Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
Backdoor:PHP/C99shell.G

Backdoor:PHP/C99shell.G


Plagegeister aller Art und deren Bekämpfung: Backdoor:PHP/C99shell.G

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 31.07.2010, 08:08   #1
WinstonWolf
 
Backdoor:PHP/C99shell.G - Standard

Backdoor:PHP/C99shell.G


Hallo

Ich habe bei Google nach der Fernsehserie "Boston Legal" gesucht.Nachdem ich auf eines der Suchergebnisse geklickt habe öffnete sich eine Seite, die sehr viel Text enthielt, der irgendwie nach einer Programiersprache aussieht. Ich habe diesen Text kopiert.Hier der Link:Datei Upload, Bilder hochladen, Datei Hosting auf Materialordner.de

Nun öffnete sich mein Antivirenprogramm (Microsoft Security Essentials),
mit folgender Meldung:
Code:
ATTFilter
Backdoor:PHP/C99shell.G

Kategorie: Hintertür

Beschreibung: Dieses Programm stellt einen Remotezugriff auf den Computer bereit, auf dem es installiert ist.

Empfehlung: Entfernen Sie diese Software unverzüglich.

Von Microsoft Security Essentials wurden Programme erkannt, die Ihre Privatsphäre verletzen oder Ihren Computer beschädigen könnten. Sie können auf die von diesen Programmen verwendeten Dateien weiterhin zugreifen, ohne sie zu entfernen (nicht empfohlen). Zum Zugreifen auf diese Dateien wählen Sie die Aktion "Zulassen" aus, und klicken Sie dann auf "Aktionen anwenden". Wenn diese Option nicht verfügbar ist, melden Sie sich als Administrator an, oder bitten Sie den lokalen Administrator um Unterstützung.

Elemente: 
containerfile:C:\Users\Michael&Diana\AppData\Local\Mozilla\Firefox\Profiles\0u7414im.default\Cache\7A6991CAd01
file:C:\Users\Michael&Diana\AppData\Local\Mozilla\Firefox\Profiles\0u7414im.default\Cache\7A6991CAd01->(SCRIPT0030)

Lesen Sie im Internet weitere Informationen zu diesem Element.
Eine Minute später kam folgende Meldung:

Code:
ATTFilter
Trojan:JS/CARDST

Kategorie: Trojaner

Beschreibung: Dieses Programm ist gefährlich. Es führt Befehle eines Angreifers aus.

Empfehlung: Entfernen Sie diese Software unverzüglich.

Von Microsoft Security Essentials wurden Programme erkannt, die Ihre Privatsphäre verletzen oder Ihren Computer beschädigen könnten. Sie können auf die von diesen Programmen verwendeten Dateien weiterhin zugreifen, ohne sie zu entfernen (nicht empfohlen). Zum Zugreifen auf diese Dateien wählen Sie die Aktion "Zulassen" aus, und klicken Sie dann auf "Aktionen anwenden". Wenn diese Option nicht verfügbar ist, melden Sie sich als Administrator an, oder bitten Sie den lokalen Administrator um Unterstützung.

Elemente: 
containerfile:C:\Users\Michael&Diana\AppData\Local\Mozilla\Firefox\Profiles\0u7414im.default\Cache\7A6991CAd01
file:C:\Users\Michael&Diana\AppData\Local\Mozilla\Firefox\Profiles\0u7414im.default\Cache\7A6991CAd01->(SCRIPT0043)->(JSNORM)->(Form)

Lesen Sie im Internet weitere Informationen zu diesem Element.
Ich habe beide Funde entfernen lassen.Seitdem keine weiteren Funde.

Hier noch Malwarebytes

Code:
ATTFilter
www.malwarebytes.org

Datenbank Version: 4373

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

31.07.2010 08:31:21
mbam-log-2010-07-31 (08-31-21).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Durchsuchte Objekte: 208177
Laufzeit: 16 Minute(n), 14 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
Und OTl

Code:
ATTFilter
OTL logfile created on: 31.07.2010 08:37:02 - Run 1
OTL by OldTimer - Version 3.2.9.1     Folder = C:\Users\Michael&Diana\Downloads
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 66,00% Memory free
8,00 Gb Paging File | 7,00 Gb Available in Paging File | 82,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 97,56 Gb Total Space | 76,93 Gb Free Space | 78,86% Space Free | Partition Type: NTFS
Drive D: | 97,66 Gb Total Space | 91,54 Gb Free Space | 93,74% Space Free | Partition Type: NTFS
Drive E: | 270,45 Gb Total Space | 202,91 Gb Free Space | 75,03% Space Free | Partition Type: NTFS
Drive F: | 397,55 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: HOMEOFFICE
Current User Name: Michael&Diana
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Michael&Diana\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\WinTV\TVServer\CaptureGenUSB.exe (Hauppauge Computer Works)
PRC - C:\Program Files (x86)\WinTV\TVServer\HauppaugeTVServer.exe (Hauppauge Computer Works)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Michael&Diana\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\SysWOW64\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (MsMpSvc) -- C:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation)
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV - (clr_optimization_v4.0.30319_64) -- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (HauppaugeTVServer) -- C:\Program Files (x86)\WinTV\TVServer\HauppaugeTVServer.exe (Hauppauge Computer Works)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (LVUVC64) Logitech Webcam 200(UVC) -- C:\Windows\SysNative\drivers\lvuvc64.sys (Logitech Inc.)
DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\wbem\ntfs.mof ()
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (hcw95rc) -- C:\Windows\SysNative\drivers\hcw95rc.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (hcw95bda) -- C:\Windows\SysNative\drivers\hcw95bda.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek Corporation                                            )
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 07 42 8D 4D F0 2F CB 01  [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.48.3
FF - prefs.js..extensions.enabledItems: selectivecookiedelete@siju.mathew:3.5
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010.07.30 15:36:28 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010.07.30 17:51:56 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.1\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2010.07.30 15:54:54 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2010.07.30 16:04:29 | 000,000,000 | ---D | M]
 
[2010.07.30 15:54:57 | 000,000,000 | ---D | M] -- C:\Users\Michael&Diana\AppData\Roaming\mozilla\Extensions
[2010.07.30 15:54:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Michael&Diana\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010.07.30 18:40:49 | 000,000,000 | ---D | M] -- C:\Users\Michael&Diana\AppData\Roaming\mozilla\Firefox\Profiles\0u7414im.default\extensions
[2010.07.30 15:52:50 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\Michael&Diana\AppData\Roaming\mozilla\Firefox\Profiles\0u7414im.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.07.30 16:30:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Michael&Diana\AppData\Roaming\mozilla\Firefox\Profiles\0u7414im.default\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}
[2010.07.30 16:31:42 | 000,000,000 | ---D | M] -- C:\Users\Michael&Diana\AppData\Roaming\mozilla\Firefox\Profiles\0u7414im.default\extensions\selectivecookiedelete@siju.mathew
[2010.07.30 18:37:59 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\mozilla firefox\extensions
[2010.07.30 18:38:00 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files (x86)\mozilla firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010.07.30 16:09:16 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010.07.30 16:09:10 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2010.07.30 16:04:14 | 000,075,208 | ---- | M] (Foxit Software Company) -- C:\Program Files (x86)\mozilla firefox\plugins\npFoxitReaderPlugin.dll
[2010.07.23 02:48:56 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.07.23 02:48:56 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2010.07.23 02:48:56 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.07.23 02:48:56 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.07.23 02:48:56 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O4:64bit: - HKLM..\Run: [MSSE] C:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.07.31 08:47:19 | 000,000,066 | R--- | M] () - F:\autorun.inf -- [ CDFS ]
O32 - AutoRun File - [2009.07.31 08:09:51 | 000,000,062 | R--- | M] () - F:\autorun.usb -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.07.31 08:13:56 | 000,000,000 | ---D | C] -- C:\Users\Michael&Diana\AppData\Roaming\Malwarebytes
[2010.07.31 08:13:50 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010.07.31 08:13:49 | 000,024,664 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2010.07.31 08:13:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2010.07.31 08:13:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.07.30 18:42:15 | 000,000,000 | ---D | C] -- C:\Users\Michael&Diana\AppData\Roaming\AllDup
[2010.07.30 18:42:07 | 002,344,880 | ---- | C] (Codejock Software) -- C:\Windows\SysWow64\Codejock.CommandBars.v13.2.1.ocx
[2010.07.30 18:42:07 | 001,000,992 | ---- | C] (Bennet-Tec Information Systems, Inc) -- C:\Windows\SysWow64\TList8.ocx
[2010.07.30 18:42:07 | 000,171,752 | ---- | C] (Michael Thummerer Software Design) -- C:\Windows\SysWow64\mtRTF2.ocx
[2010.07.30 18:42:07 | 000,086,016 | ---- | C] (Michael Thummerer Software Design) -- C:\Windows\SysWow64\mtFrame.ocx
[2010.07.30 18:42:07 | 000,085,696 | ---- | C] (Michael Thummerer Software Design) -- C:\Windows\SysWow64\mtSplitter.ocx
[2010.07.30 18:42:07 | 000,044,736 | ---- | C] (Michael Thummerer Software Design) -- C:\Windows\SysWow64\mtSubclass.dll
[2010.07.30 18:42:07 | 000,000,000 | ---D | C] -- C:\ProgramData\AllDup
[2010.07.30 18:42:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AllDup
[2010.07.30 18:38:57 | 000,000,000 | ---D | C] -- C:\Users\Michael&Diana\AppData\Roaming\skypePM
[2010.07.30 18:38:04 | 000,000,000 | ---D | C] -- C:\Users\Michael&Diana\AppData\Roaming\Skype
[2010.07.30 18:37:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2010.07.30 18:37:47 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype
[2010.07.30 18:37:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype
[2010.07.30 17:54:32 | 000,143,168 | ---- | C] (SurfRight B.V.) -- C:\Windows\SysNative\LnkProtect.dll
[2010.07.30 17:52:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Hitman Pro
[2010.07.30 17:52:52 | 000,000,000 | ---D | C] -- C:\Programme\Hitman Pro 3.5
[2010.07.30 17:46:16 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2010.07.30 17:44:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CCleaner
[2010.07.30 17:41:19 | 000,000,000 | ---D | C] -- C:\Users\Michael&Diana\AppData\Roaming\Ashampoo
[2010.07.30 17:40:31 | 000,000,000 | ---D | C] -- C:\Users\Michael&Diana\AppData\Local\ashampoo
[2010.07.30 17:40:31 | 000,000,000 | ---D | C] -- C:\ProgramData\ashampoo
[2010.07.30 17:40:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Ashampoo
[2010.07.30 17:29:09 | 000,000,000 | ---D | C] -- C:\Users\Michael&Diana\Documents\Haenlein-Software
[2010.07.30 17:28:42 | 000,000,000 | ---D | C] -- C:\Users\Michael&Diana\AppData\Roaming\Haenlein-Software
[2010.07.30 17:28:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DVR-Compress
[2010.07.30 17:28:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DVR-Studio Pro 2
[2010.07.30 16:50:14 | 001,081,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSComCtl.ocx
[2010.07.30 16:50:09 | 000,499,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msvcp71.dll
[2010.07.30 16:50:09 | 000,348,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msvcr71.dll
[2010.07.30 16:50:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WinTV
[2010.07.30 16:50:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\InstallShield Installation Information
[2010.07.30 16:49:51 | 000,307,256 | ---- | C] (Hauppauge Computer Works) -- C:\Windows\SysWow64\hcwpnp32.dll
[2010.07.30 16:49:51 | 000,106,552 | ---- | C] (Hauppauge Computer Works, Inc.) -- C:\Windows\SysWow64\hcwi2c32.dll
[2010.07.30 16:49:51 | 000,036,921 | ---- | C] (Hauppauge Computer Works) -- C:\Windows\SysWow64\hcwutl32.dll
[2010.07.30 16:45:49 | 000,656,896 | ---- | C] (Hauppauge Computer Works, Inc.) -- C:\Windows\SysNative\drivers\hcw95bda.sys
[2010.07.30 16:45:49 | 000,019,456 | ---- | C] (Hauppauge Computer Works, Inc.) -- C:\Windows\SysNative\hcw95rc.sys
[2010.07.30 16:45:49 | 000,019,456 | ---- | C] (Hauppauge Computer Works, Inc.) -- C:\Windows\SysNative\drivers\hcw95rc.sys
[2010.07.30 16:22:34 | 000,000,000 | ---D | C] -- C:\Users\Michael&Diana\AppData\Roaming\DivX
[2010.07.30 16:13:58 | 000,000,000 | ---D | C] -- C:\Programme\DivX
[2010.07.30 16:13:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DivX Shared
[2010.07.30 16:12:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DivX
[2010.07.30 16:11:39 | 000,000,000 | ---D | C] -- C:\ProgramData\DivX
[2010.07.30 16:10:36 | 000,000,000 | ---D | C] -- C:\Users\Michael&Diana\AppData\Roaming\Macromedia
[2010.07.30 16:10:36 | 000,000,000 | ---D | C] -- C:\Users\Michael&Diana\AppData\Roaming\Adobe
[2010.07.30 16:10:31 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Macromed
[2010.07.30 16:09:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2010.07.30 16:09:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2010.07.30 16:09:15 | 000,423,656 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\deployJava1.dll
[2010.07.30 16:09:15 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe
[2010.07.30 16:09:15 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe
[2010.07.30 16:09:15 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe
[2010.07.30 16:09:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2010.07.30 16:05:14 | 000,000,000 | ---D | C] -- C:\Windows\Panther
[2010.07.30 16:04:45 | 000,000,000 | ---D | C] -- C:\Users\Michael&Diana\AppData\Roaming\Foxit Software
[2010.07.30 16:04:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Foxit Software
[2010.07.30 15:59:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Antimalware
[2010.07.30 15:59:17 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Security Essentials
[2010.07.30 15:54:56 | 000,000,000 | ---D | C] -- C:\Users\Michael&Diana\AppData\Roaming\Thunderbird
[2010.07.30 15:54:56 | 000,000,000 | ---D | C] -- C:\Users\Michael&Diana\AppData\Local\Thunderbird
[2010.07.30 15:54:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Thunderbird
[2010.07.30 15:40:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight
[2010.07.30 15:38:28 | 000,000,000 | ---D | C] -- C:\Users\Michael&Diana\AppData\Local\WindowsUpdate
[2010.07.30 15:36:42 | 000,000,000 | ---D | C] -- C:\Users\Michael&Diana\AppData\Roaming\Mozilla
[2010.07.30 15:36:42 | 000,000,000 | ---D | C] -- C:\Users\Michael&Diana\AppData\Local\Mozilla
[2010.07.30 15:36:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2010.07.30 15:28:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET
[2010.07.30 15:28:06 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
[2010.07.30 15:26:13 | 001,942,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dfshim.dll
[2010.07.30 15:26:13 | 001,130,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dfshim.dll
[2010.07.30 15:26:13 | 000,320,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\PresentationHost.exe
[2010.07.30 15:26:13 | 000,295,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\PresentationHost.exe
[2010.07.30 15:26:13 | 000,109,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\PresentationHostProxy.dll
[2010.07.30 15:26:13 | 000,099,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\PresentationHostProxy.dll
[2010.07.30 15:26:13 | 000,049,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\netfxperf.dll
[2010.07.30 15:26:13 | 000,048,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netfxperf.dll
[2010.07.30 15:25:57 | 000,294,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\browserchoice.exe
[2010.07.30 15:19:48 | 000,961,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\CPFilters.dll
[2010.07.30 15:19:48 | 000,641,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\CPFilters.dll
[2010.07.30 15:19:48 | 000,613,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\psisdecd.dll
[2010.07.30 15:19:48 | 000,552,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msdri.dll
[2010.07.30 15:19:48 | 000,465,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\psisdecd.dll
[2010.07.30 15:19:48 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MSNP.ax
[2010.07.30 15:19:48 | 000,258,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mpg2splt.ax
[2010.07.30 15:19:48 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSNP.ax
[2010.07.30 15:19:48 | 000,199,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mpg2splt.ax
[2010.07.30 15:19:47 | 014,629,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wmp.dll
[2010.07.30 15:19:46 | 011,406,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wmp.dll
[2010.07.30 15:19:45 | 012,625,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wmploc.DLL
[2010.07.30 15:19:45 | 001,975,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\CertEnroll.dll
[2010.07.30 15:19:45 | 001,320,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\CertEnroll.dll
[2010.07.30 15:19:44 | 012,625,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wmploc.DLL
[2010.07.30 15:19:39 | 002,870,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer.exe
[2010.07.30 15:19:39 | 002,614,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\explorer.exe
[2010.07.30 15:19:39 | 000,389,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winlogon.exe
[2010.07.30 15:19:37 | 001,736,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll
[2010.07.30 15:19:37 | 000,424,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secproc.dll
[2010.07.30 15:19:37 | 000,422,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secproc_isv.dll
[2010.07.30 15:19:37 | 000,369,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\secproc.dll
[2010.07.30 15:19:37 | 000,365,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\secproc_isv.dll
[2010.07.30 15:19:37 | 000,357,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RMActivate_isv.exe
[2010.07.30 15:19:37 | 000,356,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RMActivate.exe
[2010.07.30 15:19:37 | 000,324,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RMActivate_isv.exe
[2010.07.30 15:19:37 | 000,320,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RMActivate.exe
[2010.07.30 15:19:37 | 000,306,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RMActivate_ssp.exe
[2010.07.30 15:19:37 | 000,305,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RMActivate_ssp_isv.exe
[2010.07.30 15:19:37 | 000,280,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RMActivate_ssp.exe
[2010.07.30 15:19:37 | 000,277,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RMActivate_ssp_isv.exe
[2010.07.30 15:19:37 | 000,121,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secproc_ssp_isv.dll
[2010.07.30 15:19:37 | 000,121,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secproc_ssp.dll
[2010.07.30 15:19:37 | 000,085,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\secproc_ssp_isv.dll
[2010.07.30 15:19:37 | 000,085,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\secproc_ssp.dll
[2010.07.30 15:19:36 | 000,612,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2010.07.30 15:19:36 | 000,427,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\vbscript.dll
[2010.07.30 15:19:36 | 000,148,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\t2embed.dll
[2010.07.30 15:19:36 | 000,108,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\t2embed.dll
[2010.07.30 15:19:35 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll
[2010.07.30 15:19:35 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe
[2010.07.30 15:19:35 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll
[2010.07.30 15:19:35 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe
[2010.07.30 15:19:35 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll
[2010.07.30 15:19:35 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe
[2010.07.30 15:19:33 | 005,509,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2010.07.30 15:19:33 | 001,572,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\quartz.dll
[2010.07.30 15:19:33 | 001,328,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\quartz.dll
[2010.07.30 15:19:33 | 000,091,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\avifil32.dll
[2010.07.30 15:19:33 | 000,084,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mciavi32.dll
[2010.07.30 15:19:32 | 003,954,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2010.07.30 15:19:32 | 003,899,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2010.07.30 15:19:32 | 000,852,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2010.07.30 15:19:32 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2010.07.30 15:19:31 | 000,144,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdd.dll
[2010.07.30 15:19:29 | 001,446,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll
[2010.07.30 15:19:28 | 000,046,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msasn1.dll
[2010.07.30 15:18:08 | 000,366,080 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysNative\atmfd.dll
[2010.07.30 15:18:08 | 000,293,888 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\atmfd.dll
[2010.07.30 15:18:08 | 000,100,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\fontsub.dll
[2010.07.30 15:18:08 | 000,070,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\fontsub.dll
[2010.07.30 15:18:08 | 000,046,080 | ---- | C] (Adobe Systems) -- C:\Windows\SysNative\atmlib.dll
[2010.07.30 15:18:08 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\SysWow64\atmlib.dll
[2010.07.30 15:14:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\logishrd
[2010.07.30 15:14:20 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\logishrd
[2010.07.30 15:13:59 | 000,220,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll
[2010.07.30 15:13:59 | 000,172,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wintrust.dll
[2010.07.30 15:13:59 | 000,139,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cabview.dll
[2010.07.30 15:13:59 | 000,132,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cabview.dll
[2010.07.30 15:12:56 | 000,000,000 | R--D | C] -- C:\Users\Michael&Diana\Searches
[2010.07.30 15:12:48 | 000,000,000 | ---D | C] -- C:\Users\Michael&Diana\AppData\Roaming\Identities
[2010.07.30 15:12:47 | 000,000,000 | R--D | C] -- C:\Users\Michael&Diana\Contacts
[2010.07.30 15:12:46 | 000,000,000 | ---D | C] -- C:\Users\Michael&Diana\AppData\Local\VirtualStore
[2010.07.30 15:12:40 | 000,000,000 | --SD | C] -- C:\Users\Michael&Diana\AppData\Roaming\Microsoft
[2010.07.30 15:12:40 | 000,000,000 | R--D | C] -- C:\Users\Michael&Diana\Videos
[2010.07.30 15:12:40 | 000,000,000 | R--D | C] -- C:\Users\Michael&Diana\Saved Games
[2010.07.30 15:12:40 | 000,000,000 | R--D | C] -- C:\Users\Michael&Diana\Pictures
[2010.07.30 15:12:40 | 000,000,000 | R--D | C] -- C:\Users\Michael&Diana\Music
[2010.07.30 15:12:40 | 000,000,000 | R--D | C] -- C:\Users\Michael&Diana\Links
[2010.07.30 15:12:40 | 000,000,000 | R--D | C] -- C:\Users\Michael&Diana\Favorites
[2010.07.30 15:12:40 | 000,000,000 | R--D | C] -- C:\Users\Michael&Diana\Downloads
[2010.07.30 15:12:40 | 000,000,000 | R--D | C] -- C:\Users\Michael&Diana\Documents
[2010.07.30 15:12:40 | 000,000,000 | R--D | C] -- C:\Users\Michael&Diana\Desktop
[2010.07.30 15:12:40 | 000,000,000 | -HSD | C] -- C:\Users\Michael&Diana\Vorlagen
[2010.07.30 15:12:40 | 000,000,000 | -HSD | C] -- C:\Users\Michael&Diana\AppData\Local\Verlauf
[2010.07.30 15:12:40 | 000,000,000 | -HSD | C] -- C:\Users\Michael&Diana\AppData\Local\Temporary Internet Files
[2010.07.30 15:12:40 | 000,000,000 | -HSD | C] -- C:\Users\Michael&Diana\Startmenü
[2010.07.30 15:12:40 | 000,000,000 | -HSD | C] -- C:\Users\Michael&Diana\SendTo
[2010.07.30 15:12:40 | 000,000,000 | -HSD | C] -- C:\Users\Michael&Diana\Recent
[2010.07.30 15:12:40 | 000,000,000 | -HSD | C] -- C:\Users\Michael&Diana\Netzwerkumgebung
[2010.07.30 15:12:40 | 000,000,000 | -HSD | C] -- C:\Users\Michael&Diana\Lokale Einstellungen
[2010.07.30 15:12:40 | 000,000,000 | -HSD | C] -- C:\Users\Michael&Diana\Documents\Eigene Videos
[2010.07.30 15:12:40 | 000,000,000 | -HSD | C] -- C:\Users\Michael&Diana\Documents\Eigene Musik
[2010.07.30 15:12:40 | 000,000,000 | -HSD | C] -- C:\Users\Michael&Diana\Eigene Dateien
[2010.07.30 15:12:40 | 000,000,000 | -HSD | C] -- C:\Users\Michael&Diana\Documents\Eigene Bilder
[2010.07.30 15:12:40 | 000,000,000 | -HSD | C] -- C:\Users\Michael&Diana\Druckumgebung
[2010.07.30 15:12:40 | 000,000,000 | -HSD | C] -- C:\Users\Michael&Diana\Cookies
[2010.07.30 15:12:40 | 000,000,000 | -HSD | C] -- C:\Users\Michael&Diana\AppData\Local\Anwendungsdaten
[2010.07.30 15:12:40 | 000,000,000 | -HSD | C] -- C:\Users\Michael&Diana\Anwendungsdaten
[2010.07.30 15:12:40 | 000,000,000 | -H-D | C] -- C:\Users\Michael&Diana\AppData
[2010.07.30 15:12:40 | 000,000,000 | ---D | C] -- C:\Users\Michael&Diana\AppData\Local\Temp
[2010.07.30 15:12:40 | 000,000,000 | ---D | C] -- C:\Users\Michael&Diana\AppData\Local\Microsoft
[2010.07.30 15:12:40 | 000,000,000 | ---D | C] -- C:\Users\Michael&Diana\AppData\Roaming\Media Center Programs
[2010.07.30 15:12:28 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen
[2010.07.30 15:12:28 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü
[2010.07.30 15:12:28 | 000,000,000 | -HSD | C] -- C:\Recovery
[2010.07.30 15:12:28 | 000,000,000 | -HSD | C] -- C:\Programme
[2010.07.30 15:12:28 | 000,000,000 | -HSD | C] -- C:\Programme\Gemeinsame Dateien
[2010.07.30 15:12:28 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten
[2010.07.30 15:12:28 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos
[2010.07.30 15:12:28 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik
[2010.07.30 15:12:28 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder
[2010.07.30 15:12:28 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen
[2010.07.30 15:12:28 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente
[2010.07.30 15:12:28 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten
[2010.07.30 15:08:40 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2010.07.30 15:08:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Hewlett-Packard
[2010.07.30 15:06:17 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch
[2010.07.30 15:06:04 | 000,000,000 | -HSD | C] -- C:\System Volume Information
[2010.07.07 14:55:08 | 006,465,632 | ---- | C] (Logitech Inc.) -- C:\Windows\SysNative\drivers\lvuvc64.sys
[2010.07.07 14:54:56 | 000,539,232 | ---- | C] (Logitech Inc.) -- C:\Windows\SysWow64\LVUI2RC.dll
[2010.07.07 14:54:32 | 000,543,328 | ---- | C] (Logitech Inc.) -- C:\Windows\SysWow64\LVUI2.dll
[2010.07.07 14:54:22 | 000,559,712 | ---- | C] (Logitech Inc.) -- C:\Windows\SysNative\LVUIRC64.dll
[2010.07.07 14:54:00 | 000,771,168 | ---- | C] (Logitech Inc.) -- C:\Windows\SysNative\LVUI64.dll
[2010.07.07 14:50:40 | 000,269,408 | ---- | C] (Logitech Inc.) -- C:\Windows\SysNative\lvco1301788.dll
[2010.07.07 14:50:18 | 000,398,432 | ---- | C] (Logitech Inc.) -- C:\Windows\SysNative\lvcod64.dll
[2010.07.07 14:50:06 | 000,416,352 | ---- | C] (Logitech Inc.) -- C:\Windows\SysWow64\lvcodec2.dll
 
========== Files - Modified Within 30 Days ==========
 
[2010.07.31 08:37:16 | 000,786,432 | -HS- | M] () -- C:\Users\Michael&Diana\NTUSER.DAT
[2010.07.31 08:13:53 | 000,001,013 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.07.31 08:13:26 | 000,014,064 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010.07.31 08:13:26 | 000,014,064 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010.07.31 08:10:32 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2010.07.31 08:10:32 | 000,653,928 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2010.07.31 08:10:32 | 000,615,810 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2010.07.31 08:10:32 | 000,129,800 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2010.07.31 08:10:32 | 000,106,190 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2010.07.31 08:06:16 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.07.31 08:06:12 | 000,000,000 | ---- | M] () -- C:\Windows\SysNative\drivers\lvuvc.hs
[2010.07.31 08:06:10 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.07.31 08:06:06 | 3218,939,904 | -HS- | M] () -- C:\hiberfil.sys
[2010.07.30 19:50:52 | 001,468,383 | -H-- | M] () -- C:\Users\Michael&Diana\AppData\Local\IconCache.db
[2010.07.30 19:19:31 | 000,019,528 | ---- | M] () -- C:\Windows\SysNative\drivers\hitmanpro35.sys
[2010.07.30 18:42:08 | 000,000,923 | ---- | M] () -- C:\Users\Public\Desktop\AllDup.lnk
[2010.07.30 18:38:57 | 000,000,056 | -H-- | M] () -- C:\ProgramData\ezsidmv.dat
[2010.07.30 17:54:32 | 000,143,168 | ---- | M] (SurfRight B.V.) -- C:\Windows\SysNative\LnkProtect.dll
[2010.07.30 17:53:10 | 000,001,978 | ---- | M] () -- C:\Users\Public\Desktop\Hitman Pro 3.5.lnk
[2010.07.30 17:46:00 | 000,004,032 | ---- | M] () -- C:\Users\Michael&Diana\Documents\cc_20100730_174557.reg
[2010.07.30 17:45:49 | 000,004,642 | ---- | M] () -- C:\Users\Michael&Diana\Documents\cc_20100730_174546.reg
[2010.07.30 16:50:33 | 000,000,209 | ---- | M] () -- C:\Windows\ODBCINST.INI
[2010.07.30 16:50:33 | 000,000,135 | ---- | M] () -- C:\Windows\ODBC.INI
[2010.07.30 16:50:13 | 000,001,077 | ---- | M] () -- C:\Users\Public\Desktop\WinTV 7.lnk
[2010.07.30 16:49:56 | 000,006,245 | ---- | M] () -- C:\Windows\HCWPNP.INI
[2010.07.30 16:09:09 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\deployJava1.dll
[2010.07.30 16:09:09 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe
[2010.07.30 16:09:09 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe
[2010.07.30 16:09:09 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe
[2010.07.30 15:59:30 | 000,057,560 | ---- | M] () -- C:\Users\Michael&Diana\AppData\Local\GDIPFONTCACHEV1.DAT
[2010.07.30 15:33:27 | 000,274,464 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2010.07.30 15:15:36 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin
[2010.07.30 15:14:43 | 000,524,288 | -HS- | M] () -- C:\Users\Michael&Diana\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
[2010.07.30 15:14:43 | 000,524,288 | -HS- | M] () -- C:\Users\Michael&Diana\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
[2010.07.30 15:14:43 | 000,065,536 | -HS- | M] () -- C:\Users\Michael&Diana\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
[2010.07.30 15:12:40 | 000,000,020 | -HS- | M] () -- C:\Users\Michael&Diana\ntuser.ini
[2010.07.30 15:09:05 | 000,056,735 | ---- | M] () -- C:\Windows\SysWow64\license.rtf
[2010.07.30 15:09:05 | 000,056,735 | ---- | M] () -- C:\Windows\SysNative\license.rtf
[2010.07.07 14:55:08 | 006,465,632 | ---- | M] (Logitech Inc.) -- C:\Windows\SysNative\drivers\lvuvc64.sys
[2010.07.07 14:54:56 | 000,539,232 | ---- | M] (Logitech Inc.) -- C:\Windows\SysWow64\LVUI2RC.dll
[2010.07.07 14:54:32 | 000,543,328 | ---- | M] (Logitech Inc.) -- C:\Windows\SysWow64\LVUI2.dll
[2010.07.07 14:54:22 | 000,559,712 | ---- | M] (Logitech Inc.) -- C:\Windows\SysNative\LVUIRC64.dll
[2010.07.07 14:54:00 | 000,771,168 | ---- | M] (Logitech Inc.) -- C:\Windows\SysNative\LVUI64.dll
[2010.07.07 14:50:40 | 000,269,408 | ---- | M] (Logitech Inc.) -- C:\Windows\SysNative\lvco1301788.dll
[2010.07.07 14:50:18 | 000,398,432 | ---- | M] (Logitech Inc.) -- C:\Windows\SysNative\lvcod64.dll
[2010.07.07 14:50:06 | 000,416,352 | ---- | M] (Logitech Inc.) -- C:\Windows\SysWow64\lvcodec2.dll
[2010.07.07 14:44:56 | 000,102,744 | ---- | M] () -- C:\Windows\SysWow64\LogiDPPApp.exe
[2010.07.07 14:44:56 | 000,102,744 | ---- | M] () -- C:\Windows\SysNative\LogiDPPApp.exe
[2010.07.07 14:44:30 | 010,829,656 | ---- | M] () -- C:\Windows\SysWow64\LogiDPP.dll
[2010.07.07 14:44:30 | 010,829,656 | ---- | M] () -- C:\Windows\SysNative\LogiDPP.dll
[2010.07.07 14:44:20 | 000,290,648 | ---- | M] () -- C:\Windows\SysWow64\DevManagerCore.dll
[2010.07.07 14:44:20 | 000,290,648 | ---- | M] () -- C:\Windows\SysNative\DevManagerCore.dll
[2010.07.07 14:37:08 | 000,266,828 | ---- | M] () -- C:\Windows\SysNative\drivers\LVAFT.cfg
[2010.07.07 14:36:30 | 000,090,071 | ---- | M] () -- C:\Windows\SysNative\lvcoin64.ini
 
========== Files Created - No Company Name ==========
 
[2010.07.31 08:13:53 | 000,001,013 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.07.30 18:42:08 | 000,000,923 | ---- | C] () -- C:\Users\Public\Desktop\AllDup.lnk
[2010.07.30 18:38:57 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.07.30 17:54:42 | 000,019,528 | ---- | C] () -- C:\Windows\SysNative\drivers\hitmanpro35.sys
[2010.07.30 17:52:52 | 000,001,978 | ---- | C] () -- C:\Users\Public\Desktop\Hitman Pro 3.5.lnk
[2010.07.30 17:45:59 | 000,004,032 | ---- | C] () -- C:\Users\Michael&Diana\Documents\cc_20100730_174557.reg
[2010.07.30 17:45:48 | 000,004,642 | ---- | C] () -- C:\Users\Michael&Diana\Documents\cc_20100730_174546.reg
[2010.07.30 16:50:33 | 000,000,135 | ---- | C] () -- C:\Windows\ODBC.INI
[2010.07.30 16:50:09 | 000,142,337 | ---- | C] () -- C:\Windows\SysWow64\Wait.exe
[2010.07.30 16:50:06 | 000,001,077 | ---- | C] () -- C:\Users\Public\Desktop\WinTV 7.lnk
[2010.07.30 16:49:40 | 000,006,245 | ---- | C] () -- C:\Windows\HCWPNP.INI
[2010.07.30 15:15:36 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2010.07.30 15:14:24 | 000,000,000 | ---- | C] () -- C:\Windows\SysNative\drivers\lvuvc.hs
[2010.07.30 15:12:40 | 000,786,432 | -HS- | C] () -- C:\Users\Michael&Diana\NTUSER.DAT
[2010.07.30 15:12:40 | 000,524,288 | -HS- | C] () -- C:\Users\Michael&Diana\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
[2010.07.30 15:12:40 | 000,524,288 | -HS- | C] () -- C:\Users\Michael&Diana\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
[2010.07.30 15:12:40 | 000,262,144 | -HS- | C] () -- C:\Users\Michael&Diana\ntuser.dat.LOG1
[2010.07.30 15:12:40 | 000,065,536 | -HS- | C] () -- C:\Users\Michael&Diana\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
[2010.07.30 15:12:40 | 000,000,020 | -HS- | C] () -- C:\Users\Michael&Diana\ntuser.ini
[2010.07.30 15:12:40 | 000,000,000 | -HS- | C] () -- C:\Users\Michael&Diana\ntuser.dat.LOG2
[2010.07.30 15:06:03 | 3218,939,904 | -HS- | C] () -- C:\hiberfil.sys
[2010.07.07 14:44:56 | 000,102,744 | ---- | C] () -- C:\Windows\SysWow64\LogiDPPApp.exe
[2010.07.07 14:44:56 | 000,102,744 | ---- | C] () -- C:\Windows\SysNative\LogiDPPApp.exe
[2010.07.07 14:44:30 | 010,829,656 | ---- | C] () -- C:\Windows\SysWow64\LogiDPP.dll
[2010.07.07 14:44:30 | 010,829,656 | ---- | C] () -- C:\Windows\SysNative\LogiDPP.dll
[2010.07.07 14:44:20 | 000,290,648 | ---- | C] () -- C:\Windows\SysWow64\DevManagerCore.dll
[2010.07.07 14:44:20 | 000,290,648 | ---- | C] () -- C:\Windows\SysNative\DevManagerCore.dll
[2010.07.07 14:37:08 | 000,266,828 | ---- | C] () -- C:\Windows\SysNative\drivers\LVAFT.cfg
[2010.07.07 14:36:30 | 000,090,071 | ---- | C] () -- C:\Windows\SysNative\lvcoin64.ini
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
 
========== LOP Check ==========
 
[2010.07.30 18:46:50 | 000,000,000 | ---D | M] -- C:\Users\Michael&Diana\AppData\Roaming\AllDup
[2010.07.30 17:42:35 | 000,000,000 | ---D | M] -- C:\Users\Michael&Diana\AppData\Roaming\Ashampoo
[2010.07.30 16:04:45 | 000,000,000 | ---D | M] -- C:\Users\Michael&Diana\AppData\Roaming\Foxit Software
[2010.07.30 17:28:42 | 000,000,000 | ---D | M] -- C:\Users\Michael&Diana\AppData\Roaming\Haenlein-Software
[2010.07.30 15:54:57 | 000,000,000 | ---D | M] -- C:\Users\Michael&Diana\AppData\Roaming\Thunderbird
[2009.07.14 07:08:49 | 000,002,898 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
< End of report >
Code:
ATTFilter
OTL Extras logfile created on: 31.07.2010 08:37:02 - Run 1
OTL by OldTimer - Version 3.2.9.1     Folder = C:\Users\Michael&Diana\Downloads
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 66,00% Memory free
8,00 Gb Paging File | 7,00 Gb Available in Paging File | 82,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 97,56 Gb Total Space | 76,93 Gb Free Space | 78,86% Space Free | Partition Type: NTFS
Drive D: | 97,66 Gb Total Space | 91,54 Gb Free Space | 93,74% Space Free | Partition Type: NTFS
Drive E: | 270,45 Gb Total Space | 202,91 Gb Free Space | 75,03% Space Free | Partition Type: NTFS
Drive F: | 397,55 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: HOMEOFFICE
Current User Name: Michael&Diana
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" File not found
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [hitmanpro] -- "C:\Program Files\Hitman Pro 3.5\HitmanPro35_x64.exe" "%1\" File not found
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [hitmanpro] -- "C:\Program Files\Hitman Pro 3.5\HitmanPro35_x64.exe" "%1\"
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{84ED5482-CFB0-4DD9-BF18-489FFDACD18A}" = Microsoft Antimalware Service DE-DE Language Pack
"{95C9C76F-ECF3-40FA-94F8-5DDFB6BAF40D}" = Microsoft Security Essentials
"{E62A1F01-07B7-4541-A835-EE5B0BF064C2}" = Microsoft Antimalware
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"HitmanPro35" = Hitman Pro 3.5
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft Security Essentials" = Microsoft Security Essentials
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java(TM) 6 Update 21
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{BD60F72D-3F2F-4AE1-9C41-3CF75B2CA59A}" = DVR-Studio Pro 2
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AllDup_is1" = AllDup 3.0.2
"Ashampoo Burning Studio 9_is1" = Ashampoo Burning Studio 9.21
"Ashampoo Photo Commander 8_is1" = Ashampoo Photo Commander 8.2.0
"CCleaner" = CCleaner
"DivX Setup.divx.com" = DivX-Setup
"Foxit Reader" = Foxit Reader
"Hauppauge WinTV 7" = Hauppauge WinTV 7
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mozilla Firefox (3.6.8)" = Mozilla Firefox (3.6.8)
"Mozilla Thunderbird (3.1.1)" = Mozilla Thunderbird (3.1.1)
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 30.07.2010 09:39:09 | Computer Name = Homeoffice | Source = Software Protection Platform Service | ID = 8200
Description = Lizenzerwerb-Fehlerdetails.   hr=0xC004C008
 
Error - 30.07.2010 09:39:09 | Computer Name = Homeoffice | Source = Software Protection Platform Service | ID = 1014
Description = Fehler beim Erwerb der Endbenutzerlizenz. hr=0xC004C008  SKU-ID=2e7d060d-4714-40f2-9896-1e4f15b612ad
 
Error - 30.07.2010 09:44:44 | Computer Name = Homeoffice | Source = Software Protection Platform Service | ID = 8200
Description = Lizenzerwerb-Fehlerdetails.   hr=0xC004C008
 
Error - 30.07.2010 09:44:44 | Computer Name = Homeoffice | Source = Software Protection Platform Service | ID = 1014
Description = Fehler beim Erwerb der Endbenutzerlizenz. hr=0xC004C008  SKU-ID=2e7d060d-4714-40f2-9896-1e4f15b612ad
 
Error - 30.07.2010 10:28:14 | Computer Name = Homeoffice | Source = EventSystem | ID = 4621
Description = 
 
Error - 30.07.2010 13:12:53 | Computer Name = Homeoffice | Source = VSS | ID = 8194
Description = 
 
[ System Events ]
Error - 30.07.2010 11:51:20 | Computer Name = Homeoffice | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter
 
Error - 30.07.2010 11:51:20 | Computer Name = Homeoffice | Source = atikmdag | ID = 43029
Description = Display is not active
 
Error - 30.07.2010 15:38:16 | Computer Name = Homeoffice | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter
 
Error - 30.07.2010 15:38:16 | Computer Name = Homeoffice | Source = atikmdag | ID = 43029
Description = Display is not active
 
Error - 31.07.2010 01:33:14 | Computer Name = Homeoffice | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter
 
Error - 31.07.2010 01:33:14 | Computer Name = Homeoffice | Source = atikmdag | ID = 43029
Description = Display is not active
 
Error - 31.07.2010 01:53:11 | Computer Name = Homeoffice | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter
 
Error - 31.07.2010 01:53:11 | Computer Name = Homeoffice | Source = atikmdag | ID = 43029
Description = Display is not active
 
Error - 31.07.2010 02:06:10 | Computer Name = Homeoffice | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter
 
Error - 31.07.2010 02:06:10 | Computer Name = Homeoffice | Source = atikmdag | ID = 43029
Description = Display is not active
 
 
< End of report >
Betriebssystem ist Windows7 64bit.
Verwendeter Browser ist Firefox 3.6.8

Wäre sehr dankbar für Hilfe.

WW
__________________
"Inter Arma Enim Silent Leges"

Alt 31.07.2010, 16:01   #2
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Backdoor:PHP/C99shell.G - Standard

Backdoor:PHP/C99shell.G


Scheint so, als wärst Du nochmal davongekommen, Malwarebytes hat nichts gefunden und das OTL-Log ist für mich unauffällig.

Ich denke Du hast Glück gehabt, dass der bösartige Code nicht ausgeführt wurde.
Den Codeschnippel den Du da gesehen hast, hab ich mal bei VT auswerten lassen => Virustotal. MD5: 04bd1d18c23f7b45ddd7a795c19723ea BackDoor-DNF PHP/C99Shell.B PHP/CShell.Y

Keine berauschende Erkennung, aber immerhin 19 von 42 Virenscannern erkennen ihn.
__________________

__________________
Antwort

Themen zu Backdoor:PHP/C99shell.G
.dll, adblock, administrator, autorun, backdoor, bereit, bho, c:\windows\system32\rundll32.exe, codejock software, components, computer, entfernen, error, explorer, firefox, firefox.exe, flash player, google, home, home premium, install.exe, installation, internet, langs, location, logfile, media center, microsoft security, microsoft security essentials, mozilla, mozilla thunderbird, oldtimer, otl logfile, otl.exe, plug-in, programdata, programm, programme, realtek, registry, rundll, saver, searchplugins, security, shell32.dll, shortcut, software, syswow64, trojan, webcheck


« Unbekannter Virus, möglicherweiße svchost.exe | D:\autorun.inf »


Ähnliche Themen: Backdoor:PHP/C99shell.G


  1. Virusmeldung beim Surfen erhalten "PHP/C99Shell.B"
    Plagegeister aller Art und deren Bekämpfung - 04.12.2013 (3)
  2. Worm: Win32/Ainslot.A / Backdoor:PHP/C99shell.AH
    Plagegeister aller Art und deren Bekämpfung - 17.10.2013 (11)
  3. System bereinigen nach Backdoor.graybird / backdoor.rustock etc.
    Plagegeister aller Art und deren Bekämpfung - 01.04.2013 (5)
  4. BDS/Backdoor.Gen' [backdoor]
    Plagegeister aller Art und deren Bekämpfung - 01.03.2013 (7)
  5. Exploit.Script.Generic, Exploit.JS.Pdfka.gfa, Backdoor.Win32.ZAccess.ypw, Backdoor.Win32.ZAccess.yqi, Trojan.Win32.Miner.dw und weitere
    Log-Analyse und Auswertung - 02.10.2012 (7)
  6. Backdoor.Bot / Backdoor.Gootkit / Malware.Trace -> HiJackThis + Malwarebytes logfile
    Log-Analyse und Auswertung - 02.07.2010 (6)
  7. Backdoor?
    Log-Analyse und Auswertung - 15.12.2009 (0)
  8. Backdoor?
    Log-Analyse und Auswertung - 15.07.2009 (1)
  9. BDS/Backdoor.Gen ?
    Plagegeister aller Art und deren Bekämpfung - 15.06.2009 (19)
  10. Backdoor.bot
    Log-Analyse und Auswertung - 04.06.2009 (2)
  11. Backdoor.Trojan und Backdoor.Grybird
    Mülltonne - 13.10.2008 (0)
  12. Backdoor???
    Mülltonne - 14.10.2007 (0)
  13. Backdoor.GrayBird.K (BackDoor-ARR [McAfee]
    Plagegeister aller Art und deren Bekämpfung - 29.07.2007 (1)
  14. Backdoor Win 32.VB.aup
    Plagegeister aller Art und deren Bekämpfung - 05.06.2007 (4)
  15. W32/Backdoor-CFB
    Plagegeister aller Art und deren Bekämpfung - 08.09.2004 (1)
  16. backdoor.avc???
    Plagegeister aller Art und deren Bekämpfung - 25.08.2004 (3)
  17. Backdoor help thx
    Plagegeister aller Art und deren Bekämpfung - 05.08.2003 (5)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Backdoor:PHP/C99shell.G - Hallo Ich habe bei Google nach der Fernsehserie "Boston Legal" gesucht.Nachdem ich auf eines der Suchergebnisse geklickt habe öffnete sich eine Seite, die sehr viel Text enthielt, der irgendwie nach - Backdoor:PHP/C99shell.G...
Archiv
Du betrachtest: Backdoor:PHP/C99shell.G auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129