\SysWOW64\wbem\vds.mof -- (vds)
SRV - [2006.11.02 08:35:15 | 000,055,846 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\SysWOW64\wbem\vss.mof -- (VSS)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2009.11.06 03:20:33 | 000,314,016 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\atksgt.sys -- (atksgt)
DRV:64bit: - [2009.11.06 03:20:33 | 000,043,680 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\lirsgt.sys -- (lirsgt)
DRV:64bit: - [2009.10.01 02:51:42 | 000,046,592 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\wpdusb.sys -- (WpdUsb)
DRV:64bit: - [2009.09.23 11:42:58 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\hamachi.sys -- (hamachi)
DRV:64bit: - [2009.07.19 11:06:00 | 000,019,912 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\pwdrvio.sys -- (pwdrvio)
DRV:64bit: - [2009.07.19 11:05:58 | 000,013,264 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\pwdspio.sys -- (pwdspio)
DRV:64bit: - [2009.07.02 19:51:28 | 006,036,480 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2009.05.23 01:08:37 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\VClone.sys -- (VClone)
DRV:64bit: - [2009.04.11 00:15:32 | 000,160,744 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\fvevol.sys -- (fvevol)
DRV:64bit: - [2009.04.10 22:39:52 | 000,275,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HdAudio.sys -- (HdAudAddService)
DRV:64bit: - [2009.04.10 22:39:36 | 000,098,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaudio.sys -- (usbaudio) USB-Audiotreiber (WDM)
DRV:64bit: - [2009.04.10 21:56:26 | 000,460,800 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\csc.sys -- (CSC)
DRV:64bit: - [2009.03.20 10:01:30 | 000,157,696 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ss_bmdm.sys -- (ss_bmdm)
DRV:64bit: - [2009.03.20 10:01:30 | 000,116,224 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ss_bbus.sys -- (ss_bbus) SAMSUNG USB Mobile Device (WDM)
DRV:64bit: - [2009.03.20 10:01:30 | 000,018,944 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ss_bmdfl.sys -- (ss_bmdfl) SAMSUNG USB Mobile Modem (Filter)
DRV:64bit: - [2009.02.17 19:11:25 | 000,031,400 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\ElbyCDIO.sys -- (ElbyCDIO)
DRV:64bit: - [2008.08.06 10:26:08 | 000,174,592 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\Rtlh64.sys -- (RTL8169)
DRV:64bit: - [2008.06.27 07:51:10 | 000,088,632 | ---- | M] (Adobe Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\adfs.sys -- (adfs)
DRV:64bit: - [2008.04.28 15:25:06 | 000,016,400 | ---- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\AtiPcie.sys -- (AtiPcie) ATI PCI Express (3GIO)
DRV:64bit: - [2008.01.21 04:48:11 | 000,119,296 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\irda.sys -- (irda)
DRV:64bit: - [2008.01.21 04:46:08 | 000,027,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\irsir.sys -- (irsir)
DRV:64bit: - [2007.11.26 15:15:06 | 000,213,272 | ---- | M] (E-MU Systems) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\emusba10.sys -- (emusba10)
DRV:64bit: - [2007.09.17 15:53:34 | 000,029,184 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\pccsmcfdx64.sys -- (pccsmcfd)
DRV:64bit: - [2007.08.15 23:50:06 | 000,688,640 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\netr28ux.sys -- (netr28ux)
DRV:64bit: - [2006.11.16 16:58:46 | 000,031,248 | ---- | M] (SIA Syncrosoft) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SynUSB64.sys -- (SynasUSB)
DRV:64bit: - [2006.05.24 11:51:14 | 000,013,824 | ---- | M] (Razer (Asia-Pacific) Pte Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\copperhd.sys -- (copperhd)
DRV:64bit: - [2005.10.21 17:01:22 | 000,019,200 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\usbicp.sys -- (uisp)
DRV:64bit: - [2005.09.23 23:18:34 | 000,261,120 | ---- | M] (Pinnacle Systems GmbH) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\MarvinBus64.sys -- (MarvinBus)
DRV - [2009.08.06 00:34:21 | 000,000,000 | ---D | M] [Kernel | System | Running] -- C:\Windows\CSC -- (CSC)
DRV - [2009.05.25 14:01:38 | 000,089,256 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysWOW64\ElbyCDIO.dll -- (ElbyCDIO)
DRV - [2009.03.31 09:39:36 | 000,016,392 | ---- | M] (Teruten Inc) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys -- (TFsExDisk)
DRV - [2008.08.14 07:57:42 | 000,074,720 | ---- | M] (Adobe Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysWOW64\drivers\adfs.sys -- (adfs)
DRV - [2006.09.18 23:36:40 | 000,003,066 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysWOW64\wbem\tcpip.mof -- (Tcpip)
DRV - [2006.09.18 23:35:23 | 000,001,088 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\wbem\mpsdrv.mof -- (mpsdrv)
DRV - [2004.08.31 18:47:34 | 000,021,888 | ---- | M] (Syncrosoft GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\synUSB64.sys -- (SynasUSB)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555
 
========== FireFox ==========
 
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: hidemenubar@moztw.org:1.0.20090705
FF - prefs.js..extensions.enabledItems: myfxva@Merci.chao:1.2.1
FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.5.2
FF - prefs.js..extensions.enabledItems: {e213bb8f-8ebd-11db-96b7-005056c00008}:3.0.0.56
FF - prefs.js..extensions.enabledItems: nasanightlaunch@example.com:0.6.20090630
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.2\extensions\\Components: E:\Mozilla Firefox\components [2010.04.07 17:38:21 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.2\extensions\\Plugins: E:\Mozilla Firefox\plugins [2010.04.07 17:38:21 | 000,000,000 | ---D | M]
 
[2009.08.09 19:08:06 | 000,000,000 | ---D | M] -- C:\Users\Iguana\AppData\Roaming\mozilla\Extensions
[2010.05.20 12:32:32 | 000,000,000 | ---D | M] -- C:\Users\Iguana\AppData\Roaming\mozilla\Firefox\Profiles\ds2tdsh8.default\extensions
[2009.08.12 22:18:29 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Iguana\AppData\Roaming\mozilla\Firefox\Profiles\ds2tdsh8.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009.08.09 20:10:18 | 000,000,000 | ---D | M] (myFireFox) -- C:\Users\Iguana\AppData\Roaming\mozilla\Firefox\Profiles\ds2tdsh8.default\extensions\{e213bb8f-8ebd-11db-96b7-005056c00008}
[2009.08.25 01:16:13 | 000,000,000 | ---D | M] -- C:\Users\Iguana\AppData\Roaming\mozilla\Firefox\Profiles\ds2tdsh8.default\extensions\hidemenubar@moztw.org
[2009.08.24 15:33:28 | 000,000,000 | ---D | M] -- C:\Users\Iguana\AppData\Roaming\mozilla\Firefox\Profiles\ds2tdsh8.default\extensions\myfxva@Merci.chao
[2009.08.09 20:15:49 | 000,000,000 | ---D | M] -- C:\Users\Iguana\AppData\Roaming\mozilla\Firefox\Profiles\ds2tdsh8.default\extensions\nasanightlaunch@example.com
[2010.04.12 11:40:14 | 000,000,000 | ---D | M] -- C:\Users\Iguana\AppData\Roaming\mozilla\Firefox\Profiles\ds2tdsh8.default\extensions\personas@christopher.beard
 
O1 HOSTS File: ([2010.05.20 13:39:39 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1       localhost
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [MSSE] C:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Copperhead] C:\Program Files (x86)\Razer\Copperhead\razerhid.exe ()
O4 - HKLM..\Run: [NPSStartup]  File not found
O4 - HKCU..\Run: [AdobeBridge]  File not found
O4 - HKCU..\Run: [PlayNC Launcher]  File not found
O4 - HKCU..\Run: [zASRockInstantBoot]  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O8:64bit: - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9 - Extra Button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - E:\ICQ7.0\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - E:\ICQ7.0\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~3\Office12\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (acaptuser64.dll) - C:\Windows\SysNative\acaptuser64.dll (Adobe Systems, Inc.)
O20 - AppInit_DLLs: (acaptuser32.dll) - C:\Windows\SysWow64\acaptuser32.dll (Adobe Systems, Inc.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Iguana\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Iguana\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.08.29 20:59:27 | 000,000,000 | ---- | M] () - D:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{d9fb5593-8227-11de-9714-001966d12233}\Shell - "" = AutoRun
O33 - MountPoints2\{d9fb5593-8227-11de-9714-001966d12233}\Shell\AutoRun\command - "" = I:\Autorun.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.05.20 20:58:40 | 000,571,904 | ---- | C] (OldTimer Tools) -- C:\Users\Iguana\Desktop\OTL.exe
[2010.05.20 14:09:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Antimalware
[2010.05.20 14:09:55 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Security Essentials
[2010.05.20 12:01:06 | 000,000,000 | ---D | C] -- C:\Users\Iguana\AppData\Roaming\Malwarebytes
[2010.05.20 12:00:56 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010.05.20 12:00:56 | 000,024,664 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2010.05.20 12:00:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2010.05.20 12:00:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.05.20 02:36:37 | 000,000,000 | ---D | C] -- C:\Users\Iguana\AppData\Local\pmaignyxo
[2010.05.12 19:17:51 | 000,000,000 | ---D | C] -- C:\Users\Iguana\Documents\EVE
[2010.05.12 19:17:47 | 000,000,000 | ---D | C] -- C:\Users\Iguana\AppData\Local\CCP
[2010.05.12 16:59:43 | 000,000,000 | ---D | C] -- C:\ProgramData\CCP
 
========== Files - Modified Within 30 Days ==========
 
[2010.05.20 21:08:38 | 003,670,016 | -HS- | M] () -- C:\Users\Iguana\NTUSER.DAT
[2010.05.20 20:58:44 | 000,571,904 | ---- | M] (OldTimer Tools) -- C:\Users\Iguana\Desktop\OTL.exe
[2010.05.20 20:33:16 | 003,692,419 | ---- | M] () -- C:\Users\Iguana\Desktop\ComboFix.exe
[2010.05.20 20:22:56 | 001,447,804 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2010.05.20 20:22:56 | 000,628,672 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2010.05.20 20:22:56 | 000,595,748 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2010.05.20 20:22:56 | 000,127,400 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2010.05.20 20:22:56 | 000,105,078 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2010.05.20 20:16:41 | 000,004,144 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.05.20 20:16:41 | 000,004,144 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.05.20 20:16:38 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.05.20 20:16:34 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.05.20 14:47:00 | 000,524,288 | -HS- | M] () -- C:\Users\Iguana\NTUSER.DAT{a7bdf3ed-6a85-11db-b5ae-f1534be43d84}.TMContainer00000000000000000001.regtrans-ms
[2010.05.20 14:47:00 | 000,065,536 | -HS- | M] () -- C:\Users\Iguana\NTUSER.DAT{a7bdf3ed-6a85-11db-b5ae-f1534be43d84}.TM.blf
[2010.05.20 14:46:58 | 004,332,211 | -H-- | M] () -- C:\Users\Iguana\AppData\Local\IconCache.db
[2010.05.20 14:23:03 | 003,023,896 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2010.05.20 13:56:22 | 000,130,768 | ---- | M] () -- C:\Users\Iguana\AppData\Local\GDIPFONTCACHEV1.DAT
[2010.05.20 12:00:59 | 000,000,856 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.05.20 00:54:22 | 000,000,420 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{7AFB0474-E6FD-4B7F-88FF-908D2A6DD9AD}.job
[2010.05.19 23:34:36 | 000,000,116 | ---- | M] () -- C:\Users\Iguana\Documents\aionmemo_3badb7c3.dat
[2010.05.12 17:31:23 | 000,000,576 | ---- | M] () -- C:\Users\Iguana\Desktop\EVE.lnk
[2010.05.11 21:08:19 | 000,002,225 | ---- | M] () -- C:\Users\Iguana\Desktop\freenet SMS.lnk
[2010.05.05 12:44:09 | 002,346,401 | ---- | M] () -- C:\Users\Iguana\Desktop\Bhagavad-Gita.pdf
[2010.05.05 00:27:49 | 000,227,960 | ---- | M] () -- C:\Users\Iguana\Desktop\raumakustik.pdf
[2010.04.29 12:19:24 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010.04.29 12:19:14 | 000,024,664 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
 
========== Files Created - No Company Name ==========
 
[2010.05.20 20:33:12 | 003,692,419 | ---- | C] () -- C:\Users\Iguana\Desktop\ComboFix.exe
[2010.05.20 12:00:59 | 000,000,856 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.05.12 17:31:23 | 000,000,576 | ---- | C] () -- C:\Users\Iguana\Desktop\EVE.lnk
[2010.05.05 12:44:09 | 002,346,401 | ---- | C] () -- C:\Users\Iguana\Desktop\Bhagavad-Gita.pdf
[2010.05.05 00:27:49 | 000,227,960 | ---- | C] () -- C:\Users\Iguana\Desktop\raumakustik.pdf
[2010.04.24 00:46:30 | 000,432,036 | ---- | C] () -- C:\Users\Iguana\AppData\Local\dd_vcredistMSI57E0.txt
[2010.04.24 00:46:30 | 000,011,450 | ---- | C] () -- C:\Users\Iguana\AppData\Local\dd_vcredistUI57E0.txt
[2010.02.04 01:18:44 | 000,011,910 | ---- | C] () -- C:\Windows\SysWow64\Genmidi.dll
[2010.02.04 01:18:44 | 000,011,910 | ---- | C] () -- C:\Windows\Genmidi.dll
[2009.11.06 11:58:04 | 000,178,975 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2009.10.21 18:21:09 | 000,000,272 | ---- | C] () -- C:\Windows\_delis32.ini
[2009.09.30 13:52:56 | 009,916,928 | ---- | C] () -- C:\Windows\SysWow64\tliadjust34.dll
[2009.08.10 04:03:14 | 000,237,568 | R--- | C] () -- C:\Windows\SysWow64\qtmlClient.dll
[2009.08.10 04:03:14 | 000,000,000 | ---- | C] () -- C:\Windows\Graffiti5.2Pin.ini
[2009.08.07 16:45:33 | 001,475,582 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2009.08.06 03:05:48 | 000,368,640 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.08.06 03:05:41 | 000,117,248 | ---- | C] () -- C:\Windows\SysWow64\EhStorAuthn.dll
[2009.08.06 00:54:44 | 000,004,801 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
[2009.03.02 12:33:32 | 000,067,584 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2009.03.02 12:33:32 | 000,000,547 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll.manifest
[2008.10.07 09:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelTraditionalChinese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSwedish.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSpanish.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelPortugese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelKorean.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelJapanese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelGerman.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelFrench.dll
[2008.06.05 08:58:26 | 000,197,912 | ---- | C] () -- C:\Windows\SysWow64\physxcudart_20.dll
[2008.02.08 17:13:44 | 000,319,488 | ---- | C] () -- C:\Windows\SysWow64\LS3Renderer.dll
[2008.01.21 04:49:10 | 000,060,124 | ---- | C] () -- C:\Windows\SysWow64\tcpmon.ini
[2007.10.25 17:26:10 | 000,005,632 | ---- | C] () -- C:\Windows\SysWow64\drivers\StarOpen.sys
[2007.01.26 02:04:12 | 000,138,752 | ---- | C] () -- C:\Windows\SysWow64\mase32.dll
[2007.01.26 02:04:12 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\ma32.dll
[2006.10.11 05:33:58 | 000,010,288 | ---- | C] () -- C:\Windows\SysWow64\drivers\ASUSHWIO.SYS
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 853 bytes -> C:\Users\Iguana\Musikhaus Thomann Kundencenter.eml:OECustomProperty
< End of report >


Bitte immer noch um Hilfe, da sich bezüglichd er Autoupdates von Programmen keine Besserung ergeben hat...

gruß

Alt 24.05.2010, 17:12   #7
Marcus81
 
Antispy Soft Virus - Standard

Immer noch keine Updates möglich - trotz Viren Entfernung!


Hallo zusammen,

Nachdem mein Pc durch einen "Antispysoft" Virus befallen war und ich diesen durch verschiedene Tools wie MBAM,Hijack This,MS essentials (so wie ich es in anderen Threads gelesen habe) entfernt habe, scheint der Pc sauber zu sein, dennoch funktionieren keinerlei Updates, weder durch Windows noch durch andere Progs oder Spiele.

Ich hatte einen Thread eröffnet (http://www.trojaner-board.de/86295-a...oft-virus.html) , doch ich habe keinerlei Antwort auf mein Problem bekommen. Ich habe nun alles Unternommen was ich finden konnte dennoch wünschte ich mir eine Beurteilung der Logs durch einen der Profis hier, da ich sonst nichts mehr weis außer das System zu formatieren was ich nur ungerne machen würde.

Es wäre schön wenn es diesmal nicht ignoriert werden würde.

Danke und Gruß

Alt 25.05.2010, 09:46   #8
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Antispy Soft Virus - Standard

Antispy Soft Virus


Hallo,

bitte Malwarebytes aktualisieren, einen Vollscan starten und anschließend das Log posten.
__________________
Logfiles bitte immer in CODE-Tags posten

Alt 25.05.2010, 11:12   #9
Marcus81
 
Antispy Soft Virus - Standard

Antispy Soft Virus


Hallo,

mich hat es nun gestern Abend schlussendlich so sehr genervt das ich mich entschlossen habe zu formatieren und neu aufzusetzen, was ich dann auch getan habe. Nun sind alle Probleme dahin und alles funktioniert wieder einwandfrei.

Ist nachwievor die "einfachste" Lösung, die ich zwar wegen der vielen installationen die ich dringend benötige meiden wollte, aber vielleicht war es besser so.

Ich bedanke mich dennoch das sich nach einigen Tagen und nochmaligem Hilfeschrei tatsächlich jemand gemeldet hat

danke und gruß

Antwort

Themen zu Antispy Soft Virus
abend, anderen, antispy, befallen, combofix, einstellen, entfernt, entfernung, erfahrenen, eröffnet, formatieren, funktionieren, gestern, hallo zusammen, hijack, hijack this, keine updates, keine updates möglich, leute, mbam, nichts, nötig, posts, problem, probleme, progs, soft, stelle, system, thema, this, tools, trotz, updates, verschiedene, viren, virus, von selbst, windows, wirklich


« Kann winlogon\taskman trojaner nicht entfernen, was tun? | TR/Agent.AR,TR/Click.Klik,HEUR/HTML.Malware,HTML/Crypted.Gen, dwwin.exe, drwtsu32.exe »


Ähnliche Themen: Antispy Soft Virus


  1. Ava Soft Virus
    Plagegeister aller Art und deren Bekämpfung - 26.05.2013 (25)
  2. AVA Soft Virus, einige Fragen dazu
    Plagegeister aller Art und deren Bekämpfung - 10.05.2013 (2)
  3. AVA Soft-Virus
    Plagegeister aller Art und deren Bekämpfung - 06.04.2013 (6)
  4. Antispy Safeguard
    Plagegeister aller Art und deren Bekämpfung - 24.09.2010 (3)
  5. Soft Antivirus Virus / Hardware schädigung möglich ?
    Plagegeister aller Art und deren Bekämpfung - 31.08.2010 (2)
  6. Nachwirkung von Antispy Soft
    Plagegeister aller Art und deren Bekämpfung - 04.08.2010 (14)
  7. Antispyware Soft Virus
    Log-Analyse und Auswertung - 15.06.2010 (59)
  8. Antispy Soft Virus eingefangen-Kann nichts mehr löschen-Systemwiederherstellung aus
    Log-Analyse und Auswertung - 02.06.2010 (24)
  9. Antispyware Soft / Antivirus Soft -- auf einem Benutzerkonto weg / auf dem anderen da
    Log-Analyse und Auswertung - 26.05.2010 (0)
  10. Antispyware Soft Demo VIRUS!
    Plagegeister aller Art und deren Bekämpfung - 08.05.2010 (2)
  11. Antispyware soft demo eingefangen Virus
    Plagegeister aller Art und deren Bekämpfung - 06.05.2010 (1)
  12. Google lädt bei Suche andere Seiten-Kann keine Antispy Programme installieren-Virus?
    Log-Analyse und Auswertung - 23.12.2008 (0)
  13. XP antispy empfohlen?
    Alles rund um Windows - 26.06.2008 (1)
  14. MS Antispy vs Defender
    Antiviren-, Firewall- und andere Schutzprogramme - 10.07.2006 (3)
  15. xp-AntiSpy
    Antiviren-, Firewall- und andere Schutzprogramme - 20.01.2006 (4)
  16. Antispy?
    Antiviren-, Firewall- und andere Schutzprogramme - 06.01.2006 (2)
  17. Microsoft AntiSpy
    Antiviren-, Firewall- und andere Schutzprogramme - 21.01.2005 (3)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Antispy Soft Virus - Nabend euch allen Ich habe seit gestern Probleme mit dem aufgetauchten "Antispy soft Virus". Das Thema ist ja hier bekannt und ich habe auch gelesen was nötig ist zur Entfernung - Antispy Soft Virus...
Archiv
Du betrachtest: Antispy Soft Virus auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129