| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Backdoor.Win32.Spammy.lx problehmWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
30.12.2010, 18:05
| #1 |
 |  Backdoor.Win32.Spammy.lx problehm Guten abend!! Wie der titel schon sagt habe ich wohl ein Backdoor.Win32.Spammy.lx auf pc und jetzt breuchte ich mal eure hilfe um den wieder los zu werden!! Mein Viren program (Kaspersky Internet Security 2010) schaft es ohne hilfe nicht den los zu werden er zeigt mir den zwar an an und wenn ich den dan beseitigen will über Kaspersky hängt sich mein pc auf und macht garnix mehr!! Genauso ist mir heute aufgefallen das der Virus immer wo anders sein muss weil gestern wo kaspersky angeschlagen hat wahr es eine andere .exe datei wo er ihn gefunden hat wie heute. Gestern war es 7813934.exe heute ist es die svcnost.exe habe auch schon nach der svcnost. exe gegoogelt und ich finde nur was über die svchost.exe oder ist das,das gleiche ?? Ich würde mich freuen wenn mir jemand dabei helfen könnte!! gruß martin |
|
30.12.2010, 18:07
| #2 |
| /// Malware-holic   |  Backdoor.Win32.Spammy.lx problehm Systemscan mit OTL
__________________download otl: http://filepony.de/download-otl/ Doppelklick auf die OTL.exe (user von Windows 7 und Vista: Rechtsklick als Administrator ausführen) 1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output 2. Hake an "scan all users" 3. Unter "Extra Registry wähle: "Use Safelist" "LOP Check" "Purity Check" 4. Kopiere in die Textbox: netsvcs msconfig safebootminimal safebootnetwork activex drivers32 %ALLUSERSPROFILE%\Application Data\*. %ALLUSERSPROFILE%\Application Data\*.exe /s %APPDATA%\*. %APPDATA%\*.exe /s %SYSTEMDRIVE%\*.exe /md5start userinit.exe eventlog.dll scecli.dll netlogon.dll cngaudit.dll ws2ifsl.sys sceclt.dll ntelogon.dll winlogon.exe logevent.dll user32.DLL explorer.exe iaStor.sys nvstor.sys atapi.sys IdeChnDr.sys viasraid.sys AGP440.sys vaxscsi.sys nvatabus.sys viamraid.sys nvata.sys nvgts.sys iastorv.sys ViPrt.sys eNetHook.dll ahcix86.sys KR10N.sys nvstor32.sys ahcix86s.sys /md5stop %systemroot%\system32\drivers\*.sys /lockedfiles %systemroot%\System32\config\*.sav %systemroot%\*. /mp /s %systemroot%\system32\*.dll /lockedfiles CREATERESTOREPOINT 5. Klicke "Scan" 6. 2 reporte werden erstellt: OTL.Txt Extras.Txt beide posten
__________________ |
|
30.12.2010, 18:30
| #3 |
| | Backdoor.Win32.Spammy.lx problehm Danke für die schnelle andwort hir die beiden reporte die du haben wolltesOTL EXTRAS Logfile:
__________________Code:
ATTFilter OTL Extras logfile created on: 30.12.2010 18:11:42 - Run 1
OTL by OldTimer - Version 3.2.18.2 Folder = C:\Users\madde\Downloads
Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 65,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 82,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 149,05 Gb Total Space | 66,59 Gb Free Space | 44,67% Space Free | Partition Type: NTFS
Drive D: | 232,79 Gb Total Space | 186,83 Gb Free Space | 80,26% Space Free | Partition Type: NTFS
Computer Name: MADDE-PC | User Name: madde | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-1449085533-319408153-1176483877-1001\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
"" =
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\FlashFXP\FlashFXP.exe" = C:\Program Files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3 -- File not found
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\FlashFXP\FlashFXP.exe" = C:\Program Files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3 -- File not found
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{00F93853-D9D3-4795-A89E-84CCBA0205C9}" = Microsoft IntelliPoint 8.0
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{098A2A49-7CF3-4F08-A38D-FB879117152A}" = Adobe Color NA Extra Settings CS4
"{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4
"{0D67A4E4-5BE0-4C9A-8AD8-AB552B433F23}" = Adobe Setup
"{0DC0E85F-36E4-463B-B3EA-4CD8ED2222A1}" = Adobe Color EU Recommended Settings CS4
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{16E16F01-2E2D-4248-A42F-76261C147B6C}" = Adobe Drive CS4
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216015FF}" = Java(TM) 6 Update 15
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4
"{361AA6F2-124E-4E98-9402-83B1445B8448}" = GameSpy Comrade
"{3744B641-61DE-417F-BCDC-9CCED4224DF8}" = LightScribe System Software
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}" = Adobe Color - Photoshop Specific CS4
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin
"{3E8DE1A6-B365-4FF6-B917-2892A34990E8}" = LG USB Modem Drivers
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{442C760A-7359-466A-B492-E4FDD3262E9D}" = LevelR
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{54194F60-988C-4D03-B922-C2B00EFDA39A}" = NVIDIA PhysX
"{5454083B-1308-4485-BF17-111000028701}" = Grand Theft Auto: Episodes from Liberty City
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{63C24A08-70F3-4C8E-B9FB-9F21A903801D}" = Adobe Color Video Profiles CS CS4
"{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}" = Adobe Photoshop CS4 Support
"{67F0E67A-8E93-4C2C-B29D-47C48262738A}" = Adobe Device Central CS4
"{68243FF8-83CA-466B-B2B8-9F99DA5479C4}" = AdobeColorCommonSetCMYK
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{7AB3A249-FB81-416B-917A-A2A10E74C503}" = iTunes
"{7B2CC3DF-64FA-44AE-8F57-B0F915147E4F}_is1" = Need For Speed™ World
"{7EE9145D-C430-44E6-B5ED-61FF9C332100}_is1" = Battle of the Immortals
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{825E9A84-1E03-4526-9F8E-45015C938A7C}" = WBFS Manager 4.0
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
"{83A606F5-BF6F-42ED-9F33-B9F74297CDED}" = Need for Speed(TM) Hot Pursuit
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{85991ED2-010C-4930-96FA-52F43C2CE98A}" = Apple Mobile Device Support
"{8690891C-DD95-E081-CE42-71C64761AFA3}" = DOGS DIARY
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{99A37AC7-E724-4621-B167-500B5A52B69C}" = LastChaosGER
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9D8B0949-7C47-476F-9F06-F900D3B078EA}" = Kaspersky Internet Security 2010
"{A250D351-A07F-4D5D-AB6C-693C69B9BFAF}" = Hercules Webcam
"{A979B2D8-E3EE-4523-A26C-4AF0A6809280}" = Sniper Elite
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.1 - Deutsch
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{B2D328BE-45AD-4D92-96F9-2151490A203E}" = Apple Application Support
"{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}" = Adobe Photoshop CS4
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{C3C44248-B8F7-4B20-A5C7-994870B60F55}" = Hercules Webcam Station Evolution SE
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{D4CFC5F3-481C-40AA-9944-E7E4E732136C}" = Microsoft IntelliType Pro 8.0
"{DA7A75E4-CC4A-4B19-A6F0-9B5469C8443E}" = KarosOnline
"{E17141A6-211D-5854-61D9-69827A430D82}" = EA Download Manager UI
"{E4848436-0345-47E2-B648-8B522FCDA623}" = Adobe Photoshop CS4
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.0
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe_faf656ef605427ee2f42989c3ad31b8" = Adobe Photoshop CS4
"Akamai" = Akamai NetSession Interface
"Ashampoo Burning Studio 9_is1" = Ashampoo Burning Studio 9.21
"Ashampoo ClipFinder HD_is1" = Ashampoo ClipFinder HD 2.09
"Ashampoo Magical Snap FREE_is1" = Ashampoo Magical Snap FREE
"AutoItv3" = AutoIt v3.3.6.1
"BlackShot" = BlackShot
"Cheat Engine 5.6_is1" = Cheat Engine 5.6
"com.adobe.example.diary.AC2D34E49418B393981766FA31245F1D30E4A56D.1" = DOGS DIARY
"com.ea.Vault.919CACB699904AC5D41B606703500DD39747C02D.1" = EA Download Manager UI
"dcmsvc_is1" = dcmsvc 1.0
"EA Download Manager" = EA Download Manager
"Free Screen To Video_is1" = Free Screen To Video V 1.1
"Free Video to MP3 Converter_is1" = Free Video to MP3 Converter version 4.2.13
"GamersFirst LIVE!" = GamersFirst LIVE!
"Gtk+ Runtime Environment" = Gtk+ Runtime Environment 2.12.9-2
"InstallWIX_{9D8B0949-7C47-476F-9F06-F900D3B078EA}" = Kaspersky Internet Security 2010
"Lexmark X1100 Series" = Lexmark X1100 Series
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox (3.6.2pre)" = Mozilla Firefox (3.6.2pre)
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"OpenAL" = OpenAL
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"TeamViewer 5" = TeamViewer 5
"UltraISO_is1" = UltraISO Premium V9.36
"Uninstall_is1" = Uninstall 1.0.0.1
"uTorrent" = µTorrent
"VLC media player" = VLC media player 1.0.5
"Winamp" = Winamp
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-1449085533-319408153-1176483877-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"MAESTIA" = MAESTIA
"Winamp Detect" = Winamp Erkennungs-Plug-in
========== Last 10 Event Log Errors ==========
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
< End of report >
|
|
30.12.2010, 18:33
| #4 |
| | Backdoor.Win32.Spammy.lx problehm OTL Logfile: Code:
ATTFilter OTL logfile created on: 30.12.2010 18:11:42 - Run 1 OTL by OldTimer - Version 3.2.18.2 Folder = C:\Users\madde\Downloads Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 65,00% Memory free 6,00 Gb Paging File | 5,00 Gb Available in Paging File | 82,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 149,05 Gb Total Space | 66,59 Gb Free Space | 44,67% Space Free | Partition Type: NTFS Drive D: | 232,79 Gb Total Space | 186,83 Gb Free Space | 80,26% Space Free | Partition Type: NTFS Computer Name: MADDE-PC | User Name: madde | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\madde\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab) PRC - C:\Programme\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation) PRC - C:\Programme\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation) PRC - C:\Programme\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) PRC - C:\Users\madde\AppData\Local\Temp\svchost.bat (ghjkhjk) PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Programme\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation) PRC - c:\Programme\Windows Defender\MpCmdRun.exe (Microsoft Corporation) PRC - C:\Programme\dcmsvc\dcmsvc.exe () PRC - C:\Windows\System32\lxbkcoms.exe ( ) ========== Modules (SafeList) ========== MOD - C:\Users\madde\Downloads\OTL.exe (OldTimer Tools) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation) MOD - C:\Windows\System32\sspicli.dll (Microsoft Corporation) MOD - C:\Windows\System32\sechost.dll (Microsoft Corporation) MOD - C:\Windows\System32\samcli.dll (Microsoft Corporation) MOD - C:\Windows\System32\profapi.dll (Microsoft Corporation) MOD - C:\Windows\System32\netutils.dll (Microsoft Corporation) MOD - C:\Windows\System32\KernelBase.dll (Microsoft Corporation) MOD - C:\Windows\System32\dwmapi.dll (Microsoft Corporation) MOD - C:\Windows\System32\devobj.dll (Microsoft Corporation) MOD - C:\Windows\System32\cryptbase.dll (Microsoft Corporation) MOD - C:\Windows\System32\cfgmgr32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (Akamai) -- c:\Programme\Common Files\Akamai\netsession_win_aeec0f0.dll () SRV - (AVP) -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab) SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) SRV - (npggsvc) -- C:\Windows\System32\GameMon.des (INCA Internet Co., Ltd.) SRV - (Boonty Games) -- C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe (BOONTY) SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (TeamViewer5) -- C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH) SRV - (WwanSvc) -- C:\Windows\System32\wwansvc.dll (Microsoft Corporation) SRV - (WbioSrvc) -- C:\Windows\System32\wbiosrvc.dll (Microsoft Corporation) SRV - (Power) -- C:\Windows\System32\umpo.dll (Microsoft Corporation) SRV - (Themes) -- C:\Windows\System32\themeservice.dll (Microsoft Corporation) SRV - (sppuinotify) -- C:\Windows\System32\sppuinotify.dll (Microsoft Corporation) SRV - (RpcEptMapper) -- C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation) SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation) SRV - (PNRPsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation) SRV - (p2pimsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation) SRV - (HomeGroupProvider) -- C:\Windows\System32\provsvc.dll (Microsoft Corporation) SRV - (PNRPAutoReg) -- C:\Windows\System32\pnrpauto.dll (Microsoft Corporation) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (HomeGroupListener) -- C:\Windows\System32\ListSvc.dll (Microsoft Corporation) SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation) SRV - (Dhcp) -- C:\Windows\System32\dhcpcore.dll (Microsoft Corporation) SRV - (defragsvc) -- C:\Windows\System32\defragsvc.dll (Microsoft Corporation) SRV - (BDESVC) -- C:\Windows\System32\bdesvc.dll (Microsoft Corporation) SRV - (AxInstSV) ActiveX-Installer (AxInstSV) -- C:\Windows\System32\AxInstSv.dll (Microsoft Corporation) SRV - (AppIDSvc) -- C:\Windows\System32\appidsvc.dll (Microsoft Corporation) SRV - (sppsvc) -- C:\Windows\System32\sppsvc.exe (Microsoft Corporation) SRV - (lxbk_device) -- C:\Windows\System32\lxbkcoms.exe ( ) SRV - (ACS) -- C:\Windows\System32\acs.exe () ========== Driver Services (SafeList) ========== DRV - (XDva375) -- C:\Windows\System32\XDva375.sys File not found DRV - (XDva369) -- C:\Windows\System32\XDva369.sys File not found DRV - (XDva360) -- C:\Windows\System32\XDva360.sys File not found DRV - (GMSIPCI) -- E:\INSTALL\GMSIPCI.SYS File not found DRV - (FLASHSYS) -- C:\Program Files\MSI\Live Update 4\LU4\FLASHSYS.sys File not found DRV - (EagleNT) -- C:\Windows\System32\drivers\EagleNT.sys File not found DRV - (anf0100.sys) -- C:\Windows\System32\drivers\anf0100.sys File not found DRV - (KLIF) -- C:\Windows\System32\drivers\klif.sys (Kaspersky Lab) DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV - (dc3d) MS Hardware Device Detection Driver (USB) -- C:\Windows\System32\drivers\dc3d.sys (Microsoft Corporation) DRV - (adfs) -- C:\Windows\System32\drivers\adfs.sys (Adobe Systems, Inc.) DRV - (ISODrive) -- C:\Programme\UltraISO\drivers\ISODrive.sys (EZB Systems, Inc.) DRV - (UsbDiag) -- C:\Windows\System32\drivers\lgusbdiag.sys (LG Electronics Inc.) DRV - (USBModem) -- C:\Windows\System32\drivers\lgusbmodem.sys (LG Electronics Inc.) DRV - (usbbus) -- C:\Windows\System32\drivers\lgusbbus.sys (LG Electronics Inc.) DRV - (KSecPkg) -- C:\Windows\System32\Drivers\ksecpkg.sys (Microsoft Corporation) DRV - (SCREAMINGBDRIVER) -- C:\Windows\System32\drivers\ScreamingBAudio.sys (Screaming Bee LLC) DRV - (KLIM6) -- C:\Windows\System32\drivers\klim6.sys (Kaspersky Lab) DRV - (klbg) -- C:\Windows\system32\drivers\klbg.sys (Kaspersky Lab) DRV - (klmouflt) -- C:\Windows\System32\drivers\klmouflt.sys (Kaspersky Lab) DRV - (kl1) -- C:\Windows\System32\drivers\kl1.sys (Kaspersky Lab) DRV - (cmdide) -- C:\Windows\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.) DRV - (adpahci) -- C:\Windows\system32\DRIVERS\adpahci.sys (Adaptec, Inc.) DRV - (adp94xx) -- C:\Windows\system32\DRIVERS\adp94xx.sys (Adaptec, Inc.) DRV - (amdsbs) -- C:\Windows\system32\DRIVERS\amdsbs.sys (AMD Technologies Inc.) DRV - (adpu320) -- C:\Windows\system32\DRIVERS\adpu320.sys (Adaptec, Inc.) DRV - (arcsas) -- C:\Windows\system32\DRIVERS\arcsas.sys (Adaptec, Inc.) DRV - (amdsata) -- C:\Windows\system32\DRIVERS\amdsata.sys (Advanced Micro Devices) DRV - (arc) -- C:\Windows\system32\DRIVERS\arc.sys (Adaptec, Inc.) DRV - (amdxata) -- C:\Windows\system32\DRIVERS\amdxata.sys (Advanced Micro Devices) DRV - (aliide) -- C:\Windows\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.) DRV - (nvstor) -- C:\Windows\system32\DRIVERS\nvstor.sys (NVIDIA Corporation) DRV - (nvraid) -- C:\Windows\system32\DRIVERS\nvraid.sys (NVIDIA Corporation) DRV - (nfrd960) -- C:\Windows\system32\DRIVERS\nfrd960.sys (IBM Corporation) DRV - (LSI_SAS) -- C:\Windows\system32\DRIVERS\lsi_sas.sys (LSI Corporation) DRV - (iaStorV) -- C:\Windows\system32\DRIVERS\iaStorV.sys (Intel Corporation) DRV - (MegaSR) -- C:\Windows\system32\DRIVERS\MegaSR.sys (LSI Corporation, Inc.) DRV - (LSI_SCSI) -- C:\Windows\system32\DRIVERS\lsi_scsi.sys (LSI Corporation) DRV - (LSI_FC) -- C:\Windows\system32\DRIVERS\lsi_fc.sys (LSI Corporation) DRV - (LSI_SAS2) -- C:\Windows\system32\DRIVERS\lsi_sas2.sys (LSI Corporation) DRV - (iirsp) -- C:\Windows\system32\DRIVERS\iirsp.sys (Intel Corp./ICP vortex GmbH) DRV - (megasas) -- C:\Windows\system32\DRIVERS\megasas.sys (LSI Corporation) DRV - (hwpolicy) -- C:\Windows\System32\drivers\hwpolicy.sys (Microsoft Corporation) DRV - (elxstor) -- C:\Windows\system32\DRIVERS\elxstor.sys (Emulex) DRV - (aic78xx) -- C:\Windows\system32\DRIVERS\djsvs.sys (Adaptec, Inc.) DRV - (HpSAMD) -- C:\Windows\system32\DRIVERS\HpSAMD.sys (Hewlett-Packard Company) DRV - (FsDepends) -- C:\Windows\System32\drivers\fsdepends.sys (Microsoft Corporation) DRV - (vsmraid) -- C:\Windows\system32\DRIVERS\vsmraid.sys (VIA Technologies Inc.,Ltd) DRV - (vhdmp) -- C:\Windows\system32\DRIVERS\vhdmp.sys (Microsoft Corporation) DRV - (vdrvroot) -- C:\Windows\system32\DRIVERS\vdrvroot.sys (Microsoft Corporation) DRV - (WIMMount) -- C:\Windows\System32\drivers\wimmount.sys (Microsoft Corporation) DRV - (viaide) -- C:\Windows\system32\DRIVERS\viaide.sys (VIA Technologies, Inc.) DRV - (ql2300) -- C:\Windows\system32\DRIVERS\ql2300.sys (QLogic Corporation) DRV - (rdyboost) -- C:\Windows\System32\drivers\rdyboost.sys (Microsoft Corporation) DRV - (ql40xx) -- C:\Windows\system32\DRIVERS\ql40xx.sys (QLogic Corporation) DRV - (SiSRaid4) -- C:\Windows\system32\DRIVERS\sisraid4.sys (Silicon Integrated Systems) DRV - (pcw) -- C:\Windows\System32\drivers\pcw.sys (Microsoft Corporation) DRV - (SiSRaid2) -- C:\Windows\system32\DRIVERS\SiSRaid2.sys (Silicon Integrated Systems Corp.) DRV - (stexstor) -- C:\Windows\system32\DRIVERS\stexstor.sys (Promise Technology) DRV - (CNG) -- C:\Windows\System32\Drivers\cng.sys (Microsoft Corporation) DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\System32\Drivers\Brserid.sys (Brother Industries Ltd.) DRV - (rdpbus) -- C:\Windows\system32\DRIVERS\rdpbus.sys (Microsoft Corporation) DRV - (RDPREFMP) -- C:\Windows\System32\drivers\RDPREFMP.sys (Microsoft Corporation) DRV - (RasAgileVpn) WAN Miniport (IKEv2) -- C:\Windows\System32\drivers\agilevpn.sys (Microsoft Corporation) DRV - (WfpLwf) -- C:\Windows\System32\drivers\wfplwf.sys (Microsoft Corporation) DRV - (NdisCap) -- C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation) DRV - (vwifimp) -- C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation) DRV - (vwififlt) -- C:\Windows\System32\drivers\vwififlt.sys (Microsoft Corporation) DRV - (vwifibus) -- C:\Windows\System32\drivers\vwifibus.sys (Microsoft Corporation) DRV - (1394ohci) -- C:\Windows\system32\DRIVERS\1394ohci.sys (Microsoft Corporation) DRV - (UmPass) -- C:\Windows\system32\DRIVERS\umpass.sys (Microsoft Corporation) DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\Windows\System32\drivers\USBAUDIO.sys (Microsoft Corporation) DRV - (mshidkmdf) -- C:\Windows\System32\drivers\mshidkmdf.sys (Microsoft Corporation) DRV - (MTConfig) -- C:\Windows\system32\DRIVERS\MTConfig.sys (Microsoft Corporation) DRV - (CompositeBus) -- C:\Windows\System32\drivers\CompositeBus.sys (Microsoft Corporation) DRV - (AppID) -- C:\Windows\system32\drivers\appid.sys (Microsoft Corporation) DRV - (scfilter) -- C:\Windows\System32\drivers\scfilter.sys (Microsoft Corporation) DRV - (discache) -- C:\Windows\System32\drivers\discache.sys (Microsoft Corporation) DRV - (AcpiPmi) -- C:\Windows\system32\DRIVERS\acpipmi.sys (Microsoft Corporation) DRV - (AmdPPM) -- C:\Windows\system32\DRIVERS\amdppm.sys (Microsoft Corporation) DRV - (hcw85cir) -- C:\Windows\system32\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV - (BrUsbMdm) -- C:\Windows\System32\Drivers\BrUsbMdm.sys (Brother Industries Ltd.) DRV - (BrUsbSer) -- C:\Windows\System32\Drivers\BrUsbSer.sys (Brother Industries Ltd.) DRV - (BrSerWdm) -- C:\Windows\System32\Drivers\BrSerWdm.sys (Brother Industries Ltd.) DRV - (BrFiltLo) -- C:\Windows\system32\DRIVERS\BrFiltLo.sys (Brother Industries, Ltd.) DRV - (BrFiltUp) -- C:\Windows\system32\DRIVERS\BrFiltUp.sys (Brother Industries, Ltd.) DRV - (netr73) -- C:\Windows\System32\drivers\netr73.sys (Ralink Technology, Corp.) DRV - (b57nd60x) -- C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation) DRV - (ebdrv) -- C:\Windows\system32\DRIVERS\evbdx.sys (Broadcom Corporation) DRV - (b06bdrv) -- C:\Windows\system32\DRIVERS\bxvbdx.sys (Broadcom Corporation) DRV - (RTL8167) -- C:\Windows\System32\drivers\Rt86win7.sys (Realtek Corporation ) DRV - (sfsync02) StarForce Protection Synchronization Driver (version 2.x) -- C:\Windows\System32\drivers\sfsync02.sys (Protection Technology) DRV - (sfdrv01) StarForce Protection Environment Driver (version 1.x) -- C:\Windows\System32\drivers\sfdrv01.sys (Protection Technology (StarForce)) DRV - (sfhlp02) StarForce Protection Helper Driver (version 2.x) -- C:\Windows\System32\drivers\sfhlp02.sys (Protection Technology (StarForce)) DRV - (ovt530) -- C:\Windows\System32\drivers\ov530vid.sys (OmniVision Technologies, Inc.) DRV - (AR5211) -- C:\Windows\System32\drivers\ar5211.sys () ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1449085533-319408153-1176483877-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.babylon.com/home IE - HKU\S-1-5-21-1449085533-319408153-1176483877-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKU\S-1-5-21-1449085533-319408153-1176483877-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKU\S-1-5-21-1449085533-319408153-1176483877-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = AE D1 97 0B 72 BB CA 01 [binary data] IE - HKU\S-1-5-21-1449085533-319408153-1176483877-1001\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKU\S-1-5-21-1449085533-319408153-1176483877-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)" FF - prefs.js..browser.search.defaultthis.engineName: "Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.order.1: "Search the web (Babylon)" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.startup.homepage: "hxxp://search.conduit.com/?ctid=CT2269050&SearchSource=13" FF - prefs.js..extensions.enabledItems: linkfilter@kaspersky.ru:9.0.0.736 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.1 FF - prefs.js..extensions.enabledItems: ffxtlbr@babylon.com:1.1.3 FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.2.0 FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&q=" FF - HKLM\software\mozilla\Mozilla Firefox 3.6.2pre\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.07.27 20:11:22 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.2pre\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.12.06 19:49:56 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\THBExt [2010.08.22 18:06:54 | 000,000,000 | ---D | M] [2010.03.09 11:23:07 | 000,000,000 | ---D | M] (No name found) -- C:\Users\madde\AppData\Roaming\mozilla\Extensions [2010.12.30 17:45:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\madde\AppData\Roaming\mozilla\Firefox\Profiles\3lvx5367.default\extensions [2010.11.29 13:52:24 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\madde\AppData\Roaming\mozilla\Firefox\Profiles\3lvx5367.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2010.12.14 19:37:09 | 000,000,000 | ---D | M] (DVDVideoSoftTB Toolbar) -- C:\Users\madde\AppData\Roaming\mozilla\Firefox\Profiles\3lvx5367.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [2010.05.26 19:48:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\madde\AppData\Roaming\mozilla\Firefox\Profiles\3lvx5367.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} [2010.05.26 19:48:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\madde\AppData\Roaming\mozilla\Firefox\Profiles\3lvx5367.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} [2010.11.15 14:09:22 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\madde\AppData\Roaming\mozilla\Firefox\Profiles\3lvx5367.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2010.12.06 19:52:29 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\madde\AppData\Roaming\mozilla\Firefox\Profiles\3lvx5367.default\extensions\ffxtlbr@babylon.com [2010.12.14 20:10:50 | 000,000,873 | ---- | M] () -- C:\Users\madde\AppData\Roaming\Mozilla\FireFox\Profiles\3lvx5367.default\searchplugins\conduit.xml [2010.12.28 00:34:11 | 000,001,056 | ---- | M] () -- C:\Users\madde\AppData\Roaming\Mozilla\FireFox\Profiles\3lvx5367.default\searchplugins\icqplugin.xml [2010.11.29 13:52:54 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2010.08.22 18:07:16 | 000,000,000 | ---D | M] (Kaspersky URL Advisor) -- C:\Programme\Mozilla Firefox\extensions\linkfilter@kaspersky.ru [2010.08.22 18:07:16 | 000,000,000 | ---D | M] (Kaspersky URL Advisor) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\LINKFILTER@KASPERSKY.RU [2010.01.16 02:15:29 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.12.06 19:52:28 | 000,002,191 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\babylon.xml [2010.01.16 02:15:29 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010.01.16 02:15:29 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.01.16 02:15:29 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.01.16 02:15:29 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2010.03.13 00:30:26 | 000,324,445 | R--- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 127.0.0.1 1-2005-search.com O1 - Hosts: 11106 more lines... O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll (Kaspersky Lab) O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab) O4 - HKLM..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab) O4 - HKLM..\Run: [dcmsvc] C:\Programme\dcmsvc\dcmsvc.exe () O4 - HKLM..\Run: [lxbkbmgr.exe] C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe (Lexmark International, Inc.) O4 - HKU\S-1-5-21-1449085533-319408153-1176483877-1001..\Run: [CatDBmap3xx] C:\Users\madde\AppData\Local\iTunesPadHelper\CatDBmap3xx.DLL () O4 - HKU\S-1-5-21-1449085533-319408153-1176483877-1001..\Run: [ICQ] C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.) O4 - HKU\S-1-5-21-1449085533-319408153-1176483877-1001..\Run: [mssend] C:\Users\madde\AppData\Roaming\xssend2\svcnost.exe () O4 - HKU\S-1-5-21-1449085533-319408153-1176483877-1001..\Run: [Steam] C:\Program Files\Steam\Steam.exe (Valve Corporation) O4 - HKU\S-1-5-21-1449085533-319408153-1176483877-1001..\Run: [System32] C:\Users\madde\AppData\Roaming\system32.exe () O4 - HKU\S-1-5-21-1449085533-319408153-1176483877-1001..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.) O4 - HKU\S-1-5-21-1449085533-319408153-1176483877-1001..\Run: [Windows Updater] C:\Users\madde\AppData\Local\Temp\svchost.bat (ghjkhjk) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - Startup: C:\Users\madde\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DOGS DIARY.lnk = C:\Programme\DOGS DIARY\DOGS DIARY.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O7 - HKU\S-1-5-21-1449085533-319408153-1176483877-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm () O9 - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab) O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\mzvkbd3.dll (Kaspersky Lab) O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll) - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\kloehk.dll (Kaspersky Lab) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - Winlogon\Notify\klogon: DllName - C:\Windows\system32\klogon.dll - C:\Windows\System32\klogon.dll (Kaspersky Lab) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{08dfb716-ebd0-11df-bd80-00241d5ccfed}\Shell - "" = AutoRun O33 - MountPoints2\{08dfb716-ebd0-11df-bd80-00241d5ccfed}\Shell\AutoRun\command - "" = F:\LGAutoRun.exe -- File not found O33 - MountPoints2\{1e7f77cb-05dd-11e0-93ee-00241d5ccfed}\Shell - "" = AutoRun O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - File not found NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found NetSvcs: Themes - C:\Windows\System32\themeservice.dll (Microsoft Corporation) NetSvcs: BDESVC - C:\Windows\System32\bdesvc.dll (Microsoft Corporation) MsConfig - StartUpFolder: C:^Users^madde^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Warner Bros.lnk - D:\Neuer Ordner (2)\Warner Bros. Digital Copy Manager\Warner Bros. Digital Copy Manager.exe - File not found MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) MsConfig - StartUpReg: AdobeCS4ServiceManager - hkey= - key= - C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated) MsConfig - StartUpReg: EA Core - hkey= - key= - C:\Program Files\Electronic Arts\EADM\Core.exe File not found MsConfig - StartUpReg: ICQ - hkey= - key= - C:\Program Files\ICQ7.0\ICQ.exe File not found MsConfig - StartUpReg: IpSharkk - hkey= - key= - C:\Program Files\IpSharkk\IpSharkk.exe File not found MsConfig - StartUpReg: iTunesHelper - hkey= - key= - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.) MsConfig - StartUpReg: LightScribe Control Panel - hkey= - key= - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe (Hewlett-Packard Company) MsConfig - StartUpReg: msnmsgr - hkey= - key= - C:\Program Files\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation) MsConfig - StartUpReg: OfficeSyncProcess - hkey= - key= - C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE File not found MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files\QuickTime\QTTask.exe (Apple Inc.) MsConfig - StartUpReg: Skype - hkey= - key= - C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.) MsConfig - StartUpReg: uTorrent - hkey= - key= - C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.) MsConfig - StartUpReg: WinampAgent - hkey= - key= - C:\Program Files\Winamp\winampa.exe (Nullsoft, Inc.) MsConfig - State: "startup" - 2 SafeBootMin: AppMgmt - Service SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: NTDS - File not found SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Power - C:\Windows\System32\umpo.dll (Microsoft Corporation) SafeBootMin: Primary disk - Driver Group SafeBootMin: RpcEptMapper - C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation) SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: vmms - Service SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: AppMgmt - Service SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: Dhcp - C:\Windows\System32\dhcpcore.dll (Microsoft Corporation) SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: Messenger - Service SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: ndiscap - C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation) SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: NTDS - File not found SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Power - C:\Windows\System32\umpo.dll (Microsoft Corporation) SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: RpcEptMapper - C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation) SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: vmms - Service SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe" ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89724421-A0EE-E025-7832-CBAE7B0CEDFD} - LightScribe Control Panel ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {92279BAA-07A2-ED83-0D22-16CDD2E1F913} - Internet Explorer ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework ActiveX: {CFDA5683-CCB7-409F-16CF-EF615665D4B6} - Java (Sun) ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.) ========== Files/Folders - Created Within 30 Days ========== [2010.12.28 09:12:55 | 000,000,000 | ---D | C] -- C:\Users\madde\AppData\Roaming\xssend2 [2010.12.28 09:08:29 | 000,000,000 | ---D | C] -- C:\Users\madde\AppData\Roaming\ru3wuo1yertdxffnten2v1tinwz1fzz2 [2010.12.22 14:31:06 | 000,000,000 | ---D | C] -- C:\Users\madde\AppData\Local\RemBOIBot [2010.12.22 12:41:01 | 000,000,000 | ---D | C] -- C:\Users\madde\Desktop\nancy [2010.12.21 17:32:47 | 000,000,000 | ---D | C] -- C:\RocWorks [2010.12.21 16:14:37 | 000,000,000 | ---D | C] -- C:\maestia [2010.12.21 13:39:59 | 000,000,000 | ---D | C] -- C:\KarosOnline [2010.12.20 17:41:55 | 000,000,000 | ---D | C] -- C:\Programme\Alaplaya [2010.12.18 00:12:03 | 000,000,000 | ---D | C] -- C:\Users\madde\AppData\Local\iTunesPadHelper [2010.12.18 00:08:55 | 000,000,000 | ---D | C] -- C:\Perfect World Entertainment [2010.12.17 23:37:16 | 000,000,000 | ---D | C] -- C:\Users\madde\Documents\Downloads [2010.12.17 23:37:13 | 000,000,000 | ---D | C] -- C:\Users\madde\AppData\Roaming\GetRightToGo [2010.12.16 09:29:30 | 000,000,000 | ---D | C] -- C:\friidump [2010.12.15 21:43:07 | 000,000,000 | ---D | C] -- C:\Users\madde\Desktop\Neuer Ordner (3) [2010.12.15 20:21:48 | 000,000,000 | ---D | C] -- C:\Users\madde\AppData\Local\WBFSManager [2010.12.15 20:20:31 | 000,000,000 | ---D | C] -- C:\Users\madde\Documents\WBFS Manager Covers [2010.12.15 20:20:31 | 000,000,000 | ---D | C] -- C:\Programme\WBFS [2010.12.15 19:57:10 | 000,000,000 | ---D | C] -- C:\Users\madde\Documents\Meine empfangenen Dateien [2010.12.15 19:02:24 | 000,000,000 | ---D | C] -- C:\Users\madde\Desktop\nine [2010.12.15 11:35:17 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll [2010.12.15 11:35:09 | 000,606,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll [2010.12.15 11:35:05 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2010.12.15 11:35:05 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2010.12.15 11:35:05 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec [2010.12.15 11:35:05 | 000,381,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll [2010.12.15 11:35:05 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll [2010.12.15 11:35:05 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2010.12.15 11:35:05 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll [2010.12.15 11:35:05 | 000,048,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2010.12.15 11:35:05 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll [2010.12.15 11:35:05 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe [2010.12.15 11:35:03 | 000,496,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskschd.dll [2010.12.15 11:35:03 | 000,351,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmicmiplugin.dll [2010.12.15 11:35:03 | 000,305,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskcomp.dll [2010.12.15 11:35:03 | 000,179,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\schtasks.exe [2010.12.15 11:35:02 | 000,294,400 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll [2010.12.15 11:35:02 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll [2010.12.15 11:35:01 | 000,314,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\webio.dll [2010.12.15 11:35:00 | 000,101,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\consent.exe [2010.12.15 11:34:59 | 002,327,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2010.12.14 19:27:10 | 000,000,000 | ---D | C] -- C:\Users\madde\Desktop\moni [2010.12.14 19:22:35 | 000,000,000 | ---D | C] -- C:\Users\madde\Documents\DVDVideoSoft [2010.12.14 19:22:30 | 000,000,000 | ---D | C] -- C:\Users\madde\AppData\Roaming\DVDVideoSoft [2010.12.14 19:22:29 | 000,000,000 | ---D | C] -- C:\Programme\DVDVideoSoft [2010.12.14 19:22:29 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\DVDVideoSoft [2010.12.14 18:40:08 | 000,000,000 | ---D | C] -- C:\Programme\uTorrent [2010.12.14 12:27:10 | 000,000,000 | ---D | C] -- C:\Users\madde\AppData\Roaming\com.adobe.example.diary.AC2D34E49418B393981766FA31245F1D30E4A56D.1 [2010.12.14 12:27:09 | 000,000,000 | ---D | C] -- C:\Programme\DOGS DIARY [2010.12.12 11:57:18 | 000,000,000 | ---D | C] -- C:\Users\madde\Desktop\nine handy [2010.12.10 13:36:52 | 000,000,000 | ---D | C] -- C:\Programme\gamigo [2010.12.06 19:44:07 | 000,000,000 | ---D | C] -- C:\Users\madde\AppData\Local\Ares [2010.12.03 20:43:26 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Skype [2010.06.02 08:37:26 | 001,224,704 | ---- | C] ( ) -- C:\Windows\System32\lxbkserv.dll [2010.06.02 08:37:26 | 000,991,232 | ---- | C] ( ) -- C:\Windows\System32\lxbkusb1.dll [2010.06.02 08:37:26 | 000,696,320 | ---- | C] ( ) -- C:\Windows\System32\lxbkhbn3.dll [2010.06.02 08:37:26 | 000,684,032 | ---- | C] ( ) -- C:\Windows\System32\lxbkcomc.dll [2010.06.02 08:37:26 | 000,643,072 | ---- | C] ( ) -- C:\Windows\System32\lxbkpmui.dll [2010.06.02 08:37:26 | 000,585,728 | ---- | C] ( ) -- C:\Windows\System32\lxbklmpm.dll [2010.06.02 08:37:26 | 000,421,888 | ---- | C] ( ) -- C:\Windows\System32\lxbkcomm.dll [2010.06.02 08:37:26 | 000,413,696 | ---- | C] ( ) -- C:\Windows\System32\lxbkinpa.dll [2010.06.02 08:37:26 | 000,397,312 | ---- | C] ( ) -- C:\Windows\System32\lxbkiesc.dll [2010.06.02 08:37:26 | 000,323,584 | ---- | C] ( ) -- C:\Windows\System32\LXBKhcp.dll [2010.06.02 08:37:26 | 000,163,840 | ---- | C] ( ) -- C:\Windows\System32\lxbkprox.dll [2010.06.02 08:37:26 | 000,094,208 | ---- | C] ( ) -- C:\Windows\System32\lxbkpplc.dll [6 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010.12.30 17:35:04 | 000,014,608 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2010.12.30 17:35:04 | 000,014,608 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2010.12.30 17:34:20 | 000,667,012 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2010.12.30 17:34:20 | 000,627,194 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2010.12.30 17:34:20 | 000,135,778 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2010.12.30 17:34:20 | 000,111,430 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2010.12.30 17:27:53 | 000,000,978 | ---- | M] () -- C:\Users\madde\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DOGS DIARY.lnk [2010.12.30 17:27:24 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.12.30 17:27:16 | 2414,731,264 | -HS- | M] () -- C:\hiberfil.sys [2010.12.28 13:09:01 | 000,315,798 | ---- | M] () -- C:\Users\madde\Documents\kranken karte vorne.jpg [2010.12.28 13:07:47 | 000,455,679 | ---- | M] () -- C:\Users\madde\Documents\perso hinten.jpg [2010.12.28 13:06:11 | 000,498,043 | ---- | M] () -- C:\Users\madde\Documents\perso vorne.jpg [2010.12.28 13:04:38 | 000,268,201 | ---- | M] () -- C:\Users\madde\Documents\kranken karte hinten.jpg [2010.12.28 11:53:55 | 002,346,568 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2010.12.25 17:42:32 | 000,001,385 | ---- | M] () -- C:\Users\madde\Desktop\LastChaosMulti.lnk [2010.12.23 12:48:14 | 000,000,690 | ---- | M] () -- C:\Users\madde\Desktop\LastChaosMultl.lnk [2010.12.21 18:54:02 | 008,474,624 | ---- | M] () -- C:\Users\madde\Desktop\The Time - Black Eyed Peas Dirty Bit.mp3 [2010.12.21 17:44:20 | 000,000,730 | ---- | M] () -- C:\Users\madde\Desktop\MAESTIA.lnk [2010.12.21 13:39:59 | 000,001,293 | ---- | M] () -- C:\Users\Public\Desktop\Karos Online.lnk [2010.12.21 11:17:59 | 2324,843,605 | ---- | M] () -- C:\Users\madde\Desktop\Loong_English-Setup.exe.downloading [2010.12.21 11:16:58 | 000,000,400 | ---- | M] () -- C:\Users\madde\Desktop\Resume Download of Loong.url [2010.12.20 17:40:40 | 1932,097,948 | ---- | M] () -- C:\Users\madde\Desktop\LOCO_Setup.exe [2010.12.18 00:19:21 | 000,000,984 | ---- | M] () -- C:\Users\Public\Desktop\Battle of the Immortals.lnk [2010.12.16 18:53:08 | 003,820,952 | ---- | M] () -- C:\Users\madde\Desktop\hackmii_installer_v0.8.zip [2010.12.15 20:20:31 | 000,002,663 | ---- | M] () -- C:\Users\Public\Desktop\WBFS Manager 4.0.lnk [2010.12.15 20:01:59 | 006,923,704 | ---- | M] () -- C:\Users\madde\Desktop\usb_loader_gx_r934.rar [2010.12.15 19:54:31 | 000,331,411 | ---- | M] () -- C:\Users\madde\Desktop\Firmware_Updater_4_3_b.zip [2010.12.14 22:48:19 | 000,068,752 | ---- | M] () -- C:\Users\madde\Desktop\Camper+$C3$9Cberraschung.jpg [2010.12.14 12:27:09 | 000,000,870 | ---- | M] () -- C:\Users\Public\Desktop\DOGS DIARY.lnk [2010.12.14 12:26:27 | 000,291,931 | ---- | M] () -- C:\Users\madde\Desktop\diary.air [2010.12.13 15:26:00 | 000,002,703 | ---- | M] () -- C:\Users\Public\Desktop\LevelR.lnk [2010.12.13 14:12:05 | 000,002,172 | ---- | M] () -- C:\Users\Public\Desktop\Need For Speed World.lnk [2010.12.13 13:18:36 | 000,114,243 | ---- | M] () -- C:\Windows\System32\drivers\klin.dat [2010.12.13 13:18:36 | 000,097,859 | ---- | M] () -- C:\Windows\System32\drivers\klick.dat [2010.12.08 21:31:33 | 000,444,952 | ---- | M] (Creative Labs) -- C:\Windows\System32\wrap_oal.dll [2010.12.08 21:31:33 | 000,109,080 | ---- | M] (Portions (C) Creative Labs Inc. and NVIDIA Corp.) -- C:\Windows\System32\OpenAL32.dll [2010.12.08 17:14:51 | 000,000,561 | ---- | M] () -- C:\Users\Public\Desktop\Sniper Elite.lnk [2010.12.04 16:15:15 | 000,000,741 | ---- | M] () -- C:\Users\madde\Desktop\BlackShot.lnk [2010.12.04 11:44:30 | 000,000,301 | ---- | M] () -- C:\Users\madde\Desktop\liebe.vbs [6 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2010.12.28 13:09:01 | 000,315,798 | ---- | C] () -- C:\Users\madde\Documents\kranken karte vorne.jpg [2010.12.28 13:07:47 | 000,455,679 | ---- | C] () -- C:\Users\madde\Documents\perso hinten.jpg [2010.12.28 13:06:11 | 000,498,043 | ---- | C] () -- C:\Users\madde\Documents\perso vorne.jpg [2010.12.28 13:03:18 | 000,268,201 | ---- | C] () -- C:\Users\madde\Documents\kranken karte hinten.jpg [2010.12.25 16:56:31 | 000,001,385 | ---- | C] () -- C:\Users\madde\Desktop\LastChaosMulti.lnk [2010.12.23 12:48:14 | 000,000,690 | ---- | C] () -- C:\Users\madde\Desktop\LastChaosMultl.lnk [2010.12.21 18:53:33 | 008,474,624 | ---- | C] () -- C:\Users\madde\Desktop\The Time - Black Eyed Peas Dirty Bit.mp3 [2010.12.21 17:44:20 | 000,000,730 | ---- | C] () -- C:\Users\madde\Desktop\MAESTIA.lnk [2010.12.21 13:39:59 | 000,001,293 | ---- | C] () -- C:\Users\Public\Desktop\Karos Online.lnk [2010.12.21 11:16:58 | 000,000,400 | ---- | C] () -- C:\Users\madde\Desktop\Resume Download of Loong.url [2010.12.21 10:36:59 | 2324,843,605 | ---- | C] () -- C:\Users\madde\Desktop\Loong_English-Setup.exe.downloading [2010.12.20 16:49:25 | 1932,097,948 | ---- | C] () -- C:\Users\madde\Desktop\LOCO_Setup.exe [2010.12.18 00:19:21 | 000,000,984 | ---- | C] () -- C:\Users\Public\Desktop\Battle of the Immortals.lnk [2010.12.16 18:53:00 | 003,820,952 | ---- | C] () -- C:\Users\madde\Desktop\hackmii_installer_v0.8.zip [2010.12.15 20:20:31 | 000,002,663 | ---- | C] () -- C:\Users\Public\Desktop\WBFS Manager 4.0.lnk [2010.12.15 20:08:11 | 006,923,704 | ---- | C] () -- C:\Users\madde\Desktop\usb_loader_gx_r934.rar [2010.12.15 19:57:39 | 000,331,411 | ---- | C] () -- C:\Users\madde\Desktop\Firmware_Updater_4_3_b.zip [2010.12.14 22:48:39 | 000,068,752 | ---- | C] () -- C:\Users\madde\Desktop\Camper+$C3$9Cberraschung.jpg [2010.12.14 12:27:10 | 000,000,978 | ---- | C] () -- C:\Users\madde\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DOGS DIARY.lnk [2010.12.14 12:27:09 | 000,000,870 | ---- | C] () -- C:\Users\Public\Desktop\DOGS DIARY.lnk [2010.12.14 12:26:41 | 000,291,931 | ---- | C] () -- C:\Users\madde\Desktop\diary.air [2010.12.13 15:26:00 | 000,002,703 | ---- | C] () -- C:\Users\Public\Desktop\LevelR.lnk [2010.12.13 14:12:05 | 000,002,172 | ---- | C] () -- C:\Users\Public\Desktop\Need For Speed World.lnk [2010.12.12 11:56:49 | 001,884,435 | ---- | C] () -- C:\Users\madde\Desktop\Muvee0001.3gp [2010.12.12 11:56:40 | 000,561,152 | ---- | C] () -- C:\Users\madde\Desktop\hellokitty_nm1khpce.thm [2010.12.12 11:56:29 | 000,512,171 | ---- | C] () -- C:\Users\madde\Desktop\DSC01779.jpg [2010.12.12 11:56:29 | 000,060,557 | ---- | C] () -- C:\Users\madde\Desktop\Foto093.jpg [2010.12.12 11:56:29 | 000,052,948 | ---- | C] () -- C:\Users\madde\Desktop\Foto094.jpg [2010.12.12 11:56:29 | 000,046,505 | ---- | C] () -- C:\Users\madde\Desktop\Foto095.jpg [2010.12.12 11:56:29 | 000,035,067 | ---- | C] () -- C:\Users\madde\Desktop\Love.jpg [2010.12.08 17:14:51 | 000,000,561 | ---- | C] () -- C:\Users\Public\Desktop\Sniper Elite.lnk [2010.12.04 16:15:15 | 000,000,741 | ---- | C] () -- C:\Users\madde\Desktop\BlackShot.lnk [2010.12.04 11:41:10 | 000,000,301 | ---- | C] () -- C:\Users\madde\Desktop\liebe.vbs [2010.11.10 12:59:03 | 001,166,848 | ---- | C] () -- C:\Users\madde\AppData\Roaming\system32.exe [2010.08.30 11:38:57 | 000,175,104 | ---- | C] () -- C:\Users\madde\AppData\Roaming\SQLite3.dll [2010.08.30 11:38:32 | 000,000,000 | ---- | C] () -- C:\Users\madde\AppData\Roaming\chrtmp [2010.08.27 14:59:33 | 000,000,093 | ---- | C] () -- C:\Users\madde\AppData\Local\fusioncache.dat [2010.08.27 11:31:09 | 000,000,110 | ---- | C] () -- C:\Windows\GMouse.ini [2010.08.14 19:25:44 | 000,004,990 | ---- | C] () -- C:\ProgramData\mtbjfghn.xbe [2010.08.08 19:09:57 | 000,407,296 | ---- | C] () -- C:\Windows\System32\drivers\ar52119x.sys [2010.08.08 19:09:57 | 000,407,296 | ---- | C] () -- C:\Windows\System32\ar52119x.sys [2010.08.08 19:09:57 | 000,407,264 | ---- | C] () -- C:\Windows\System32\drivers\ar5211.sys [2010.08.08 19:09:57 | 000,407,264 | ---- | C] () -- C:\Windows\System32\ar5211.sys [2010.08.08 19:09:55 | 000,651,264 | ---- | C] () -- C:\Windows\System32\libeay32.dll [2010.08.08 19:09:52 | 000,147,456 | ---- | C] () -- C:\Windows\System32\ssleay32.dll [2010.06.24 13:59:15 | 001,970,176 | ---- | C] () -- C:\Windows\System32\d3dx9.dll [2010.06.24 07:32:59 | 000,000,576 | ---- | C] () -- C:\ProgramData\afl.log [2010.06.02 08:38:05 | 000,000,093 | ---- | C] () -- C:\Windows\Lexstat.ini [2010.06.02 08:37:26 | 000,413,696 | ---- | C] () -- C:\Windows\System32\lxbkutil.dll [2010.06.02 08:37:26 | 000,274,432 | ---- | C] () -- C:\Windows\System32\LXBKinst.dll [2010.06.01 19:35:40 | 000,000,193 | ---- | C] () -- C:\Windows\WORDPAD.INI [2010.03.29 11:25:06 | 000,138,664 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys [2010.03.26 16:45:52 | 000,389,120 | ---- | C] () -- C:\Windows\System32\HookShield.dll [2010.03.26 16:45:52 | 000,225,280 | ---- | C] () -- C:\Windows\System32\HookMap.dll [2010.03.26 16:45:52 | 000,134,504 | ---- | C] () -- C:\Windows\System32\smdll.dll [2010.03.26 16:45:52 | 000,036,200 | ---- | C] () -- C:\Windows\System32\Auxiliary.dll [2010.03.09 10:17:39 | 000,138,056 | ---- | C] () -- C:\Users\madde\AppData\Roaming\PnkBstrK.sys [2009.07.14 00:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll [2007.02.07 16:57:50 | 000,039,899 | ---- | C] () -- C:\Windows\System32\rtsicis.ini [2007.01.22 07:49:34 | 000,344,064 | ---- | C] () -- C:\Windows\System32\lxbkcoin.dll [2006.01.15 01:38:30 | 000,002,056 | -H-- | C] () -- C:\Users\madde\AppData\Roaming\logs.dat [2005.10.05 11:19:32 | 000,040,960 | ---- | C] () -- C:\Windows\System32\lxbkvs.dll [2005.09.13 15:27:10 | 000,061,440 | ---- | C] () -- C:\Windows\System32\lxbkcnv5.dll [2005.09.13 15:27:10 | 000,061,440 | ---- | C] () -- C:\Windows\System32\lxbkcnv4.dll ========== LOP Check ========== [2010.09.04 16:59:02 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\Ashampoo [2010.08.14 19:25:44 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\Carambis [2010.10.12 17:48:51 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\City Interactive 3 Days Zoo Mystery [2010.12.14 12:27:10 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\com.adobe.example.diary.AC2D34E49418B393981766FA31245F1D30E4A56D.1 [2010.04.19 17:23:42 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\com.warnerbros.DigitalCopyManager.449F66ACC381FDC604DC2AA255FEECEEBBBEE1E5.1 [2010.03.18 20:24:55 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\Command and Conquer 4 [2010.12.14 19:22:30 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\DVDVideoSoft [2010.06.21 18:37:40 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\FreeScreenToVideo [2010.12.18 00:08:45 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\GetRightToGo [2010.03.28 14:19:47 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\gtk-2.0 [2010.12.30 17:33:17 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\ICQ [2010.08.27 10:40:11 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\Process Hacker 2 [2010.10.11 10:56:20 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\rondomedia [2010.12.28 18:11:30 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\ru3wuo1yertdxffnten2v1tinwz1fzz2 [2010.05.08 12:35:24 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\Screaming Bee [2010.03.04 17:13:57 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\TeamViewer [2010.12.22 18:18:28 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\TS3Client [2010.11.15 13:56:42 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\TuneUp Software [2010.08.15 13:16:51 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\Twintale Entertainment [2010.03.11 15:24:09 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\Ubisoft [2010.04.03 03:05:02 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\Ukryag [2010.12.30 17:34:12 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\uTorrent [2010.12.21 13:52:44 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\Uwzu [2010.12.30 17:24:57 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\xssend2 [2010.10.20 14:19:29 | 000,032,630 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2010.04.05 11:02:52 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\Adobe [2010.06.18 16:52:45 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\Apple Computer [2010.09.04 16:59:02 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\Ashampoo [2010.08.14 19:25:44 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\Carambis [2010.10.12 17:48:51 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\City Interactive 3 Days Zoo Mystery [2010.12.14 12:27:10 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\com.adobe.example.diary.AC2D34E49418B393981766FA31245F1D30E4A56D.1 [2010.04.19 17:23:42 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\com.warnerbros.DigitalCopyManager.449F66ACC381FDC604DC2AA255FEECEEBBBEE1E5.1 [2010.03.18 20:24:55 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\Command and Conquer 4 [2010.11.12 11:04:52 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\dvdcss [2010.12.14 19:22:30 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\DVDVideoSoft [2010.06.21 18:37:40 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\FreeScreenToVideo [2010.12.18 00:08:45 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\GetRightToGo [2010.03.28 14:19:47 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\gtk-2.0 [2010.12.30 17:33:17 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\ICQ [2010.03.04 09:07:44 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\Identities [2010.03.20 23:10:04 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\InstallShield [2010.04.01 17:58:57 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\Lavasoft [2010.03.04 15:33:41 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\Macromedia [2009.07.14 09:56:41 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\Media Center Programs [2010.09.09 17:39:51 | 000,000,000 | --SD | M] -- C:\Users\madde\AppData\Roaming\Microsoft [2010.03.09 11:23:07 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\Mozilla [2010.04.23 12:00:16 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\NVIDIA [2010.08.27 10:40:11 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\Process Hacker 2 [2010.10.11 10:56:20 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\rondomedia [2010.12.28 18:11:30 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\ru3wuo1yertdxffnten2v1tinwz1fzz2 [2010.05.08 12:35:24 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\Screaming Bee [2010.04.28 14:35:40 | 000,000,000 | RH-D | M] -- C:\Users\madde\AppData\Roaming\SecuROM [2010.12.22 23:16:56 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\Skype [2010.12.22 17:53:30 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\skypePM [2010.03.04 17:13:57 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\TeamViewer [2010.12.22 18:18:28 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\TS3Client [2010.11.15 13:56:42 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\TuneUp Software [2010.08.15 13:16:51 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\Twintale Entertainment [2010.03.11 15:24:09 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\Ubisoft [2010.04.03 03:05:02 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\Ukryag [2010.12.30 17:34:12 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\uTorrent [2010.12.21 13:52:44 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\Uwzu [2010.12.20 12:11:56 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\vlc [2010.06.21 13:05:56 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\Winamp [2010.03.04 16:41:06 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\WinRAR [2010.12.30 17:24:57 | 000,000,000 | ---D | M] -- C:\Users\madde\AppData\Roaming\xssend2 < %APPDATA%\*.exe /s > [2010.11.10 12:58:49 | 001,166,848 | ---- | M] () -- C:\Users\madde\AppData\Roaming\system32.exe [2010.12.14 12:53:54 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\madde\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe [2010.12.28 09:12:48 | 000,145,920 | ---- | M] () -- C:\Users\madde\AppData\Roaming\xssend2\svcnost.exe < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys [2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys [2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys < MD5 for: ATAPI.SYS > [2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys [2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys [2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys < MD5 for: CNGAUDIT.DLL > [2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll [2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll < MD5 for: EXPLORER.EXE > [2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe [2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\explorer.exe [2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe [2009.08.03 06:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe [2009.08.03 06:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe [2009.10.31 07:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe < MD5 for: IASTORV.SYS > [2009.07.14 02:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\drivers\iaStorV.sys [2009.07.14 02:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys [2009.07.14 02:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys < MD5 for: NETLOGON.DLL > [2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\System32\netlogon.dll [2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll < MD5 for: NVSTOR.SYS > [2009.07.14 02:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\drivers\nvstor.sys [2009.07.14 02:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys [2009.07.14 02:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys < MD5 for: SCECLI.DLL > [2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\System32\scecli.dll [2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll < MD5 for: USER32.DLL > [2009.07.14 02:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\System32\user32.dll [2009.07.14 02:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll < MD5 for: USERINIT.EXE > [2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\System32\userinit.exe [2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe < MD5 for: WINLOGON.EXE > [2009.10.28 07:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\System32\winlogon.exe [2009.10.28 07:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe [2009.10.28 06:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe [2009.07.14 02:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe < MD5 for: WS2IFSL.SYS > [2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys [2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [2009.07.14 02:15:20 | 000,380,957 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\expsrv.dll [2010.05.22 17:23:00 | 001,355,776 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\MSVBVM50.dll [2009.07.14 02:15:50 | 001,386,496 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\msvbvm60.dll [6 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ] ========== Alternate Data Streams ========== @Alternate Data Stream - 12 bytes -> C:\Users\madde\Documents:{726B6F7C-E889-4EFE-8CA3-AEF4943DBD38} < End of report > gruß martin |
|
30.12.2010, 18:54
| #5 |
| /// Malware-holic | Backdoor.Win32.Spammy.lx problehm • Starte bitte die OTL.exe • Kopiere nun das Folgende in die Textbox. :OTL O4 - HKU\S-1-5-21-1449085533-319408153-1176483877-1001..\Run: [Windows Updater] C:\Users\madde\AppData\Local\Temp\svchost.bat (ghjkhjk) O4 - HKU\S-1-5-21-1449085533-319408153-1176483877-1001..\Run: [System32] C:\Users\madde\AppData\Roaming\system32.exe () O4 - HKU\S-1-5-21-1449085533-319408153-1176483877-1001..\Run: [mssend] C:\Users\madde\AppData\Roaming\xssend2\svcnost.exe () O4 - HKU\S-1-5-21-1449085533-319408153-1176483877-1001..\Run: [CatDBmap3xx] C:\Users\madde\AppData\Local\iTunesPadHelper\CatDBmap3xx.DLL () [2010.12.18 00:12:03 | 000,000,000 | ---D | C] -- C:\Users\madde\AppData\Local\iTunesPadHelper [2010.12.28 09:12:55 | 000,000,000 | ---D | C] -- C:\Users\madde\AppData\Roaming\xssend2 [2010.12.28 09:08:29 | 000,000,000 | ---D | C] -- C:\Users\madde\AppData\Roaming\ru3wuo1yertdxffnten2v1tinwz1fzz2 :Files C:\Dokumente und Einstellungen\Rene.HOME-PC\Lokale Einstellungen\Temp\Bt1.exe [2010.12.29 09:02:22 | 000,208,896 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\WINDOWS\Bwukoa.exe [2010.12.29 09:02:15 | 000,299,008 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\WINDOWS\System32\sshnas21.dll [2010.12.30 13:26:04 | 000,000,290 | -H-- | M] () -- C:\WINDOWS\tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job [2010.12.30 13:25:49 | 000,000,290 | -H-- | M] () -- C:\WINDOWS\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job [2010.12.30 13:13:04 | 000,000,244 | -H-- | M] () -- C:\WINDOWS\tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job :Commands [purity] [EMPTYFLASH] [emptytemp] [Reboot] • Schliesse bitte nun alle Programme. • Klicke nun bitte auf den Fix Button. • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen. • Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort posten. öffne mein computer, c: dann _OTL dort rechtsklick auf moved files wähle zu moved files.rar oder zip hinzufügen. lade das archiv in unserem upload channel hoch. http://www.trojaner-board.de/54791-a...ner-board.html
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
30.12.2010, 19:09
| #6 |
| | Backdoor.Win32.Spammy.lx problehm so habe die sachen hochgeladen!! gruß martin All processes killed ========== OTL ========== Registry value HKEY_USERS\S-1-5-21-1449085533-319408153-1176483877-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Windows Updater deleted successfully. C:\Users\madde\AppData\Local\Temp\svchost.bat moved successfully. Registry value HKEY_USERS\S-1-5-21-1449085533-319408153-1176483877-1001\Software\Microsoft\Windows\CurrentVersion\Run\\System32 deleted successfully. C:\Users\madde\AppData\Roaming\system32.exe moved successfully. Registry value HKEY_USERS\S-1-5-21-1449085533-319408153-1176483877-1001\Software\Microsoft\Windows\CurrentVersion\Run\\mssend deleted successfully. File move failed. C:\Users\madde\AppData\Roaming\xssend2\svcnost.exe scheduled to be moved on reboot. Registry value HKEY_USERS\S-1-5-21-1449085533-319408153-1176483877-1001\Software\Microsoft\Windows\CurrentVersion\Run\\CatDBmap3xx deleted successfully. C:\Users\madde\AppData\Local\iTunesPadHelper\CatDBmap3xx.DLL moved successfully. C:\Users\madde\AppData\Local\iTunesPadHelper folder moved successfully. Folder move failed. C:\Users\madde\AppData\Roaming\xssend2 scheduled to be moved on reboot. C:\Users\madde\AppData\Roaming\ru3wuo1yertdxffnten2v1tinwz1fzz2 folder moved successfully. ========== FILES ========== File\Folder C:\Dokumente und Einstellungen\Rene.HOME-PC\Lokale Einstellungen\Temp\Bt1.exe not found. File\Folder [2010.12.29 09:02:22 | 000,208,896 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\WINDOWS\Bwukoa.exe not found. File\Folder [2010.12.29 09:02:15 | 000,299,008 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\WINDOWS\System32\sshnas21.dll not found. File\Folder [2010.12.30 13:26:04 | 000,000,290 | -H-- | M] () -- C:\WINDOWS\tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job not found. File\Folder [2010.12.30 13:25:49 | 000,000,290 | -H-- | M] () -- C:\WINDOWS\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job not found. File\Folder [2010.12.30 13:13:04 | 000,000,244 | -H-- | M] () -- C:\WINDOWS\tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job not found. ========== COMMANDS ========== [EMPTYFLASH] User: All Users User: Default ->Flash cache emptied: 56502 bytes User: Default User ->Flash cache emptied: 0 bytes User: madde ->Flash cache emptied: 103744 bytes User: Public Total Flash Files Cleaned = 0,00 mb [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: madde ->Temp folder emptied: 5283122121 bytes ->Temporary Internet Files folder emptied: 8878166 bytes ->Java cache emptied: 12394810 bytes ->FireFox cache emptied: 57453579 bytes ->Flash cache emptied: 0 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 4856976 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 346191882 bytes RecycleBin emptied: 2512615932 bytes Total Files Cleaned = 7.844,00 mb OTL by OldTimer - Version 3.2.18.2 log created on 12302010_185732 Files\Folders moved on Reboot... File\Folder C:\Users\madde\AppData\Roaming\xssend2\svcnost.exe not found! C:\Users\madde\AppData\Roaming\xssend2 folder moved successfully. Registry entries deleted on Reboot... Geändert von madde25 (30.12.2010 um 19:23 Uhr) |
|
30.12.2010, 20:44
| #7 |
| | Backdoor.Win32.Spammy.lx problehm ich weiß ja nicht was jetzt geschen ist aber durch die sachen die ich machen sollte schein das teil wohl lahmgelegt worden sein weil aufeinmal konnte mein vieren programm gegen das teil an gehen und hat es gelöscht!! Dan sage ich mal danke schön markusg für deine hilfe auch wenn ich nicht weiß was du / ich da jetzt gemacht haben!! aber eine frage habe ich noch und zwar möchte ich gerne wissen ob du aus den logs sehen kannst ob noch irgendwas nicht stimmt weil seit dem ich diesen backdoor drauf hatte hat mein viren programm auch ein Trojan downloader gefunden und noch andere schöne sachen die mein virenprogram zwar gelöscht haben soll aber man weiß ja nie!! gruß martin |
|
30.12.2010, 20:49
| #8 |
| /// Malware-holic | Backdoor.Win32.Spammy.lx problehm kannst du mal im kaspersky verlauf schauen was gefunden wurde? desweiteren: download malwarebytes: Malwarebytes instalieren, öffnen, registerkarte aktualisierung, programm updaten. schalte alle laufenden programme ab, trenne die internetverbindung. registerkarte scanner, komplett scan, funde entfernen, log posten.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
31.12.2010, 10:54
| #9 |
| | Backdoor.Win32.Spammy.lx problehm uff Malwarebytes hat tatsechlich noch mehr gefunden -.- !! Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Datenbank Version: 5426 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 31.12.2010 10:49:33 mbam-log-2010-12-31 (10-49-33).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Durchsuchte Objekte: 366035 Laufzeit: 52 Minute(n), 54 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 1 Infizierte Registrierungswerte: 1 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 1 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: HKEY_CURRENT_USER\SOFTWARE\Invictus (Trojan.FakeAlert) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: HKEY_CURRENT_USER\Software\Microsoft\bk (Malware.Trace) -> Value: bk -> Quarantined and deleted successfully. Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: c:\Users\madde\AppData\Roaming\logs.dat (Bifrose.Trace) -> Quarantined and deleted successfully. Werde dan jetzt auf entfernen drücken und noch mal scannen lassen und dan die logdatei auch noch posten! In Kaspersky log steht der Backdoor.Win32.Spammy.lx jetzt unter nicht gefunden!! Also müste der doch jetzt weg sein oder nicht?? Habe bei kaspersky mal im quarantäne geschaut da hat er auch 3 Viren drinne und zwar den Trojan.win32.Generic und das auch in 3 verschiedenden darteien!! aber so lange die da drinne sind kann doch nichts passieren oder sehe ich das falsch?? gruß martin Geändert von madde25 (31.12.2010 um 11:51 Uhr) |
|
31.12.2010, 12:51
| #10 |
| /// Malware-holic | Backdoor.Win32.Spammy.lx problehm machst du eigendlich onlinebanking /einkäufe?
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
31.12.2010, 12:58
| #11 |
| | Backdoor.Win32.Spammy.lx problehm ich mache onlinebanking und mein acc ist jetzt seit gestern abend gespert wollte gesternabend aufn konto und wurde nach 30 tans gefragt habe gleich bei der post bank angerufen!! Ich nähme mal an das es der Trojan.win32.Generic wahr oder?? hatte dan seit gestern abend auch ein problehm mit den internet seiten der der hat mir aufeinmal bei fast jeder seite ein fehler angezeigt wegen javer oder so und ein virus was in javer ordner gessesen hat ist schon gelöscht worden!! seit dehm gehts wieder ohne problehme!! bin am überlegen ob ich nicht mein pc plat mache!! Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Datenbank Version: 5426 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 31.12.2010 12:58:46 mbam-log-2010-12-31 (12-58-46).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Durchsuchte Objekte: 349203 Laufzeit: 1 Stunde(n), 57 Minute(n), 14 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) |
|
31.12.2010, 16:49
| #12 |
| | Backdoor.Win32.Spammy.lx problehm ist den alles wieder sauber bei mir oder muss ich noch was machen?? |
|
01.01.2011, 18:37
| #13 |
| | Backdoor.Win32.Spammy.lx problehm habe da noch eine frage ich habe mir mal die log von OLT angeschaut und da ist mir der name Process Hacker 2 aufgefallen aber ich habe kein plan was das sein soll und selber finden tuhe ich es auch irgendwie nett!! Kann mir jemand sagen was das ist?? |
|
02.01.2011, 11:51
| #14 |
| /// Malware-holic | Backdoor.Win32.Spammy.lx problehm ich hab auch nen privat leben... du musst deine daten sichern, und dann setzen wir den pc neu auf. der ist so verseucht, von dem kannst du kein onlinebanking machen, bis er neu aufgesetzt wurde. ich helfe dir ihn diesmal richtig abzusichern.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
02.01.2011, 12:08
| #15 |
| | Backdoor.Win32.Spammy.lx problehm ja sorry naklar hast du auch ein privat leben wollte ja nicht aufdringlich sein!! hmm ist also doch kommplet verseucht obwohl kein scaner mehr was findet?? naja wenn es halt sein muss ist es halt so!! kannst du mir den erleutern was die viren die ich auf mein pc hatte o. habe anstellen?? und wo ich die weg habe?? gruß martin ps: hoffentlich hattest du einen schönen rutsch ins neue jahr!! so die wichtigsten darten sind gesichert wahren nicht viele!! also können bei mir beide platten gelöscht werden!! Geändert von madde25 (02.01.2011 um 12:16 Uhr) |
|
| Themen zu Backdoor.Win32.Spammy.lx problehm |
| abend, andere, beseitigen, datei, freue, gefunde, gestern, guten, heute, hängt, inter, interne, internet, internet security, internet security 2010, kaspersky, program, schaf, security, svchost.exe, titel, viren, virus, würde |
Linear-Darstellung
