| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Trojaner Ursache für Probleme mit dem Drucker?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
| |
25.10.2011, 23:15
| #1 |
 |  Trojaner Ursache für Probleme mit dem Drucker? Hallo, nach dem Scannen unseres zweiten Rechners habe ich auch dort Trojaner gefunden. Das Problem beim Drucker ist, dass immer erst gedruckt wird, wenn der Auftrag abgeschickt und dann nochmal hochgefahren wurde. Erst dachte ich, dass mit Viren/Trojanern keine Verbindung besteht bis ich mehrere Programme laufen lassen habe. Hier die Logs. Mit SUPERAntiSpyware habe ich die gefundenen Infektionen gelöscht. Bei denen mit Eset noch nicht. Meine Frage ist dann nur, ob die Druckerproblematik etwas damit zu tun haben kann, da diese auch in Druckerdateien lagen (CTFPRINTER.DLL im SUPERAntiSpyware log) Vielen Dank schon im Voraus für Eure Unterstützung! OTL Code:
ATTFilter OTL logfile created on: 25.10.2011 21:42:39 - Run 1 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Dokumente und Einstellungen\Administrator\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,99 Gb Total Physical Memory | 1,23 Gb Available Physical Memory | 61,86% Memory free 3,84 Gb Paging File | 3,10 Gb Available in Paging File | 80,67% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 93,16 Gb Total Space | 63,86 Gb Free Space | 68,55% Space Free | Partition Type: NTFS Computer Name: NOTEBOOK | User Name: Administrator | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.10.25 21:37:25 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Administrator\Desktop\OTL.exe PRC - [2011.10.25 16:28:02 | 000,161,664 | ---- | M] (Oracle Corporation) -- C:\Programme\Java\jre7\bin\jqs.exe PRC - [2011.10.17 19:18:23 | 004,615,552 | ---- | M] (SUPERAntiSpyware.com) -- C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe PRC - [2011.09.28 18:55:33 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe PRC - [2011.09.10 06:28:50 | 002,338,656 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgtray.exe PRC - [2011.09.09 03:10:56 | 001,082,208 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgnsx.exe PRC - [2011.08.18 01:33:26 | 000,659,296 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgrsx.exe PRC - [2011.08.18 01:33:06 | 007,390,560 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe PRC - [2011.08.12 01:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) -- C:\Programme\SUPERAntiSpyware\SASCore.exe PRC - [2011.07.29 11:30:30 | 000,994,360 | ---- | M] (Secunia) -- C:\Programme\Secunia\PSI\psia.exe PRC - [2011.07.29 11:30:28 | 000,291,896 | ---- | M] (Secunia) -- C:\Programme\Secunia\PSI\psi_tray.exe PRC - [2011.05.23 14:13:04 | 000,657,248 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgchsvx.exe PRC - [2011.05.04 13:59:46 | 000,252,136 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe PRC - [2011.03.28 03:00:52 | 000,351,072 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgcsrvx.exe PRC - [2011.02.10 07:55:18 | 001,148,256 | ---- | M] () -- C:\Programme\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe PRC - [2011.02.08 05:33:42 | 000,269,520 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgwdsvc.exe PRC - [2009.11.08 11:11:18 | 000,126,976 | ---- | M] () -- C:\WINDOWS\system32\UAService7.exe PRC - [2009.09.01 18:00:12 | 000,075,048 | ---- | M] (cyberlink) -- C:\Programme\CyberLink\Shared Files\brs.exe PRC - [2009.07.06 15:22:04 | 000,087,336 | ---- | M] (CyberLink Corp.) -- C:\Programme\CyberLink\PowerDVD9\PDVD9Serv.exe PRC - [2008.08.14 17:15:46 | 002,407,184 | ---- | M] () -- C:\Programme\Logitech\QuickCam\Quickcam.exe PRC - [2008.08.14 17:11:48 | 000,565,008 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\logishrd\LComMgr\Communications_Helper.exe PRC - [2008.08.14 17:11:14 | 000,447,248 | ---- | M] (Logitech Inc.) -- C:\Programme\Gemeinsame Dateien\logishrd\LQCVFX\COCIManager.exe PRC - [2008.07.26 08:25:36 | 000,150,040 | ---- | M] (Logitech Inc.) -- C:\Programme\Gemeinsame Dateien\logishrd\LVMVFM\LVPrcSrv.exe PRC - [2008.07.26 08:23:42 | 000,186,904 | ---- | M] (Logitech Inc.) -- C:\Programme\Gemeinsame Dateien\logishrd\LVCOMSER\LVComSer.exe PRC - [2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2008.01.25 14:32:56 | 000,689,416 | ---- | M] (Logitech, Inc.) -- c:\Programme\Logitech\QuickCam\LU\LogitechUpdate.exe PRC - [2008.01.25 14:32:48 | 000,191,240 | ---- | M] (Logitech, Inc.) -- c:\Programme\Logitech\QuickCam\LU\LULnchr.exe PRC - [2007.02.07 01:30:00 | 000,065,536 | R--- | M] (Cognizance Corporation) -- C:\Programme\Hewlett-Packard\IAM\Bin\asghost.exe ========== Modules (No Company Name) ========== MOD - [2011.10.25 21:32:30 | 000,063,488 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll MOD - [2011.10.25 21:32:30 | 000,052,736 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10007.dll MOD - [2011.10.25 17:00:26 | 000,117,760 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL MOD - [2011.10.25 17:00:25 | 000,052,224 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll MOD - [2011.09.28 18:55:33 | 001,015,256 | ---- | M] () -- C:\Programme\Mozilla Firefox\js3250.dll MOD - [2011.09.05 19:04:58 | 000,301,056 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU MOD - [2011.02.10 07:55:18 | 001,148,256 | ---- | M] () -- C:\Programme\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe MOD - [2009.11.08 11:11:18 | 000,126,976 | ---- | M] () -- C:\WINDOWS\system32\UAService7.exe MOD - [2009.11.08 11:11:18 | 000,090,112 | ---- | M] () -- C:\WINDOWS\system32\CmdLineExt.dll MOD - [2008.08.14 17:23:22 | 000,118,032 | ---- | M] () -- C:\Programme\Logitech\QuickCam\LAppRes.DLL MOD - [2008.08.14 17:15:46 | 002,407,184 | ---- | M] () -- C:\Programme\Logitech\QuickCam\Quickcam.exe MOD - [2008.08.14 17:13:30 | 000,149,264 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\logishrd\LComMgr\LogiVOIPDevicePlugin.dll MOD - [2008.08.14 17:13:08 | 000,165,136 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\logishrd\LComMgr\LogiCordless4001.dll MOD - [2008.08.14 17:13:08 | 000,138,000 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\logishrd\LComMgr\LogiCordless.dll MOD - [2008.08.14 17:12:10 | 000,167,184 | ---- | M] () -- C:\Programme\Logitech\QuickCam\EFVal.dll MOD - [2008.08.14 17:11:48 | 000,565,008 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\logishrd\LComMgr\Communications_Helper.exe MOD - [2008.08.14 17:11:48 | 000,345,872 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\logishrd\LComMgr\DevMngr.dll MOD - [2008.07.26 08:24:04 | 000,068,120 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\logishrd\LVCOMSER\LVCSPS.dll MOD - [2001.10.28 17:42:30 | 000,116,224 | ---- | M] () -- C:\WINDOWS\system32\pdfcmnnt.dll ========== Win32 Services (SafeList) ========== SRV - File not found [Auto | Stopped] -- -- (Nero BackItUp Scheduler 4.0) SRV - File not found [Disabled | Stopped] -- -- (HidServ) SRV - [2011.10.25 16:28:02 | 000,161,664 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Programme\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService) SRV - [2011.09.01 09:17:00 | 001,025,352 | ---- | M] () [On_Demand | Stopped] -- C:\Programme\AVG\AVG10\Toolbar\ToolbarBroker.exe -- (AVG Security Toolbar Service) SRV - [2011.08.18 01:33:06 | 007,390,560 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Programme\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe -- (AVGIDSAgent) SRV - [2011.08.12 01:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Programme\SUPERAntiSpyware\SASCORE.EXE -- (!SASCORE) SRV - [2011.07.29 11:30:30 | 000,994,360 | ---- | M] (Secunia) [Auto | Running] -- C:\Programme\Secunia\PSI\PSIA.exe -- (Secunia PSI Agent) SRV - [2011.02.08 05:33:42 | 000,269,520 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Programme\AVG\AVG10\avgwdsvc.exe -- (avgwd) SRV - [2009.11.08 11:11:18 | 000,126,976 | ---- | M] () [Auto | Running] -- C:\WINDOWS\system32\UAService7.exe -- (UserAccess7) SecuROM User Access Service (V7) SRV - [2008.07.26 08:25:36 | 000,150,040 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv) SRV - [2008.07.26 08:23:42 | 000,186,904 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe -- (LVCOMSer) SRV - [2007.02.07 01:30:00 | 000,074,240 | R--- | M] (Cognizance Corporation) [Auto | Running] -- C:\Programme\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll -- (ASBroker) SRV - [2006.06.22 05:14:00 | 000,131,584 | R--- | M] (Cognizance Corporation) [Auto | Running] -- C:\Programme\Hewlett-Packard\IAM\Bin\ASChnl.dll -- (ASChannel) SRV - [2003.07.28 12:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose) ========== Driver Services (SafeList) ========== DRV - [2011.07.22 18:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV) DRV - [2011.07.12 23:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL) DRV - [2011.05.27 19:05:44 | 000,134,480 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AVGIDSDriver.sys -- (AVGIDSDriver) DRV - [2011.04.05 00:59:56 | 000,297,168 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgtdix.sys -- (Avgtdix) DRV - [2011.03.16 16:03:20 | 000,032,592 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\avgrkx86.sys -- (Avgrkx86) DRV - [2011.03.01 14:25:18 | 000,034,896 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\avgmfx86.sys -- (Avgmfx86) DRV - [2011.02.22 08:13:02 | 000,022,992 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys -- (AVGIDSEH) DRV - [2011.02.10 07:53:54 | 000,027,216 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AVGIDSShim.sys -- (AVGIDSShim) DRV - [2011.02.10 07:53:52 | 000,024,144 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AVGIDSFilter.sys -- (AVGIDSFilter) DRV - [2011.01.07 06:41:46 | 000,248,656 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgldx86.sys -- (Avgldx86) DRV - [2010.09.01 10:30:58 | 000,015,544 | ---- | M] (Secunia) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\psi_mf.sys -- (PSI) DRV - [2009.09.01 17:59:44 | 000,087,536 | ---- | M] (CyberLink Corp.) [2009/11/21 15:06:25] [Kernel | Auto | Running] -- C:\Programme\CyberLink\PowerDVD9\000.fcl -- ({B154377D-700F-42cc-9474-23858FBDF4BD}) DRV - [2009.05.14 17:18:40 | 001,123,328 | ---- | M] (Broadcom Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX) DRV - [2008.07.26 17:26:22 | 000,041,752 | R--- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LVUSBSta.sys -- (LVUSBSta) DRV - [2008.07.26 17:22:34 | 002,570,520 | R--- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LV302V32.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI) DRV - [2008.07.26 08:25:02 | 000,025,624 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys -- (LVPr2Mon) DRV - [2007.10.31 10:23:20 | 002,236,544 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NETw4x32.sys -- (NETw4x32) Intel(R) DRV - [2007.08.28 15:47:36 | 000,146,560 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\atswpdrv.sys -- (ATSWPDRV) AuthenTec TruePrint USB Driver (SwipeSensor) DRV - [2007.06.18 16:12:04 | 000,016,768 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr) DRV - [2007.01.24 14:44:06 | 000,290,304 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tifm21.sys -- (tifm21) DRV - [2006.09.14 16:55:00 | 000,088,192 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gtipci21.sys -- (GTIPCI21) DRV - [2006.06.28 09:54:00 | 000,009,472 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CPQBttn.sys -- (HBtnKey) DRV - [2006.02.15 15:59:52 | 000,401,664 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio) DRV - [2006.02.15 15:56:58 | 001,342,570 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL) DRV - [2006.02.15 15:54:46 | 000,030,363 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver) DRV - [2006.02.15 15:54:40 | 000,030,189 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwmodem.sys -- (btwmodem) DRV - [2006.02.15 15:54:10 | 000,057,096 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB) DRV - [2006.02.15 15:51:22 | 000,148,168 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwdndis.sys -- (BTWDNDIS) DRV - [2005.12.12 15:00:46 | 001,120,352 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem) DRV - [2005.10.26 10:01:02 | 000,142,720 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k) Broadcom NetLink (TM) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Programme\AVG\AVG10\Toolbar\IEToolbar.dll () IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search" FF - prefs.js..browser.search.defaultthis.engineName: "Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.selectedEngine: "AVG Secure Search" FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/firefox?client=firefox-a&rls=org.mozilla:de:official" FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2 FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.6.0.8153 FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1410 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA}:7.0.01 FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&q=" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Programme\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Programme\AVG\AVG10\Firefox4\ [2011.09.15 20:55:22 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Programme\AVG\AVG10\Toolbar\Firefox\avg@igeared [2011.09.16 19:35:29 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.23\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.09.28 18:55:36 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.23\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.10.25 16:31:47 | 000,000,000 | ---D | M] [2009.07.15 18:49:27 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Extensions [2011.10.24 15:52:00 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ciqks4e4.default\extensions [2010.10.29 19:13:55 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ciqks4e4.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011.06.17 17:21:08 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ciqks4e4.default\extensions\engine@conduit.com [2010.05.10 09:58:47 | 000,000,873 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ciqks4e4.default\searchplugins\conduit.xml [2011.10.25 17:09:52 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2011.08.23 20:06:05 | 000,000,000 | ---D | M] (Click to call with Skype) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2010.12.08 22:17:57 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2011.10.25 16:28:19 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} [2011.09.15 20:55:22 | 000,000,000 | ---D | M] (AVG Safe Search) -- C:\PROGRAMME\AVG\AVG10\FIREFOX4 [2011.10.25 16:28:02 | 000,611,224 | ---- | M] (Oracle Corporation) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll [2010.09.14 23:32:39 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml [2010.09.14 23:32:39 | 000,002,344 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml [2010.09.14 23:32:39 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml [2010.09.14 23:32:39 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml [2010.09.14 23:32:39 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2011.10.25 16:18:20 | 000,612,608 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost #[IPv6] O1 - Hosts: 127.0.0.1 fr.a2dfp.net O1 - Hosts: 127.0.0.1 m.fr.a2dfp.net O1 - Hosts: 127.0.0.1 ad.a8.net O1 - Hosts: 127.0.0.1 asy.a8ww.net O1 - Hosts: 127.0.0.1 abcstats.com O1 - Hosts: 127.0.0.1 a.abv.bg O1 - Hosts: 127.0.0.1 adserver.abv.bg O1 - Hosts: 127.0.0.1 adv.abv.bg O1 - Hosts: 127.0.0.1 bimg.abv.bg O1 - Hosts: 127.0.0.1 ca.abv.bg O1 - Hosts: 127.0.0.1 www2.a-counter.kiev.ua O1 - Hosts: 127.0.0.1 track.acclaimnetwork.com O1 - Hosts: 127.0.0.1 accuserveadsystem.com O1 - Hosts: 127.0.0.1 www.accuserveadsystem.com O1 - Hosts: 127.0.0.1 achmedia.com O1 - Hosts: 127.0.0.1 aconti.net O1 - Hosts: 127.0.0.1 secure.aconti.net O1 - Hosts: 127.0.0.1 www.aconti.net #[Dialer.Aconti] O1 - Hosts: 127.0.0.1 am1.activemeter.com O1 - Hosts: 127.0.0.1 www.activemeter.com #[Tracking.Cookie] O1 - Hosts: 127.0.0.1 ads.activepower.net O1 - Hosts: 127.0.0.1 stat.active24stats.nl #[Tracking.Cookie] O1 - Hosts: 127.0.0.1 ad2games.com O1 - Hosts: 16291 more lines... O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programme\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.) O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Programme\AVG\AVG10\Toolbar\IEToolbar.dll () O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (Credential Manager for HP ProtectTools) - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Programme\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll (Bioscrypt Inc.) O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Programme\AVG\AVG10\Toolbar\IEToolbar.dll () O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Programme\AVG\AVG10\Toolbar\IEToolbar.dll () O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [AVG_TRAY] C:\Programme\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [BDRegion] C:\Programme\CyberLink\Shared Files\brs.exe (cyberlink) O4 - HKLM..\Run: [CognizanceTS] C:\Programme\Hewlett-Packard\IAM\Bin\ASTSVCC.dll (Cognizance Corporation) O4 - HKLM..\Run: [LogitechCommunicationsManager] C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe () O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Programme\Logitech\QuickCam\Quickcam.exe () O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh) O4 - HKLM..\Run: [PDVD9LanguageShortcut] C:\Programme\CyberLink\PowerDVD9\Language\Language.exe (CyberLink Corp.) O4 - HKLM..\Run: [PTHOSTTR] C:\Programme\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE (Hewlett-Packard Development Company, L.P.) O4 - HKLM..\Run: [RemoteControl9] C:\Programme\CyberLink\PowerDVD9\PDVD9Serv.exe (CyberLink Corp.) O4 - HKLM..\Run: [SSBkgdUpdate] C:\Programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Scansoft, Inc.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKCU..\Run: [NBJ] C:\Programme\Ahead\Nero BackItUp\NBJ.exe (Ahead Software AG) O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Secunia PSI Tray.lnk = C:\Programme\Secunia\PSI\psi_tray.exe (Secunia) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTaskGrouping = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTaskGrouping = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 1 O8 - Extra context menu item: Free YouTube Download - C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubedownload.htm () O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubetomp3.htm () O8 - Extra context menu item: Senden an &Bluetooth - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm () O9 - Extra Button: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 1.7.0_01) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Java Plug-in 1.7.0_01) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.7.0_01) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.100.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9AF3CD9C-53E1-477D-8DAA-3563C5BC9E31}: DhcpNameServer = 192.168.100.1 O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Programme\AVG\AVG10\Toolbar\IEToolbar.dll () O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programme\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (APSHook.dll) -C:\WINDOWS\System32\APSHook.dll (Bioscrypt Inc.) O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Programme\SUPERAntiSpyware\SASWINLO.DLL) - C:\Programme\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com) O20 - Winlogon\Notify\OneCard: DllName - (C:\Programme\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll) - C:\Programme\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll (Cognizance Corporation) O24 - Desktop Components:0 () - file:///C:/DOKUME~1/ADMINI~1/LOKALE~1/Temp/msohtml1/01/clip_image002.jpg O24 - Desktop Components:1 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Programme\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.05.14 16:12:19 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{2fef371e-cd76-11e0-b277-00164187111b}\Shell - "" = AutoRun O33 - MountPoints2\{2fef371e-cd76-11e0-b277-00164187111b}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{2fef371e-cd76-11e0-b277-00164187111b}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{2fef3721-cd76-11e0-b277-00164187111b}\Shell - "" = AutoRun O33 - MountPoints2\{2fef3721-cd76-11e0-b277-00164187111b}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{2fef3721-cd76-11e0-b277-00164187111b}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{437fd7fa-d1bb-11e0-b283-00164187111b}\Shell - "" = AutoRun O33 - MountPoints2\{437fd7fa-d1bb-11e0-b283-00164187111b}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{437fd7fa-d1bb-11e0-b283-00164187111b}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{c84c571f-710b-11de-ac77-001a731a6b65}\Shell\AutoRun\command - "" = E:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\recycle.exe O33 - MountPoints2\{c84c571f-710b-11de-ac77-001a731a6b65}\Shell\open\command - "" = E:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\recycle.exe O34 - HKLM BootExecute: (autocheck autochk *) O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4 ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789) ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Macromedia Shockwave Flash ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE NetSvcs: 6to4 - File not found NetSvcs: HidServ - File not found NetSvcs: Ias - File not found NetSvcs: Iprip - File not found NetSvcs: Irmon - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: WmdmPmSp - File not found MsConfig - State: "system.ini" - 0 MsConfig - State: "win.ini" - 0 MsConfig - State: "bootini" - 0 MsConfig - State: "services" - 0 MsConfig - State: "startup" - 0 CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2011.10.25 21:37:16 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Administrator\Desktop\OTL.exe [2011.10.25 21:31:27 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\CyberLink PowerDVD 9 [2011.10.25 21:29:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Desktop\69886-alle-hilfesuchenden-eroeffnung-themas-beachten-Dateien [2011.10.25 18:52:06 | 000,000,000 | ---D | C] -- C:\Programme\ESET [2011.10.25 18:48:14 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Sun [2011.10.25 17:00:13 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\SUPERAntiSpyware.com [2011.10.25 16:59:32 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com [2011.10.25 16:59:32 | 000,000,000 | ---D | C] -- C:\Programme\SUPERAntiSpyware [2011.10.25 16:58:08 | 000,000,000 | --SD | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\OpenOffice.org 3.3 [2011.10.25 16:55:46 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2011.10.25 16:44:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\VideoLAN [2011.10.25 16:32:57 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Secunia PSI [2011.10.25 16:32:15 | 000,000,000 | ---D | C] -- C:\Programme\Secunia [2011.10.25 16:30:39 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Apple Computer [2011.10.25 16:28:45 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Apple Computer [2011.10.25 16:28:37 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Java [2011.10.25 16:27:08 | 000,000,000 | ---D | C] -- C:\Programme\Java [2011.10.24 19:24:05 | 000,000,000 | -H-D | C] -- C:\WINDOWS\System32\GroupPolicy [2011.10.22 11:21:25 | 000,000,000 | ---D | C] -- C:\ConversionOutput [2011.10.22 11:07:09 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Contenta Converter PREMIUM [2011.10.22 11:06:45 | 000,000,000 | ---D | C] -- C:\Programme\ContentaConverter-PREMIUM [2011.10.18 21:39:39 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Malwarebytes [2011.10.18 21:39:32 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware [2011.10.18 21:39:32 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes [2011.10.18 21:39:29 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2011.10.18 21:39:29 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2011.10.09 19:15:37 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Ahead [4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.10.25 21:37:43 | 000,302,592 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\f02oernt.exe [2011.10.25 21:37:25 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Administrator\Desktop\OTL.exe [2011.10.25 21:31:33 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat [2011.10.25 21:31:24 | 000,001,100 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2011.10.25 21:31:23 | 000,000,274 | ---- | M] () -- C:\WINDOWS\tasks\WGASetup.job [2011.10.25 21:31:21 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2011.10.25 21:29:32 | 000,059,445 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\69886-alle-hilfesuchenden-eroeffnung-themas-beachten.html [2011.10.25 21:28:16 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\defogger_reenable [2011.10.25 20:06:01 | 000,001,104 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2011.10.25 18:42:41 | 000,222,432 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2011.10.25 16:44:04 | 000,000,691 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\VLC media player.lnk [2011.10.25 16:32:21 | 000,000,725 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Secunia PSI Tray.lnk [2011.10.25 16:29:01 | 000,001,763 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\QTSBandwidthCache [2011.10.25 16:28:34 | 000,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn [2011.10.25 16:22:32 | 000,449,418 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat [2011.10.25 16:22:32 | 000,433,138 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2011.10.25 16:22:32 | 000,080,936 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat [2011.10.25 16:22:32 | 000,068,094 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2011.10.25 15:34:56 | 135,548,065 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm [2011.10.24 19:35:54 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2011.10.24 19:25:29 | 000,000,488 | RHS- | M] () -- C:\Dokumente und Einstellungen\All Users\ntuser.pol [2011.10.24 17:43:18 | 000,002,519 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\Mobipocket Reader.lnk [2011.10.24 15:26:06 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2011.10.22 11:00:40 | 000,024,064 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.10.21 18:25:33 | 000,064,877 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\iavichjg.avm [2011.10.13 21:20:43 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2011.09.26 20:13:37 | 000,077,910 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\02_Address_by_President_Bush.pdf [2011.09.26 20:06:23 | 000,059,711 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\Severn_Suzuki_speaks_in_Rio.pdf [4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.10.25 21:37:39 | 000,302,592 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\f02oernt.exe [2011.10.25 21:29:24 | 000,059,445 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\69886-alle-hilfesuchenden-eroeffnung-themas-beachten.html [2011.10.25 21:28:16 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\defogger_reenable [2011.10.25 16:44:04 | 000,000,691 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\VLC media player.lnk [2011.10.25 16:32:21 | 000,000,725 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Secunia PSI Tray.lnk [2011.10.25 16:32:21 | 000,000,688 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Secunia PSI.lnk [2011.10.25 16:29:01 | 000,001,763 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\QTSBandwidthCache [2011.10.24 19:25:29 | 000,000,488 | RHS- | C] () -- C:\Dokumente und Einstellungen\All Users\ntuser.pol [2011.10.24 16:00:58 | 000,001,804 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Adobe Reader X.lnk [2011.10.20 19:16:59 | 002,192,218 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\EXERCISE.PDF [2011.09.26 20:13:37 | 000,077,910 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\02_Address_by_President_Bush.pdf [2011.09.26 20:06:23 | 000,059,711 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Desktop\Severn_Suzuki_speaks_in_Rio.pdf [2011.08.24 21:54:43 | 000,000,000 | ---- | C] () -- C:\WINDOWS\pcfriend.INI [2011.02.15 22:27:40 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat [2010.06.11 14:58:26 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2010.05.05 07:17:08 | 000,040,960 | ---- | C] () -- C:\Programme\Uninstall_CDS.exe [2010.01.09 17:05:42 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD-Start.INI [2009.12.15 15:57:49 | 000,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI [2009.11.08 11:11:18 | 000,126,976 | ---- | C] () -- C:\WINDOWS\System32\UAService7.exe [2009.11.08 11:11:18 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt.dll [2009.11.01 13:17:29 | 000,000,035 | ---- | C] () -- C:\WINDOWS\A5W.INI [2009.08.30 18:13:13 | 000,066,482 | R--- | C] () -- C:\WINDOWS\System32\lvcoinst.ini [2009.08.26 18:41:37 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat [2009.08.25 16:51:43 | 000,110,592 | ---- | C] () -- C:\WINDOWS\t_Uninst.exe [2009.08.08 14:34:33 | 000,000,468 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI [2009.08.08 14:34:33 | 000,000,027 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI [2009.08.08 14:34:32 | 000,000,030 | ---- | C] () -- C:\WINDOWS\System32\brss01a.ini [2009.08.08 14:33:01 | 000,000,205 | ---- | C] () -- C:\WINDOWS\Brpfx04a.ini [2009.08.08 14:33:01 | 000,000,092 | ---- | C] () -- C:\WINDOWS\brpcfx.ini [2009.08.08 14:33:01 | 000,000,050 | ---- | C] () -- C:\WINDOWS\System32\bridf05a.dat [2009.08.08 14:31:09 | 000,027,114 | ---- | C] () -- C:\WINDOWS\maxlink.ini [2009.07.23 09:53:38 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll [2009.07.21 12:06:27 | 000,024,064 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.07.15 18:49:21 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2009.07.15 18:20:52 | 000,000,502 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2009.05.14 17:31:10 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4926.dll [2009.05.14 17:03:13 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2009.05.14 17:01:50 | 000,222,432 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2009.05.14 16:14:46 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2009.05.14 16:08:50 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2008.07.26 08:25:02 | 000,025,624 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys [2006.02.15 16:04:52 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\btprn2k.dll [2004.08.31 11:32:48 | 000,327,680 | ---- | C] () -- C:\WINDOWS\System32\QFClient2.dll [2004.08.04 01:12:38 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin [2004.08.02 14:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2003.02.20 17:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI [2002.03.04 10:16:34 | 000,110,592 | R--- | C] () -- C:\WINDOWS\System32\Jpeg32.dll [2001.11.14 12:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll [2001.09.01 00:15:44 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin [2001.09.01 00:15:44 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat [2001.08.18 21:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat [2001.08.18 21:00:00 | 000,449,418 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat [2001.08.18 21:00:00 | 000,433,138 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat [2001.08.18 21:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat [2001.08.18 21:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat [2001.08.18 21:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat [2001.08.18 21:00:00 | 000,080,936 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat [2001.08.18 21:00:00 | 000,068,094 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat [2001.08.18 21:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin [2001.08.18 21:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat [2001.08.18 21:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat [2001.08.18 21:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat [1998.05.07 02:10:00 | 000,069,632 | R--- | C] () -- C:\WINDOWS\System32\ODMA32.dll ========== LOP Check ========== [2009.12.14 18:31:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Amazon [2011.08.27 10:32:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\AVG10 [2011.10.25 16:38:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Canon [2009.08.25 16:59:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Cornelsen [2010.05.31 23:11:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\DVDVideoSoftIEHelpers [2009.11.08 11:11:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ldoce4 [2009.08.30 19:24:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Leadertech [2010.01.09 17:09:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mobipocket [2009.05.15 12:41:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\OpenOffice.org [2009.08.24 20:34:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\ScanSoft [2011.08.23 12:55:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Telefónica [2010.06.13 15:22:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Uniblue [2011.08.31 14:08:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AVG Security Toolbar [2011.08.27 10:30:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AVG10 [2010.02.12 16:56:34 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJEGV [2011.10.25 16:37:30 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJScan [2011.08.27 10:30:29 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Common Files [2011.08.27 10:32:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MFAData [2009.08.08 14:30:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ScanSoft [2009.07.15 19:03:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP [2011.10.25 21:31:23 | 000,000,274 | ---- | M] () -- C:\WINDOWS\Tasks\WGASetup.job ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2011.08.27 10:56:16 | 000,000,000 | -H-D | M] -- C:\$AVG [2009.05.14 18:13:07 | 000,000,000 | ---D | M] -- C:\61b68f90d8f24aeb1286 [2010.01.06 12:34:35 | 000,000,000 | ---D | M] -- C:\Beihilfe [2011.10.25 18:42:37 | 000,000,000 | -HSD | M] -- C:\Config.Msi [2011.10.22 12:16:30 | 000,000,000 | ---D | M] -- C:\ConversionOutput [2010.09.01 22:13:55 | 000,000,000 | ---D | M] -- C:\DateienSchule [2010.09.02 12:16:49 | 000,000,000 | ---D | M] -- C:\DateienSeminar [2009.05.14 18:31:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen [2011.07.20 21:17:31 | 000,000,000 | ---D | M] -- C:\EN_106297 [2009.12.14 23:32:38 | 000,000,000 | ---D | M] -- C:\Fotos [2009.05.14 17:31:00 | 000,000,000 | ---D | M] -- C:\Intel [2011.05.24 18:50:47 | 000,000,000 | ---D | M] -- C:\Klett [2009.07.15 18:13:48 | 000,000,000 | RH-D | M] -- C:\MSOCache [2011.08.27 10:27:06 | 000,000,000 | ---D | M] -- C:\Program Files [2011.10.25 18:52:06 | 000,000,000 | R--D | M] -- C:\Programme [2009.05.15 12:52:10 | 000,000,000 | -HSD | M] -- C:\RECYCLER [2009.07.15 08:54:37 | 000,000,000 | ---D | M] -- C:\SWSetup [2009.05.14 16:15:44 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2011.03.28 20:45:07 | 000,000,000 | ---D | M] -- C:\temp [2011.10.25 18:44:18 | 000,000,000 | ---D | M] -- C:\WINDOWS < %PROGRAMFILES%\*.exe > [2004.03.11 13:27:22 | 000,040,960 | ---- | M] () -- C:\Programme\Uninstall_CDS.exe Invalid Environment Variable: LOCALAPPDATA < %systemroot%\*. /mp /s > < %systemroot%\system32\*.manifest /3 > [1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ] < MD5 for: EXPLORER.EXE > [2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\explorer.exe [2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe < MD5 for: REGEDIT.EXE > [2004.08.04 00:58:10 | 000,153,600 | ---- | M] (Microsoft Corporation) MD5=8193CE5FB09E83F2699FD65BBCBE2FD2 -- C:\WINDOWS\I386\REGEDIT.EXE [2008.04.14 07:53:00 | 000,153,600 | ---- | M] (Microsoft Corporation) MD5=AD9226BF3CED13636083BB9C76E9D2A2 -- C:\WINDOWS\regedit.exe [2008.04.14 07:53:00 | 000,153,600 | ---- | M] (Microsoft Corporation) MD5=AD9226BF3CED13636083BB9C76E9D2A2 -- C:\WINDOWS\ServicePackFiles\i386\regedit.exe < MD5 for: USERINIT.EXE > [2008.04.14 07:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe [2008.04.14 07:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe < MD5 for: WINLOGON.EXE > [2008.04.14 07:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe [2008.04.14 07:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-10-13 19:28:48 < > ========== Alternate Data Streams ========== @Alternate Data Stream - 123 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:C980DA7D < End of report > Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=722c9ee07fffc24bb6956f98fb54d32a
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-10-25 06:45:25
# local_time=2011-10-25 08:45:25 (+0100, Westeuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=1032 16777173 100 96 763 62736630 0 0
# compatibility_mode=8192 67108863 100 0 160 160 0 0
# scanned=78448
# found=6
# cleaned=0
# scan_time=6639
C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\10\2bd7158a-2609014e Java/TrojanDownloader.OpenStream.NCN trojan (unable to clean) 00000000000000000000000000000000 I
C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Downloads\Nero-9.4.12.3_free.exe Win32/Toolbar.AskSBar application (unable to clean) 00000000000000000000000000000000 I
C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Downloads\registrybooster.exe a variant of Win32/RegistryBooster application (unable to clean) 00000000000000000000000000000000 I
C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Downloads\SoftonicDownloader66221.exe a variant of Win32/SoftonicDownloader.A application (unable to clean) 00000000000000000000000000000000 I
C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\jar_cache1476677931927937826.tmp a variant of Java/TrojanDownloader.OpenStream.NCM trojan (unable to clean) 00000000000000000000000000000000 I
C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\NERO1004997\unit_app_75\Toolbar.exe Win32/Toolbar.AskSBar application (unable to clean) 00000000000000000000000000000000 I
AVG Details Code:
ATTFilter "Objektname";"C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temp\plugtmp-10\plugin-2fdp.php"
"Erkennungsname";"Virus identifiziert: Exploit.PDF"
"Objekttyp";"Datei"
"SDK-Typ";"Kern"
"Ergebnis";"In Virenquarantäne verschoben"
"Aktionsverlauf";"In Virenquarantäne verschoben"
"Objektname";"C:\Programme\softonic-de3\tbsof0.dll"
"Erkennungsname";"Beschädigte ausführbare Datei"
"Objekttyp";"Datei"
"SDK-Typ";"Kern"
"Ergebnis";"In Virenquarantäne verschoben"
"Aktionsverlauf";"In Virenquarantäne verschoben"
"Objektname";"C:\Programme\DVDVideoSoftTB\tbDVD0.dll"
"Erkennungsname";"Beschädigte ausführbare Datei"
"Objekttyp";"Datei"
"SDK-Typ";"Kern"
"Ergebnis";"In Virenquarantäne verschoben"
"Aktionsverlauf";"In Virenquarantäne verschoben"
"Objektname";"C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temporary Internet Files\Content.IE5\YXWH4TY9\tbedrs[2].dll"
"Erkennungsname";"Beschädigte ausführbare Datei"
"Objekttyp";"Datei"
"SDK-Typ";"Kern"
"Ergebnis";"In Virenquarantäne verschoben"
"Aktionsverlauf";"In Virenquarantäne verschoben"
"Objektname";"C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temporary Internet Files\Content.IE5\YXWH4TY9\tbedrs[1].dll"
"Erkennungsname";"Beschädigte ausführbare Datei"
"Objekttyp";"Datei"
"SDK-Typ";"Kern"
"Ergebnis";"In Virenquarantäne verschoben"
"Aktionsverlauf";"In Virenquarantäne verschoben"
Code:
ATTFilter Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org
Datenbank Version: 7975
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13
18.10.2011 22:45:44
mbam-log-2011-10-18 (22-45-44).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|G:\|)
Durchsuchte Objekte: 247948
Laufzeit: 58 Minute(n), 29 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org
Datenbank Version: 7975
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13
18.10.2011 21:46:27
mbam-log-2011-10-18 (21-46-27).txt
Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 166057
Laufzeit: 5 Minute(n), 59 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
|
|
26.10.2011, 13:13
| #2 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Trojaner Ursache für Probleme mit dem Drucker?Zitat:
__________________ |
|
26.10.2011, 15:08
| #3 |
| | Trojaner Ursache für Probleme mit dem Drucker? MBAM log
__________________Code:
ATTFilter Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org
Datenbank Version: 8022
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13
26.10.2011 16:04:02
mbam-log-2011-10-26 (16-04-02).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|G:\|)
Durchsuchte Objekte: 252811
Laufzeit: 56 Minute(n), 29 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
|
|
26.10.2011, 18:58
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Trojaner Ursache für Probleme mit dem Drucker? Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!) Code:
ATTFilter :OTL
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Programme\AVG\AVG10\Toolbar\IEToolbar.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - prefs.js..browser.search.defaultthis.engineName: "Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.startup.homepage: "http://www.google.de/firefox?client=firefox-a&rls=org.mozilla:de:official"
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2
FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&q="
[2011.06.17 17:21:08 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ciqks4e4.default\extensions\engine@conduit.com
[2010.05.10 09:58:47 | 000,000,873 | ---- | M] () -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ciqks4e4.default\searchplugins\conduit.xml
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.05.14 16:12:19 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{2fef371e-cd76-11e0-b277-00164187111b}\Shell - "" = AutoRun
O33 - MountPoints2\{2fef371e-cd76-11e0-b277-00164187111b}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{2fef371e-cd76-11e0-b277-00164187111b}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{2fef3721-cd76-11e0-b277-00164187111b}\Shell - "" = AutoRun
O33 - MountPoints2\{2fef3721-cd76-11e0-b277-00164187111b}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{2fef3721-cd76-11e0-b277-00164187111b}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{437fd7fa-d1bb-11e0-b283-00164187111b}\Shell - "" = AutoRun
O33 - MountPoints2\{437fd7fa-d1bb-11e0-b283-00164187111b}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{437fd7fa-d1bb-11e0-b283-00164187111b}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{c84c571f-710b-11de-ac77-001a731a6b65}\Shell\AutoRun\command - "" = E:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\recycle.exe
O33 - MountPoints2\{c84c571f-710b-11de-ac77-001a731a6b65}\Shell\open\command - "" = E:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\recycle.exe
@Alternate Data Stream - 123 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:C980DA7D
:Files
C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\10
C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Downloads\registrybooster.exe
C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Downloads\SoftonicDownloader66221.exe
:Commands
[emptytemp]
[resethosts]
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet. Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt. Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
26.10.2011, 19:30
| #5 |
| | Trojaner Ursache für Probleme mit dem Drucker?Code:
ATTFilter All processes killed
========== OTL ==========
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Local Page| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{A3BC75A2-1F87-4686-AA43-5347D756017C} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A3BC75A2-1F87-4686-AA43-5347D756017C}\ deleted successfully.
C:\Programme\AVG\AVG10\Toolbar\IEToolbar.dll moved successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
Prefs.js: "Search" removed from browser.search.defaultthis.engineName
Prefs.js: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl
Prefs.js: "hxxp://www.google.de/firefox?client=firefox-a&rls=org.mozilla:de:official" removed from browser.startup.homepage
Prefs.js: engine@conduit.com:3.3.3.2 removed from extensions.enabledItems
Prefs.js: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&q=" removed from keyword.URL
C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ciqks4e4.default\extensions\engine@conduit.com\searchplugin folder moved successfully.
C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ciqks4e4.default\extensions\engine@conduit.com\META-INF folder moved successfully.
C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ciqks4e4.default\extensions\engine@conduit.com\lib folder moved successfully.
C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ciqks4e4.default\extensions\engine@conduit.com\DualPackage folder moved successfully.
C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ciqks4e4.default\extensions\engine@conduit.com\defaults folder moved successfully.
C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ciqks4e4.default\extensions\engine@conduit.com\components folder moved successfully.
C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ciqks4e4.default\extensions\engine@conduit.com\chrome folder moved successfully.
C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ciqks4e4.default\extensions\engine@conduit.com folder moved successfully.
C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ciqks4e4.default\searchplugins\conduit.xml moved successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\AUTOEXEC.BAT moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2fef371e-cd76-11e0-b277-00164187111b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2fef371e-cd76-11e0-b277-00164187111b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2fef371e-cd76-11e0-b277-00164187111b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2fef371e-cd76-11e0-b277-00164187111b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2fef371e-cd76-11e0-b277-00164187111b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2fef371e-cd76-11e0-b277-00164187111b}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2fef3721-cd76-11e0-b277-00164187111b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2fef3721-cd76-11e0-b277-00164187111b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2fef3721-cd76-11e0-b277-00164187111b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2fef3721-cd76-11e0-b277-00164187111b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2fef3721-cd76-11e0-b277-00164187111b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2fef3721-cd76-11e0-b277-00164187111b}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{437fd7fa-d1bb-11e0-b283-00164187111b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{437fd7fa-d1bb-11e0-b283-00164187111b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{437fd7fa-d1bb-11e0-b283-00164187111b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{437fd7fa-d1bb-11e0-b283-00164187111b}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{437fd7fa-d1bb-11e0-b283-00164187111b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{437fd7fa-d1bb-11e0-b283-00164187111b}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c84c571f-710b-11de-ac77-001a731a6b65}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c84c571f-710b-11de-ac77-001a731a6b65}\ not found.
File E:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\recycle.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c84c571f-710b-11de-ac77-001a731a6b65}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c84c571f-710b-11de-ac77-001a731a6b65}\ not found.
File E:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\recycle.exe not found.
ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:C980DA7D deleted successfully.
========== FILES ==========
C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\10 folder moved successfully.
File\Folder C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Downloads\registrybooster.exe not found.
File\Folder C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\Downloads\SoftonicDownloader66221.exe not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: Administrator
->Temp folder emptied: 905459631 bytes
->Temporary Internet Files folder emptied: 35859042 bytes
->Java cache emptied: 1371973 bytes
->FireFox cache emptied: 131755171 bytes
->Flash cache emptied: 100295 bytes
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 648843 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33237 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2134333 bytes
%systemroot%\System32 .tmp files removed: 2951 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 46128701 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 1.071,00 mb
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
OTL by OldTimer - Version 3.2.31.0 log created on 10262011_202409
Files\Folders moved on Reboot...
File\Folder C:\WINDOWS\temp\logishrd\LVPrcInj02.dll not found!
Registry entries deleted on Reboot...
|
|
26.10.2011, 20:03
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Trojaner Ursache für Probleme mit dem Drucker? Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet, Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten. Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!  Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen: Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop. Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )  Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen!
__________________ --> Trojaner Ursache für Probleme mit dem Drucker? |
|
26.10.2011, 20:53
| #7 |
| | Trojaner Ursache für Probleme mit dem Drucker?Code:
ATTFilter 21:51:07.0140 1016 TDSS rootkit removing tool 2.6.13.0 Oct 25 2011 13:56:21
21:51:07.0437 1016 ============================================================
21:51:07.0437 1016 Current date / time: 2011/10/26 21:51:07.0437
21:51:07.0437 1016 SystemInfo:
21:51:07.0437 1016
21:51:07.0437 1016 OS Version: 5.1.2600 ServicePack: 3.0
21:51:07.0437 1016 Product type: Workstation
21:51:07.0437 1016 ComputerName: NOTEBOOK
21:51:07.0437 1016 UserName: Administrator
21:51:07.0437 1016 Windows directory: C:\WINDOWS
21:51:07.0437 1016 System windows directory: C:\WINDOWS
21:51:07.0437 1016 Processor architecture: Intel x86
21:51:07.0437 1016 Number of processors: 2
21:51:07.0437 1016 Page size: 0x1000
21:51:07.0437 1016 Boot type: Normal boot
21:51:07.0437 1016 ============================================================
21:51:07.0828 1016 Initialize success
21:51:18.0500 0792 ============================================================
21:51:18.0500 0792 Scan started
21:51:18.0500 0792 Mode: Manual; SigCheck; TDLFS;
21:51:18.0500 0792 ============================================================
21:51:19.0046 0792 Abiosdsk - ok
21:51:19.0062 0792 abp480n5 - ok
21:51:19.0125 0792 ACPI (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
21:51:19.0984 0792 ACPI - ok
21:51:20.0078 0792 ACPIEC (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
21:51:20.0203 0792 ACPIEC - ok
21:51:20.0265 0792 ADIHdAudAddService (7356eff52ad50b8946d346002118ce62) C:\WINDOWS\system32\drivers\ADIHdAud.sys
21:51:20.0328 0792 ADIHdAudAddService - ok
21:51:20.0343 0792 adpu160m - ok
21:51:20.0375 0792 AEAudio (fff87a9b1ab36ee4b7bec98a4cb01b79) C:\WINDOWS\system32\drivers\AEAudio.sys
21:51:20.0406 0792 AEAudio - ok
21:51:20.0437 0792 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
21:51:20.0562 0792 aec - ok
21:51:20.0671 0792 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
21:51:20.0718 0792 AFD - ok
21:51:20.0812 0792 AgereSoftModem (9c7b1314d5e1212bd3d654177c06e24d) C:\WINDOWS\system32\DRIVERS\AGRSM.sys
21:51:20.0984 0792 AgereSoftModem - ok
21:51:21.0046 0792 Aha154x - ok
21:51:21.0062 0792 aic78u2 - ok
21:51:21.0062 0792 aic78xx - ok
21:51:21.0093 0792 AliIde - ok
21:51:21.0093 0792 amsint - ok
21:51:21.0156 0792 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
21:51:21.0281 0792 Arp1394 - ok
21:51:21.0296 0792 asc - ok
21:51:21.0312 0792 asc3350p - ok
21:51:21.0312 0792 asc3550 - ok
21:51:21.0359 0792 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
21:51:21.0468 0792 AsyncMac - ok
21:51:21.0515 0792 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
21:51:21.0625 0792 atapi - ok
21:51:21.0640 0792 Atdisk - ok
21:51:21.0656 0792 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
21:51:21.0765 0792 Atmarpc - ok
21:51:21.0812 0792 ATSWPDRV (69e65a2ce11619f0c868967ca9540b80) C:\WINDOWS\system32\DRIVERS\ATSwpDrv.sys
21:51:21.0859 0792 ATSWPDRV - ok
21:51:21.0906 0792 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
21:51:22.0015 0792 audstub - ok
21:51:22.0125 0792 AVGIDSDriver (2d18221aab3db2d408d6c55c0f23090a) C:\WINDOWS\system32\DRIVERS\AVGIDSDriver.Sys
21:51:22.0140 0792 AVGIDSDriver - ok
21:51:22.0171 0792 AVGIDSEH (1af676db3f3d4cc709cfab2571cf5fc3) C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys
21:51:22.0171 0792 AVGIDSEH - ok
21:51:22.0203 0792 AVGIDSFilter (4c51e233c87f9ec7598551de554bc99d) C:\WINDOWS\system32\DRIVERS\AVGIDSFilter.Sys
21:51:22.0203 0792 AVGIDSFilter - ok
21:51:22.0234 0792 AVGIDSShim (c3fc426e54f55c1cc3219e415b88e10c) C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys
21:51:22.0234 0792 AVGIDSShim - ok
21:51:22.0296 0792 Avgldx86 (4e796d3d2c3182b13b3e3b5a2ad4ef0a) C:\WINDOWS\system32\DRIVERS\avgldx86.sys
21:51:22.0312 0792 Avgldx86 - ok
21:51:22.0343 0792 Avgmfx86 (5639de66b37d02bd22df4cf3155fba60) C:\WINDOWS\system32\DRIVERS\avgmfx86.sys
21:51:22.0359 0792 Avgmfx86 - ok
21:51:22.0375 0792 Avgrkx86 (d1baf652eda0ae70896276a1fb32c2d4) C:\WINDOWS\system32\DRIVERS\avgrkx86.sys
21:51:22.0390 0792 Avgrkx86 - ok
21:51:22.0421 0792 Avgtdix (aaf0ebcad95f2164cffb544e00392498) C:\WINDOWS\system32\DRIVERS\avgtdix.sys
21:51:22.0453 0792 Avgtdix - ok
21:51:22.0546 0792 b57w2k (c0acd392ece55784884cc208aafa06ce) C:\WINDOWS\system32\DRIVERS\b57xp32.sys
21:51:22.0609 0792 b57w2k - ok
21:51:22.0796 0792 BCM43XX (e9ea635b8432d68f0005b3f6cebab837) C:\WINDOWS\system32\DRIVERS\bcmwl5.sys
21:51:22.0937 0792 BCM43XX - ok
21:51:22.0984 0792 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
21:51:23.0171 0792 Beep - ok
21:51:23.0281 0792 BrScnUsb (92a964547b96d697e5e9ed43b4297f5a) C:\WINDOWS\system32\Drivers\BrScnUsb.sys
21:51:23.0328 0792 BrScnUsb - ok
21:51:23.0390 0792 btaudio (df74d51ba41ad84d72b2cb844337d3ed) C:\WINDOWS\system32\drivers\btaudio.sys
21:51:23.0468 0792 btaudio ( UnsignedFile.Multi.Generic ) - warning
21:51:23.0468 0792 btaudio - detected UnsignedFile.Multi.Generic (1)
21:51:23.0515 0792 BTDriver (048f90a830e4dfbe050ea9f4c9f98ae3) C:\WINDOWS\system32\DRIVERS\btport.sys
21:51:23.0515 0792 BTDriver ( UnsignedFile.Multi.Generic ) - warning
21:51:23.0515 0792 BTDriver - detected UnsignedFile.Multi.Generic (1)
21:51:23.0640 0792 BTKRNL (6b6ad8cbf3984c3b39d4d06c38f52010) C:\WINDOWS\system32\DRIVERS\btkrnl.sys
21:51:23.0734 0792 BTKRNL ( UnsignedFile.Multi.Generic ) - warning
21:51:23.0734 0792 BTKRNL - detected UnsignedFile.Multi.Generic (1)
21:51:23.0812 0792 BTWDNDIS (8aa19a3c1cbdfeef118f0e4ef874a8a7) C:\WINDOWS\system32\DRIVERS\btwdndis.sys
21:51:23.0828 0792 BTWDNDIS ( UnsignedFile.Multi.Generic ) - warning
21:51:23.0828 0792 BTWDNDIS - detected UnsignedFile.Multi.Generic (1)
21:51:23.0875 0792 btwmodem (8b17bf2af7c388a59885d147312d3945) C:\WINDOWS\system32\DRIVERS\btwmodem.sys
21:51:23.0890 0792 btwmodem ( UnsignedFile.Multi.Generic ) - warning
21:51:23.0890 0792 btwmodem - detected UnsignedFile.Multi.Generic (1)
21:51:23.0921 0792 BTWUSB (00c8988da469e4ac087539bd77420123) C:\WINDOWS\system32\Drivers\btwusb.sys
21:51:23.0937 0792 BTWUSB ( UnsignedFile.Multi.Generic ) - warning
21:51:23.0937 0792 BTWUSB - detected UnsignedFile.Multi.Generic (1)
21:51:23.0984 0792 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
21:51:24.0171 0792 cbidf2k - ok
21:51:24.0203 0792 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
21:51:24.0328 0792 CCDECODE - ok
21:51:24.0328 0792 cd20xrnt - ok
21:51:24.0390 0792 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
21:51:24.0484 0792 Cdaudio - ok
21:51:24.0625 0792 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
21:51:24.0734 0792 Cdfs - ok
21:51:24.0765 0792 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
21:51:24.0890 0792 Cdrom - ok
21:51:24.0906 0792 Changer - ok
21:51:24.0968 0792 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
21:51:25.0093 0792 CmBatt - ok
21:51:25.0109 0792 CmdIde - ok
21:51:25.0125 0792 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
21:51:25.0250 0792 Compbatt - ok
21:51:25.0281 0792 Cpqarray - ok
21:51:25.0296 0792 dac2w2k - ok
21:51:25.0312 0792 dac960nt - ok
21:51:25.0328 0792 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
21:51:25.0421 0792 Disk - ok
21:51:25.0484 0792 dmboot (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
21:51:25.0640 0792 dmboot - ok
21:51:25.0734 0792 dmio (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
21:51:25.0843 0792 dmio - ok
21:51:25.0875 0792 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
21:51:26.0015 0792 dmload - ok
21:51:26.0062 0792 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
21:51:26.0265 0792 DMusic - ok
21:51:26.0281 0792 dpti2o - ok
21:51:26.0296 0792 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
21:51:26.0406 0792 drmkaud - ok
21:51:26.0437 0792 ewusbnet - ok
21:51:26.0453 0792 ew_hwusbdev - ok
21:51:26.0515 0792 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
21:51:26.0625 0792 Fastfat - ok
21:51:26.0703 0792 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
21:51:26.0828 0792 Fdc - ok
21:51:26.0859 0792 Fips (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
21:51:26.0968 0792 Fips - ok
21:51:26.0984 0792 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
21:51:27.0093 0792 Flpydisk - ok
21:51:27.0140 0792 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
21:51:27.0250 0792 FltMgr - ok
21:51:27.0281 0792 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
21:51:27.0406 0792 Fs_Rec - ok
21:51:27.0453 0792 Ftdisk (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
21:51:27.0562 0792 Ftdisk - ok
21:51:27.0656 0792 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
21:51:27.0750 0792 Gpc - ok
21:51:27.0812 0792 GTIPCI21 (f3c9f09aa3eda29a1c841877e7e39158) C:\WINDOWS\system32\DRIVERS\gtipci21.sys
21:51:27.0859 0792 GTIPCI21 - ok
21:51:27.0921 0792 HBtnKey (de15777902a5d9121857d155873a1d1b) C:\WINDOWS\system32\DRIVERS\cpqbttn.sys
21:51:27.0968 0792 HBtnKey - ok
21:51:28.0015 0792 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
21:51:28.0203 0792 HDAudBus - ok
21:51:28.0250 0792 hpn - ok
21:51:28.0312 0792 HpqKbFiltr (35956140e686d53bf676cf0c778880fc) C:\WINDOWS\system32\DRIVERS\HpqKbFiltr.sys
21:51:28.0359 0792 HpqKbFiltr - ok
21:51:28.0437 0792 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
21:51:28.0515 0792 HTTP - ok
21:51:28.0562 0792 huawei_enumerator - ok
21:51:28.0593 0792 hwdatacard - ok
21:51:28.0609 0792 i2omgmt - ok
21:51:28.0609 0792 i2omp - ok
21:51:28.0640 0792 i8042prt (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
21:51:28.0765 0792 i8042prt - ok
21:51:29.0109 0792 ialm (48846b31be5a4fa662ccfde7a1ba86b9) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
21:51:29.0656 0792 ialm - ok
21:51:29.0781 0792 iastor (37769c28e1c6489c56e41db7a32d58c5) C:\WINDOWS\system32\Drivers\iaStor.sys
21:51:29.0812 0792 iastor - ok
21:51:29.0875 0792 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
21:51:30.0062 0792 Imapi - ok
21:51:30.0078 0792 ini910u - ok
21:51:30.0093 0792 IntelIde (69c4e3c9e67a1f103b94e14fdd5f3213) C:\WINDOWS\system32\DRIVERS\intelide.sys
21:51:30.0187 0792 IntelIde - ok
21:51:30.0250 0792 intelppm (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
21:51:30.0359 0792 intelppm - ok
21:51:30.0390 0792 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
21:51:30.0515 0792 Ip6Fw - ok
21:51:30.0609 0792 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
21:51:30.0718 0792 IpFilterDriver - ok
21:51:30.0750 0792 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
21:51:30.0859 0792 IpInIp - ok
21:51:30.0921 0792 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
21:51:31.0046 0792 IpNat - ok
21:51:31.0078 0792 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
21:51:31.0187 0792 IPSec - ok
21:51:31.0218 0792 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
21:51:31.0343 0792 IRENUM - ok
21:51:31.0421 0792 isapnp (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
21:51:31.0531 0792 isapnp - ok
21:51:31.0562 0792 Kbdclass (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
21:51:31.0671 0792 Kbdclass - ok
21:51:31.0703 0792 kbdhid (b6d6c117d771c98130497265f26d1882) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
21:51:31.0828 0792 kbdhid - ok
21:51:31.0875 0792 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
21:51:32.0000 0792 kmixer - ok
21:51:32.0031 0792 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
21:51:32.0125 0792 KSecDD - ok
21:51:32.0187 0792 lbrtfdc - ok
21:51:32.0234 0792 LVPr2Mon (a6919138f29ae45e90e99fa94737e04c) C:\WINDOWS\system32\DRIVERS\LVPr2Mon.sys
21:51:32.0250 0792 LVPr2Mon - ok
21:51:32.0296 0792 LVUSBSta (23f8ef78bb9553e465a476f3cee5ca18) C:\WINDOWS\system32\drivers\LVUSBSta.sys
21:51:32.0296 0792 LVUSBSta - ok
21:51:32.0359 0792 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
21:51:32.0484 0792 mnmdd - ok
21:51:32.0531 0792 Modem (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
21:51:32.0718 0792 Modem - ok
21:51:32.0765 0792 Mouclass (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
21:51:32.0875 0792 Mouclass - ok
21:51:32.0906 0792 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
21:51:33.0031 0792 MountMgr - ok
21:51:33.0093 0792 mraid35x - ok
21:51:33.0125 0792 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
21:51:33.0250 0792 MRxDAV - ok
21:51:33.0312 0792 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
21:51:33.0421 0792 MRxSmb - ok
21:51:33.0453 0792 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
21:51:33.0640 0792 Msfs - ok
21:51:33.0687 0792 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
21:51:33.0796 0792 MSKSSRV - ok
21:51:33.0890 0792 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
21:51:33.0984 0792 MSPCLOCK - ok
21:51:34.0000 0792 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
21:51:34.0125 0792 MSPQM - ok
21:51:34.0156 0792 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
21:51:34.0250 0792 mssmbios - ok
21:51:34.0296 0792 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
21:51:34.0406 0792 MSTEE - ok
21:51:34.0468 0792 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
21:51:34.0500 0792 Mup - ok
21:51:34.0546 0792 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
21:51:34.0671 0792 NABTSFEC - ok
21:51:34.0796 0792 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
21:51:34.0984 0792 NDIS - ok
21:51:35.0015 0792 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
21:51:35.0125 0792 NdisIP - ok
21:51:35.0156 0792 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
21:51:35.0218 0792 NdisTapi - ok
21:51:35.0250 0792 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
21:51:35.0359 0792 Ndisuio - ok
21:51:35.0375 0792 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
21:51:35.0484 0792 NdisWan - ok
21:51:35.0515 0792 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
21:51:35.0562 0792 NDProxy - ok
21:51:35.0671 0792 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
21:51:35.0796 0792 NetBIOS - ok
21:51:35.0828 0792 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
21:51:35.0953 0792 NetBT - ok
21:51:36.0109 0792 NETw4x32 (9eb7001200bc53dad5bc531f0e58970e) C:\WINDOWS\system32\DRIVERS\NETw4x32.sys
21:51:36.0312 0792 NETw4x32 - ok
21:51:36.0421 0792 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
21:51:36.0578 0792 NIC1394 - ok
21:51:36.0593 0792 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
21:51:36.0718 0792 Npfs - ok
21:51:36.0765 0792 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
21:51:36.0937 0792 Ntfs - ok
21:51:36.0984 0792 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
21:51:37.0093 0792 Null - ok
21:51:37.0140 0792 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
21:51:37.0265 0792 NwlnkFlt - ok
21:51:37.0328 0792 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
21:51:37.0453 0792 NwlnkFwd - ok
21:51:37.0484 0792 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
21:51:37.0609 0792 ohci1394 - ok
21:51:37.0640 0792 Parport (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\DRIVERS\parport.sys
21:51:37.0765 0792 Parport - ok
21:51:37.0796 0792 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
21:51:37.0890 0792 PartMgr - ok
21:51:37.0921 0792 ParVdm (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
21:51:38.0031 0792 ParVdm - ok
21:51:38.0031 0792 PCI (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
21:51:38.0140 0792 PCI - ok
21:51:38.0156 0792 PCIDump - ok
21:51:38.0187 0792 PCIIde (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
21:51:38.0281 0792 PCIIde - ok
21:51:38.0296 0792 Pcmcia (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
21:51:38.0421 0792 Pcmcia - ok
21:51:38.0421 0792 PDCOMP - ok
21:51:38.0437 0792 PDFRAME - ok
21:51:38.0453 0792 PDRELI - ok
21:51:38.0468 0792 PDRFRAME - ok
21:51:38.0484 0792 perc2 - ok
21:51:38.0500 0792 perc2hib - ok
21:51:38.0656 0792 PID_PEPI (4bb5ac2dd485b8eefccb977ee66a68ad) C:\WINDOWS\system32\DRIVERS\LV302V32.SYS
21:51:38.0796 0792 PID_PEPI - ok
21:51:38.0906 0792 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
21:51:39.0031 0792 PptpMiniport - ok
21:51:39.0062 0792 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
21:51:39.0234 0792 PSched - ok
21:51:39.0281 0792 PSI (d24dfd16a1e2a76034df5aa18125c35d) C:\WINDOWS\system32\DRIVERS\psi_mf.sys
21:51:39.0281 0792 PSI - ok
21:51:39.0312 0792 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
21:51:39.0437 0792 Ptilink - ok
21:51:39.0453 0792 ql1080 - ok
21:51:39.0468 0792 Ql10wnt - ok
21:51:39.0484 0792 ql12160 - ok
21:51:39.0500 0792 ql1240 - ok
21:51:39.0515 0792 ql1280 - ok
21:51:39.0546 0792 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
21:51:39.0671 0792 RasAcd - ok
21:51:39.0703 0792 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
21:51:39.0828 0792 Rasl2tp - ok
21:51:39.0859 0792 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
21:51:39.0968 0792 RasPppoe - ok
21:51:40.0031 0792 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
21:51:40.0140 0792 Raspti - ok
21:51:40.0203 0792 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
21:51:40.0328 0792 Rdbss - ok
21:51:40.0328 0792 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
21:51:40.0437 0792 RDPCDD - ok
21:51:40.0484 0792 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
21:51:40.0593 0792 rdpdr - ok
21:51:40.0656 0792 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
21:51:40.0703 0792 RDPWD - ok
21:51:40.0734 0792 redbook (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
21:51:40.0859 0792 redbook - ok
21:51:40.0953 0792 SASDIFSV (39763504067962108505bff25f024345) C:\Programme\SUPERAntiSpyware\SASDIFSV.SYS
21:51:40.0953 0792 SASDIFSV - ok
21:51:40.0984 0792 SASKUTIL (77b9fc20084b48408ad3e87570eb4a85) C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS
21:51:40.0984 0792 SASKUTIL - ok
21:51:41.0125 0792 sdbus (8d04819a3ce51b9eb47e5689b44d43c4) C:\WINDOWS\system32\DRIVERS\sdbus.sys
21:51:41.0312 0792 sdbus - ok
21:51:41.0359 0792 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
21:51:41.0453 0792 Secdrv - ok
21:51:41.0500 0792 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
21:51:41.0609 0792 serenum - ok
21:51:41.0640 0792 Serial (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\DRIVERS\serial.sys
21:51:41.0750 0792 Serial - ok
21:51:41.0796 0792 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
21:51:41.0906 0792 Sfloppy - ok
21:51:41.0921 0792 Simbad - ok
21:51:41.0968 0792 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
21:51:42.0078 0792 SLIP - ok
21:51:42.0156 0792 Sparrow - ok
21:51:42.0203 0792 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
21:51:42.0328 0792 splitter - ok
21:51:42.0375 0792 sr (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
21:51:42.0484 0792 sr - ok
21:51:42.0531 0792 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
21:51:42.0609 0792 Srv - ok
21:51:42.0671 0792 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
21:51:42.0828 0792 streamip - ok
21:51:42.0875 0792 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
21:51:42.0984 0792 swenum - ok
21:51:43.0109 0792 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
21:51:43.0218 0792 swmidi - ok
21:51:43.0234 0792 symc810 - ok
21:51:43.0250 0792 symc8xx - ok
21:51:43.0265 0792 sym_hi - ok
21:51:43.0281 0792 sym_u3 - ok
21:51:43.0312 0792 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
21:51:43.0421 0792 sysaudio - ok
21:51:43.0500 0792 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
21:51:43.0609 0792 Tcpip - ok
21:51:43.0640 0792 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
21:51:43.0796 0792 TDPIPE - ok
21:51:43.0859 0792 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
21:51:44.0015 0792 TDTCP - ok
21:51:44.0031 0792 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
21:51:44.0218 0792 TermDD - ok
21:51:44.0296 0792 tifm21 (e4c85c291ddb3dc5e4a2f227ca465ba6) C:\WINDOWS\system32\drivers\tifm21.sys
21:51:44.0343 0792 tifm21 - ok
21:51:44.0359 0792 TosIde - ok
21:51:44.0390 0792 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
21:51:44.0500 0792 Udfs - ok
21:51:44.0515 0792 ultra - ok
21:51:44.0593 0792 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
21:51:44.0734 0792 Update - ok
21:51:44.0859 0792 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
21:51:45.0000 0792 usbaudio - ok
21:51:45.0046 0792 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
21:51:45.0203 0792 usbccgp - ok
21:51:45.0218 0792 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
21:51:45.0375 0792 usbehci - ok
21:51:45.0421 0792 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
21:51:45.0531 0792 usbhub - ok
21:51:45.0578 0792 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
21:51:45.0687 0792 usbprint - ok
21:51:45.0718 0792 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
21:51:45.0828 0792 usbscan - ok
21:51:45.0906 0792 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
21:51:46.0031 0792 USBSTOR - ok
21:51:46.0078 0792 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
21:51:46.0187 0792 usbuhci - ok
21:51:46.0234 0792 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
21:51:46.0343 0792 usbvideo - ok
21:51:46.0390 0792 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
21:51:46.0484 0792 VgaSave - ok
21:51:46.0500 0792 ViaIde - ok
21:51:46.0546 0792 VolSnap (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
21:51:46.0640 0792 VolSnap - ok
21:51:46.0687 0792 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
21:51:46.0796 0792 Wanarp - ok
21:51:46.0921 0792 Wdf01000 (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
21:51:46.0953 0792 Wdf01000 - ok
21:51:46.0968 0792 WDICA - ok
21:51:47.0015 0792 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
21:51:47.0125 0792 wdmaud - ok
21:51:47.0187 0792 WmiAcpi (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
21:51:47.0296 0792 WmiAcpi - ok
21:51:47.0343 0792 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
21:51:47.0515 0792 WSTCODEC - ok
21:51:47.0640 0792 {B154377D-700F-42cc-9474-23858FBDF4BD} (74ec37b9eaf9fca015b933a526825c7a) C:\Programme\CyberLink\PowerDVD9\000.fcl
21:51:47.0656 0792 {B154377D-700F-42cc-9474-23858FBDF4BD} - ok
21:51:47.0671 0792 MBR (0x1B8) (5f8b5082f3482cc06b72ec5806598ae9) \Device\Harddisk0\DR0
21:51:48.0109 0792 \Device\Harddisk0\DR0 - ok
21:51:48.0109 0792 Boot (0x1200) (928001616f71d682c11fb4d99cdaff39) \Device\Harddisk0\DR0\Partition0
21:51:48.0109 0792 \Device\Harddisk0\DR0\Partition0 - ok
21:51:48.0109 0792 ============================================================
21:51:48.0109 0792 Scan finished
21:51:48.0109 0792 ============================================================
21:51:48.0218 2436 Detected object count: 6
21:51:48.0218 2436 Actual detected object count: 6
21:52:02.0937 2436 btaudio ( UnsignedFile.Multi.Generic ) - skipped by user
21:52:02.0937 2436 btaudio ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:52:02.0937 2436 BTDriver ( UnsignedFile.Multi.Generic ) - skipped by user
21:52:02.0937 2436 BTDriver ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:52:02.0937 2436 BTKRNL ( UnsignedFile.Multi.Generic ) - skipped by user
21:52:02.0937 2436 BTKRNL ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:52:02.0937 2436 BTWDNDIS ( UnsignedFile.Multi.Generic ) - skipped by user
21:52:02.0937 2436 BTWDNDIS ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:52:02.0937 2436 btwmodem ( UnsignedFile.Multi.Generic ) - skipped by user
21:52:02.0937 2436 btwmodem ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:52:02.0937 2436 BTWUSB ( UnsignedFile.Multi.Generic ) - skipped by user
21:52:02.0937 2436 BTWUSB ( UnsignedFile.Multi.Generic ) - User select action: Skip
|
|
27.10.2011, 08:02
| #8 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Trojaner Ursache für Probleme mit dem Drucker? Dann bitte jetzt CF ausführen: ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat! Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
27.10.2011, 11:03
| #9 |
| | Trojaner Ursache für Probleme mit dem Drucker?Code:
ATTFilter ComboFix 11-10-27.03 - Administrator 27.10.2011 11:48:03.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.49.1031.18.2039.1405 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\Administrator\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokumente und einstellungen\Administrator\WINDOWS
C:\Thumbs.db
c:\windows\dasetup.log
c:\windows\ehome\medctrro.exe
c:\windows\help\tours\htmltour\unlock_playing.htm
c:\windows\system32\d3d9caps.dat
c:\windows\TEMP\logishrd\LVPrcInj01.dll
.
.
((((((((((((((((((((((( Dateien erstellt von 2011-09-27 bis 2011-10-27 ))))))))))))))))))))))))))))))
.
.
2011-10-26 18:34 . 2011-09-29 07:09 134104 ----a-w- c:\programme\Mozilla Firefox\components\browsercomps.dll
2011-10-26 18:34 . 2011-09-29 07:09 89048 ----a-w- c:\programme\Mozilla Firefox\libEGL.dll
2011-10-26 18:34 . 2011-09-29 07:09 773080 ----a-w- c:\programme\Mozilla Firefox\mozsqlite3.dll
2011-10-26 18:34 . 2011-09-29 07:09 478168 ----a-w- c:\programme\Mozilla Firefox\libGLESv2.dll
2011-10-26 18:34 . 2011-09-29 07:09 1833944 ----a-w- c:\programme\Mozilla Firefox\mozjs.dll
2011-10-26 18:34 . 2011-09-29 07:09 15832 ----a-w- c:\programme\Mozilla Firefox\mozalloc.dll
2011-10-26 18:34 . 2011-09-29 00:26 2106216 ----a-w- c:\programme\Mozilla Firefox\D3DCompiler_43.dll
2011-10-26 18:34 . 2011-09-29 00:26 1998168 ----a-w- c:\programme\Mozilla Firefox\d3dx9_43.dll
2011-10-26 18:24 . 2011-10-26 18:24 -------- d-----w- C:\_OTL
2011-10-26 13:05 . 2011-08-31 15:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-10-25 21:58 . 2011-10-25 21:58 -------- d-----w- c:\programme\7-Zip
2011-10-25 16:52 . 2011-10-25 16:52 -------- d-----w- c:\programme\ESET
2011-10-25 16:48 . 2011-10-25 16:48 -------- d-----w- c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Sun
2011-10-25 15:00 . 2011-10-25 15:00 -------- d-----w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\SUPERAntiSpyware.com
2011-10-25 14:59 . 2011-10-25 15:00 -------- d-----w- c:\programme\SUPERAntiSpyware
2011-10-25 14:59 . 2011-10-25 14:59 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com
2011-10-25 14:32 . 2011-10-25 14:32 -------- d-----w- c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Secunia PSI
2011-10-25 14:32 . 2011-10-25 14:32 -------- d-----w- c:\programme\Secunia
2011-10-25 14:30 . 2011-10-25 14:30 -------- d-----w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Apple Computer
2011-10-25 14:28 . 2011-10-25 14:28 -------- d-----w- c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Apple Computer
2011-10-25 14:28 . 2011-10-25 14:28 -------- d-----w- c:\programme\Gemeinsame Dateien\Java
2011-10-25 14:28 . 2011-10-25 14:28 128000 ----a-w- c:\windows\system32\javacpl.cpl
2011-10-25 14:27 . 2011-10-26 07:40 -------- d-----w- c:\programme\Java
2011-10-24 17:24 . 2011-10-24 17:24 -------- d--h--w- c:\windows\system32\GroupPolicy
2011-10-22 09:21 . 2011-10-22 10:16 -------- d-----w- C:\ConversionOutput
2011-10-22 09:06 . 2011-10-22 09:27 -------- d-----w- c:\programme\ContentaConverter-PREMIUM
2011-10-21 07:15 . 2011-10-25 14:41 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-18 19:39 . 2011-10-18 19:39 -------- d-----w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Malwarebytes
2011-10-18 19:39 . 2011-10-18 19:39 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2011-10-18 19:39 . 2011-10-26 13:05 -------- d-----w- c:\programme\Malwarebytes' Anti-Malware
2011-10-09 17:15 . 2011-10-09 17:15 -------- d-----w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Ahead
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-25 14:28 . 2010-12-08 20:17 544656 ----a-w- c:\windows\system32\deployJava1.dll
2011-09-26 09:41 . 2008-07-29 17:59 614912 ----a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 09:41 . 2001-08-18 19:00 23040 ----a-w- c:\windows\system32\oleaccrc.dll
2011-09-26 09:41 . 2001-08-18 19:00 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-09 09:11 . 2004-08-03 22:57 604160 ----a-w- c:\windows\system32\crypt32.dll
2011-09-06 14:10 . 2004-08-03 22:46 1859072 ----a-w- c:\windows\system32\win32k.sys
2011-08-17 21:25 . 2004-08-03 22:57 832512 ----a-w- c:\windows\system32\wininet.dll
2011-08-17 21:25 . 2004-08-03 22:58 1830912 ----a-w- c:\windows\system32\inetcpl.cpl
2011-08-17 21:25 . 2004-08-03 22:57 78336 ----a-w- c:\windows\system32\ieencode.dll
2011-08-17 21:25 . 2004-08-03 22:57 17408 ----a-w- c:\windows\system32\corpol.dll
2011-08-17 13:49 . 2004-08-03 21:14 138496 ----a-w- c:\windows\system32\drivers\afd.sys
2011-08-17 12:22 . 2004-08-03 22:42 389120 ----a-w- c:\windows\system32\html.iec
2004-03-11 11:27 . 2010-05-05 05:17 40960 ----a-w- c:\programme\Uninstall_CDS.exe
2011-09-29 07:09 . 2011-10-26 18:34 134104 ----a-w- c:\programme\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\programme\Skype\Phone\Skype.exe" [2011-07-29 17361032]
"NBJ"="c:\programme\Ahead\Nero BackItUp\NBJ.exe" [2004-09-22 1871872]
"SUPERAntiSpyware"="c:\programme\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-10-17 4615552]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QlbCtrl.exe"="c:\programme\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-10-19 177456]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-08-20 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-08-20 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-08-20 137752]
"AGRSMMSG"="AGRSMMSG.exe" [2005-12-12 88203]
"SoundMAXPnP"="c:\programme\Analog Devices\Core\smax4pnp.exe" [2007-01-05 872448]
"PTHOSTTR"="c:\programme\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2007-01-09 145184]
"CognizanceTS"="c:\progra~1\HEWLET~1\IAM\Bin\ASTSVCC.dll" [2003-12-22 17920]
"SSBkgdUpdate"="c:\programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648]
"PaperPort PTD"="c:\programme\ScanSoft\PaperPort\pptd40nt.exe" [2005-03-17 57393]
"IndexSearch"="c:\programme\ScanSoft\PaperPort\IndexSearch.exe" [2005-03-17 40960]
"LogitechCommunicationsManager"="c:\programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe" [2008-08-14 565008]
"LogitechQuickCamRibbon"="c:\programme\Logitech\QuickCam\Quickcam.exe" [2008-08-14 2407184]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2006-09-01 282624]
"RemoteControl9"="c:\programme\CyberLink\PowerDVD9\PDVD9Serv.exe" [2009-07-06 87336]
"PDVD9LanguageShortcut"="c:\programme\CyberLink\PowerDVD9\Language\Language.exe" [2009-04-27 50472]
"BDRegion"="c:\programme\Cyberlink\Shared Files\brs.exe" [2009-09-01 75048]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"AVG_TRAY"="c:\programme\AVG\AVG10\avgtray.exe" [2011-09-10 2338656]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\
Secunia PSI Tray.lnk - c:\programme\Secunia\PSI\psi_tray.exe [2011-7-29 291896]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoTaskGrouping"= 1 (0x1)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoTaskGrouping"= 1 (0x1)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoTaskGrouping"= 1 (0x1)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\programme\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2011-05-04 17:54 551296 ----a-w- c:\programme\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard]
2007-02-06 23:30 74240 ----a-r- c:\programme\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\APSHook.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\CyberLink\\PowerDVD9\\PowerDVD9.exe"=
"c:\\Programme\\Skype\\Phone\\Skype.exe"=
"c:\\Programme\\AVG\\AVG10\\avgmfapx.exe"=
"c:\\Programme\\AVG\\AVG10\\avgdiagex.exe"=
"c:\\Programme\\AVG\\AVG10\\avgnsx.exe"=
"c:\\Programme\\AVG\\AVG10\\avgemcx.exe"=
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [22.02.2011 08:13 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [16.03.2011 16:03 32592]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [07.01.2011 06:41 248656]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [05.04.2011 00:59 297168]
R1 SASDIFSV;SASDIFSV;c:\programme\SUPERAntiSpyware\sasdifsv.sys [22.07.2011 18:27 12880]
R1 SASKUTIL;SASKUTIL;c:\programme\SUPERAntiSpyware\SASKUTIL.SYS [12.07.2011 23:55 67664]
R2 !SASCORE;SAS Core Service;c:\programme\SUPERAntiSpyware\SASCore.exe [12.08.2011 01:38 116608]
R2 {B154377D-700F-42cc-9474-23858FBDF4BD};Power Control [2009/11/21 15:06];c:\programme\CyberLink\PowerDVD9\000.fcl [01.09.2009 17:59 87536]
R2 ASBroker;Anmeldesitzungsbroker;c:\windows\System32\svchost.exe -k Cognizance [04.08.2004 00:58 14336]
R2 ASChannel;Lokaler Verbindungskanal;c:\windows\System32\svchost.exe -k Cognizance [04.08.2004 00:58 14336]
R2 AVGIDSAgent;AVGIDSAgent;c:\programme\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [18.08.2011 01:33 7390560]
R2 avgwd;AVG WatchDog;c:\programme\AVG\AVG10\avgwdsvc.exe [08.02.2011 05:33 269520]
R2 Secunia PSI Agent;Secunia PSI Agent;c:\programme\Secunia\PSI\PSIA.exe --start-service --> c:\programme\Secunia\PSI\PSIA.exe --start-service [?]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [14.04.2011 21:28 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [10.02.2011 07:53 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [10.02.2011 07:53 27216]
R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [14.05.2009 17:19 88192]
R3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [01.09.2010 10:30 15544]
S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [20.05.2010 19:22 136176]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\programme\AVG\AVG10\Toolbar\ToolbarBroker.exe [27.08.2011 10:30 1025352]
S3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys --> c:\windows\system32\DRIVERS\ew_hwusbdev.sys [?]
S3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys --> c:\windows\system32\DRIVERS\ewusbnet.sys [?]
S3 gupdatem;Google Update-Dienst (gupdatem);c:\programme\Google\Update\GoogleUpdate.exe [20.05.2010 19:22 136176]
S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys --> c:\windows\system32\DRIVERS\ew_jubusenum.sys [?]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Cognizance REG_MULTI_SZ ASBroker ASChannel
.
Inhalt des "geplante Tasks" Ordners
.
2011-10-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-05-20 17:22]
.
2011-10-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-05-20 17:22]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page =
mLocal Page =
IE: Free YouTube Download - c:\dokumente und einstellungen\Administrator\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubedownload.htm
IE: Free YouTube to Mp3 Converter - c:\dokumente und einstellungen\Administrator\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubetomp3.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Senden an &Bluetooth - c:\programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
TCP: DhcpNameServer = 192.168.100.1
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} -
FF - ProfilePath - c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\ciqks4e4.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.search.selectedEngine - AVG Secure Search
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\programme\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Click to call with Skype: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} - c:\programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF - Ext: Java Console: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} - c:\programme\Mozilla Firefox\extensions\{CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: AVG Safe Search: {1E73965B-8B48-48be-9C8D-68B920ABC1C4} - c:\programme\AVG\AVG10\Firefox4
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - c:\programme\AVG\AVG10\Toolbar\IEToolbar.dll
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - c:\programme\AVG\AVG10\Toolbar\IEToolbar.dll
AddRemove-{d6f996fe-9bee-4bfb-9017-1a0e4f636d13} - c:\programme\Gemeinsame Dateien\Nero\Nero ProductInstaller 4\SetupX.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-10-27 11:55
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{B154377D-700F-42cc-9474-23858FBDF4BD}]
"ImagePath"="\??\c:\programme\CyberLink\PowerDVD9\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•6~*]
"7040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(1132)
c:\programme\SUPERAntiSpyware\SASWINLO.DLL
c:\programme\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll
c:\programme\Hewlett-Packard\IAM\bin\ItMsg.dll
c:\programme\Hewlett-Packard\IAM\Bin\TrayIcon.dll
c:\programme\Hewlett-Packard\IAM\bin\HPBrand.dll
c:\programme\Hewlett-Packard\IAM\bin\DEU\HPBrand.dll
c:\programme\Hewlett-Packard\IAM\bin\DEU\ItMsg.dll
c:\programme\Hewlett-Packard\IAM\Bin\ASChnl.dll
.
- - - - - - - > 'explorer.exe'(7136)
c:\windows\system32\APSHook.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\msi.dll
c:\windows\system32\MSCTF.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\progra~1\AVG\AVG10\avgchsvx.exe
c:\windows\system32\brss01a.exe
c:\windows\System32\SCardSvr.exe
c:\programme\Hewlett-Packard\IAM\bin\asghost.exe
c:\windows\AGRSMMSG.exe
c:\windows\system32\igfxsrvc.exe
c:\programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe
c:\programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\programme\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
c:\programme\Secunia\PSI\PSIA.exe
c:\programme\AVG\AVG10\avgnsx.exe
c:\windows\system32\UAService7.exe
c:\programme\Hewlett-Packard\Shared\hpqwmiex.exe
c:\programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe
c:\windows\system32\wscntfy.exe
c:\programme\Gemeinsame Dateien\Logishrd\LQCVFX\COCIManager.exe
c:\programme\logitech\quickcam\lu\lulnchr.exe
c:\programme\logitech\quickcam\lu\LogitechUpdate.exe
c:\progra~1\AVG\AVG10\avgrsx.exe
c:\programme\AVG\AVG10\avgcsrvx.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-10-27 12:01:02 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2011-10-27 10:00
.
Vor Suchlauf: 17 Verzeichnis(se), 70.074.384.384 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 70.028.521.472 Bytes frei
.
WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - B2424D56D51AFB8384BE62AA6010DDB7
|
|
27.10.2011, 12:33
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Trojaner Ursache für Probleme mit dem Drucker? Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen. Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst. Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM! Downloade dir bitte  aswMBR.exe und speichere die Datei auf deinem Desktop.
Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).
__________________ Logfiles bitte immer in CODE-Tags posten |
|
27.10.2011, 15:02
| #11 |
| | Trojaner Ursache für Probleme mit dem Drucker? GMER Code:
ATTFilter GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2011-10-27 15:15:34
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 TOSHIBA_ rev.AH20
Running: 5rpohwgm.exe; Driver: C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\kxroqpow.sys
---- System - GMER 1.0.15 ----
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwOpenProcess [0xB4E21738]
SSDT \??\C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0xA0639640]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateThread [0xB4E21878]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwWriteVirtualMemory [0xB4E21914]
---- Kernel code sections - GMER 1.0.15 ----
? Combo-Fix.sys Das System kann die angegebene Datei nicht finden. !
.text C:\Programme\CyberLink\PowerDVD9\000.fcl section is writeable [0x9F987000, 0x2892, 0xE8000020]
.vmp2 C:\Programme\CyberLink\PowerDVD9\000.fcl entry point in ".vmp2" section [0x9F9AA050]
? C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\catchme.sys Das System kann die angegebene Datei nicht finden. !
? C:\WINDOWS\system32\Drivers\PROCEXP113.SYS Das System kann die angegebene Datei nicht finden. !
---- Devices - GMER 1.0.15 ----
AttachedDevice \FileSystem\Ntfs \Ntfs AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
---- EOF - GMER 1.0.15 ----
Code:
ATTFilter Report of OSAM: Autorun Manager v5.0.11926.0 hxxp://www.online-solutions.ru/en/ Saved at 15:22:36 on 27.10.2011 OS: Windows XP Professional Service Pack 3 (Build 2600) Default Browser: Mozilla Corporation Firefox 7.0.1 Scanner Settings [x] Rootkits detection (hidden registry) [x] Rootkits detection (hidden files) [x] Retrieve files information [x] Check Microsoft signatures Filters [ ] Trusted entries [ ] Empty entries [x] Hidden registry entries (rootkit activity) [x] Exclusively opened files [x] Not found files [x] Files without detailed information [x] Existing files [ ] Non-startable services [ ] Non-startable drivers [x] Active entries [x] Disabled entries [Boot Execute] -----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager )----- "BootExecute" - "AVG Technologies CZ, s.r.o." - C:\PROGRA~1\AVG\AVG10\avgchsvx.exe "BootExecute" - "AVG Technologies CZ, s.r.o." - C:\PROGRA~1\AVG\AVG10\avgrsx.exe [Common] -----( %SystemRoot%\Tasks )----- "GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe "GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe [Control Panel Objects] -----( %SystemRoot%\system32 )----- "btcpl.cpl" - "Broadcom Corporation." - C:\WINDOWS\system32\btcpl.cpl "FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\WINDOWS\system32\FlashPlayerCPLApp.cpl "infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl "javacpl.cpl" - "Oracle Corporation" - C:\WINDOWS\system32\javacpl.cpl -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )----- "CognizanceWS" - "Cognizance Corporation" - C:\PROGRA~1\HEWLET~1\IAM\Bin\Settings.dll "PTHOST.CPL" - " Hewlett-Packard Development Company, L.P" - C:\Programme\Hewlett-Packard\HP ProtectTools Security Manager\PTHOST.CPL "QlbConfig" - " Hewlett-Packard Development Company, L.P." - C:\Programme\Hewlett-Packard\HP Quick Launch Buttons\QlbConfg.cpl "QuickTime" - "Apple Computer, Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl "SMAX4CP" - "Analog Devices, Inc." - C:\Programme\Analog Devices\SoundMAX\SMax4.cpl [Drivers] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "AVG Anti-Rootkit Driver" (Avgrkx86) - "AVG Technologies CZ, s.r.o." - C:\WINDOWS\System32\DRIVERS\avgrkx86.sys "AVG AVI Loader Driver" (Avgldx86) - "AVG Technologies CZ, s.r.o." - C:\WINDOWS\System32\DRIVERS\avgldx86.sys "AVG Mini-Filter Resident Anti-Virus Shield" (Avgmfx86) - "AVG Technologies CZ, s.r.o." - C:\WINDOWS\System32\DRIVERS\avgmfx86.sys "AVG TDI Driver" (Avgtdix) - "AVG Technologies CZ, s.r.o." - C:\WINDOWS\System32\DRIVERS\avgtdix.sys "AVGIDSDriver" (AVGIDSDriver) - "AVG Technologies CZ, s.r.o. " - C:\WINDOWS\System32\DRIVERS\AVGIDSDriver.Sys "AVGIDSEH" (AVGIDSEH) - "AVG Technologies CZ, s.r.o. " - C:\WINDOWS\System32\DRIVERS\AVGIDSEH.Sys "AVGIDSFilter" (AVGIDSFilter) - "AVG Technologies CZ, s.r.o. " - C:\WINDOWS\System32\DRIVERS\AVGIDSFilter.Sys "AVGIDSShim" (AVGIDSShim) - "AVG Technologies CZ, s.r.o. " - C:\WINDOWS\System32\DRIVERS\AVGIDSShim.Sys "Bluetooth-Audiogerät" (btaudio) - "Broadcom Corporation." - C:\WINDOWS\System32\drivers\btaudio.sys "Bluetooth-Bus-Enumerator" (BTKRNL) - "Broadcom Corporation." - C:\WINDOWS\System32\DRIVERS\btkrnl.sys "Bluetooth-LAN-Zugangsserver" (BTWDNDIS) - "Broadcom Corporation." - C:\WINDOWS\System32\DRIVERS\btwdndis.sys "Bluetooth-Modem" (btwmodem) - "Broadcom Corporation." - C:\WINDOWS\System32\DRIVERS\btwmodem.sys "catchme" (catchme) - ? - C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\catchme.sys (File not found) "Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys (File not found) "Huawei DataCard USB Modem and USB Serial" (hwdatacard) - ? - C:\WINDOWS\System32\DRIVERS\ewusbmdm.sys (File not found) "Huawei MobileBroadband USB PNP Device" (ew_hwusbdev) - ? - C:\WINDOWS\System32\DRIVERS\ew_hwusbdev.sys (File not found) "HUAWEI USB-NDIS miniport" (ewusbnet) - ? - C:\WINDOWS\System32\DRIVERS\ewusbnet.sys (File not found) "huawei_enumerator" (huawei_enumerator) - ? - C:\WINDOWS\System32\DRIVERS\ew_jubusenum.sys (File not found) "i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys (File not found) "kxroqpow" (kxroqpow) - ? - C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\kxroqpow.sys (Hidden registry entry, rootkit activity | File not found) "lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys (File not found) "PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys (File not found) "PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys (File not found) "PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys (File not found) "PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys (File not found) "PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys (File not found) "Power Control [2009/11/21 15:06:25]" ({B154377D-700F-42cc-9474-23858FBDF4BD}) - ? - C:\Programme\CyberLink\PowerDVD9\000.fcl "PSI" (PSI) - "Secunia" - C:\WINDOWS\System32\DRIVERS\psi_mf.sys "SASDIFSV" (SASDIFSV) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Programme\SUPERAntiSpyware\SASDIFSV.SYS "SASKUTIL" (SASKUTIL) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS "Virtueller Bluetooth-Kommunikationstreiber" (BTDriver) - "Broadcom Corporation." - C:\WINDOWS\System32\DRIVERS\btport.sys "WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys (File not found) "WIDCOMM USB Bluetooth Driver" (BTWUSB) - "Broadcom Corporation." - C:\WINDOWS\System32\Drivers\btwusb.sys [Explorer] -----( HKCU\Software\Microsoft\Internet Explorer\Desktop\Components )----- "(0) Source" - ? - /C:/DOKUME~1/ADMINI~1/LOKALE~1/Temp/msohtml1/01/clip_image002.jpg (File not found) -----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )----- {89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install -----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )----- {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll -----( HKLM\Software\Classes\Protocols\Filter )----- {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll {1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll {807553E5-5146-11D5-A672-00B0D022E945} "text/xml" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL -----( HKLM\Software\Classes\Protocols\Handler )----- {F2DDE6B2-9684-4A55-86D4-E255E237B77C} "avgsecuritytoolbar" - ? - C:\Programme\AVG\AVG10\Toolbar\IEToolbar.dll (File not found) {32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\11\OWC11.DLL {3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\10\OWC10.DLL {0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL {91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} "XPLPPFilter Class" - "AVG Technologies CZ, s.r.o." - C:\Programme\AVG\AVG10\avgpp.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )----- {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "SABShellExecuteHook Class" - "SuperAdBlocker.com" - C:\Programme\SUPERAntiSpyware\SASSEH.DLL -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )----- {23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Programme\7-Zip\7-zip.dll {9F97547E-460A-42C5-AE0C-81C61FFAEBC3} "AVG Find Extension" - ? - (File not found | COM-object registry key not found) {9F97547E-4609-42C5-AE0C-81C61FFAEBC3} "AVG Shell Extension Class" - "AVG Technologies CZ, s.r.o." - C:\Programme\AVG\AVG10\avgse.dll {6af09ec9-b429-11d4-a1fb-0090960218cb} "Bluetooth-Umgebung" - "Broadcom Corporation." - C:\WINDOWS\system32\btneighborhood.dll {42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - (File not found | COM-object registry key not found) {853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? - (File not found | COM-object registry key not found) {42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\OFFICE11\msohev.dll {00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL {C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll {087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll {63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll {3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Programme\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll {0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL {45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - ? - (File not found | COM-object registry key not found) {E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll {764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? - (File not found | COM-object registry key not found) {e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll {BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL [Internet Explorer] -----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )----- <binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found) -----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )----- {8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.7.0_01" - "Oracle Corporation" - C:\Programme\Java\jre7\bin\npjpi170_01.dll / hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} "Java Plug-in 1.7.0_01" - "Oracle Corporation" - C:\Programme\Java\jre7\bin\npjpi170_01.dll / hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.7.0_01" - ? - \bin\npjpi170_01.dll (File not found) / hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab {D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Macromed\Flash\Flash10x.ocx / hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )----- {898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Click to call with Skype" - "Skype Technologies S.A." - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll {FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Recherchieren" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )----- {18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} "AVG Safe Search" - "AVG Technologies CZ, s.r.o." - C:\Programme\AVG\AVG10\avgssie.dll {DF21F1DB-80C6-11D3-9483-B03D0EC10000} "Credential Manager for HP ProtectTools" - "Bioscrypt Inc." - C:\Programme\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype Browser Helper" - "Skype Technologies S.A." - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [Logon] -----( %AllUsersProfile%\Startmenü\Programme\Autostart )----- "desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini "Secunia PSI Tray.lnk" - "Secunia" - C:\Programme\Secunia\PSI\psi_tray.exe (Shortcut exists | File exists) -----( %UserProfile%\Startmenü\Programme\Autostart )----- "desktop.ini" - ? - C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Autostart\desktop.ini -----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )----- "NBJ" - "Ahead Software AG" - "C:\Programme\Ahead\Nero BackItUp\NBJ.exe" "Skype" - "Skype Technologies S.A." - "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized "SUPERAntiSpyware" - "SUPERAntiSpyware.com" - C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )----- "Adobe ARM" - "Adobe Systems Incorporated" - "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" "AVG_TRAY" - "AVG Technologies CZ, s.r.o." - C:\Programme\AVG\AVG10\avgtray.exe "BDRegion" - "cyberlink" - C:\Programme\Cyberlink\Shared Files\brs.exe "CognizanceTS" - "Cognizance Corporation" - rundll32.exe C:\PROGRA~1\HEWLET~1\IAM\Bin\ASTSVCC.dll,RegisterModule "IndexSearch" - "ScanSoft, Inc." - C:\Programme\ScanSoft\PaperPort\IndexSearch.exe "LogitechCommunicationsManager" - "Logitech Inc." - "C:\Programme\Gemeinsame Dateien\LogiShrd\LComMgr\Communications_Helper.exe" "LogitechQuickCamRibbon" - "Logitech Inc." - "C:\Programme\Logitech\QuickCam\Quickcam.exe" /hide "NeroFilterCheck" - "Ahead Software Gmbh" - C:\WINDOWS\system32\NeroCheck.exe "PaperPort PTD" - "ScanSoft, Inc." - C:\Programme\ScanSoft\PaperPort\pptd40nt.exe "PDVD9LanguageShortcut" - "CyberLink Corp." - C:\Programme\CyberLink\PowerDVD9\Language\Language.exe "PTHOSTTR" - "Hewlett-Packard Development Company, L.P." - C:\Programme\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start "QlbCtrl.exe" - " Hewlett-Packard Development Company, L.P." - C:\Programme\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start "QuickTime Task" - "Apple Computer, Inc." - "C:\Programme\QuickTime\qttask.exe" -atboottime "RemoteControl9" - "CyberLink Corp." - C:\Programme\CyberLink\PowerDVD9\PDVD9Serv.exe "SSBkgdUpdate" - "Scansoft, Inc." - "C:\Programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot [Network Providers] -----( HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order )----- "Credential Manager" - "Cognizance Corporation" - C:\Programme\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll [Print Monitors] -----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )----- "Bluetooth-Druckeranschluss" - "Broadcom Corporation." - C:\WINDOWS\system32\bthcrp.dll "Canon BJ Language Monitor MP540 series" - "CANON INC." - C:\WINDOWS\system32\CNMLM9E.DLL "Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\mdimon.dll "PDFCreator" - ? - C:\WINDOWS\system32\pdfcmnnt.dll (File found, but it contains no detailed information) [Services] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- ".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe "Anmeldesitzungsbroker" (ASBroker) - "Cognizance Corporation" - C:\Programme\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll "ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe "AVG Security Toolbar Service" (AVG Security Toolbar Service) - ? - C:\Programme\AVG\AVG10\Toolbar\ToolbarBroker.exe "AVG WatchDog" (avgwd) - "AVG Technologies CZ, s.r.o." - C:\Programme\AVG\AVG10\avgwdsvc.exe "AVGIDSAgent" (AVGIDSAgent) - "AVG Technologies CZ, s.r.o." - C:\Programme\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe "Bluetooth Service" (btwdins) - "Broadcom Corporation." - C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe "Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe "Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe "Hilfe und Support" (helpsvc) - ? - C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dlles\pchsvc.dll (File not found) "hpqwmiex" (hpqwmiex) - "Hewlett-Packard Development Company, L.P." - C:\Programme\Hewlett-Packard\Shared\hpqwmiex.exe "Lokaler Verbindungskanal" (ASChannel) - "Cognizance Corporation" - C:\Programme\Hewlett-Packard\IAM\Bin\ASChnl.dll "LVCOMSer" (LVCOMSer) - "Logitech Inc." - C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe "Nero BackItUp Scheduler 4.0" (Nero BackItUp Scheduler 4.0) - ? - C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe (File not found) "Office Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE "Process Monitor" (LVPrcSrv) - "Logitech Inc." - C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe "SAS Core Service" (!SASCORE) - "SUPERAntiSpyware.com" - C:\Programme\SUPERAntiSpyware\SASCORE.EXE "Secunia PSI Agent" (Secunia PSI Agent) - "Secunia" - C:\Programme\Secunia\PSI\PSIA.exe "SecuROM User Access Service (V7)" (UserAccess7) - ? - C:\WINDOWS\system32\UAService7.exe (File found, but it contains no detailed information) "Windows CardSpace" (idsvc) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe "Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [Winlogon] -----( HKCU\Control Panel\IOProcs )----- "MVB" - ? - mvfs32.dll (File not found) -----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions )----- {8F51D94E-8B89-4844-B15C-9C049BA0F49F} "DLLName" - "Cognizance Corporation" - C:\Programme\Hewlett-Packard\IAM\Bin\ItVCard.dll -----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )----- "!SASWinLogon" - "SUPERAntiSpyware.com" - C:\Programme\SUPERAntiSpyware\SASWINLO.DLL "OneCard" - "Cognizance Corporation" - C:\Programme\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll ===[ Logfile end ]=========================================[ Logfile end ]=== If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru Code:
ATTFilter aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-10-27 15:26:25
-----------------------------
15:26:25.359 OS Version: Windows 5.1.2600 Service Pack 3
15:26:25.359 Number of processors: 2 586 0xE08
15:26:25.359 ComputerName: NOTEBOOK UserName:
15:26:26.093 Initialize success
15:30:01.890 AVAST engine defs: 11102700
15:52:00.625 The log file has been saved successfully to "C:\Dokumente und Einstellungen\Administrator\Desktop\aswMBR.txt"
aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-10-27 15:26:25
-----------------------------
15:26:25.359 OS Version: Windows 5.1.2600 Service Pack 3
15:26:25.359 Number of processors: 2 586 0xE08
15:26:25.359 ComputerName: NOTEBOOK UserName:
15:26:26.093 Initialize success
15:30:01.890 AVAST engine defs: 11102700
15:52:00.625 The log file has been saved successfully to "C:\Dokumente und Einstellungen\Administrator\Desktop\aswMBR.txt"
15:52:08.000 The log file has been saved successfully to "C:\Dokumente und Einstellungen\Administrator\Desktop\aswMBR.txt"
|
|
27.10.2011, 18:25
| #12 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Trojaner Ursache für Probleme mit dem Drucker? Bei aswMBR hast du irgendwas falsch gemacht, bitte die Anleitung richtig umsetzen
__________________ Logfiles bitte immer in CODE-Tags posten |
|
27.10.2011, 20:58
| #13 |
| | Trojaner Ursache für Probleme mit dem Drucker?Code:
ATTFilter aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-10-27 21:37:16
-----------------------------
21:37:16.359 OS Version: Windows 5.1.2600 Service Pack 3
21:37:16.359 Number of processors: 2 586 0xE08
21:37:16.359 ComputerName: NOTEBOOK UserName:
21:37:17.078 Initialize success
21:37:27.812 AVAST engine defs: 11102700
21:38:23.093 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
21:38:23.093 Disk 0 Vendor: TOSHIBA_ AH20 Size: 95396MB BusType: 3
21:38:23.125 Disk 0 MBR read successfully
21:38:23.125 Disk 0 MBR scan
21:38:23.156 Disk 0 unknown MBR code
21:38:23.171 Disk 0 scanning sectors +195365520
21:38:23.234 Disk 0 scanning C:\WINDOWS\system32\drivers
21:38:36.781 Service scanning
21:38:37.859 Modules scanning
21:38:44.640 Disk 0 trace - called modules:
21:38:44.687 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll iaStor.sys
21:38:44.687 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x89d7f030]
21:38:44.687 3 CLASSPNP.SYS[ba108fd7] -> nt!IofCallDriver -> \Device\0000008e[0x89dc3958]
21:38:44.687 5 ACPI.sys[b9f7e620] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x89d19028]
21:38:45.250 AVAST engine scan C:\WINDOWS
21:39:09.234 AVAST engine scan C:\WINDOWS\system32
21:40:56.578 AVAST engine scan C:\WINDOWS\system32\drivers
21:41:13.968 AVAST engine scan C:\Dokumente und Einstellungen\Administrator
21:46:56.890 AVAST engine scan C:\Dokumente und Einstellungen\All Users
21:48:23.625 Scan finished successfully
21:55:23.203 Disk 0 MBR has been saved successfully to "C:\Dokumente und Einstellungen\Administrator\Desktop\MBR.dat"
21:55:23.203 The log file has been saved successfully to "C:\Dokumente und Einstellungen\Administrator\Desktop\aswMBR.txt"
|
|
27.10.2011, 21:27
| #14 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Trojaner Ursache für Probleme mit dem Drucker? Wir sollten den MBR fixen, sichere für den Fall der Fälle ALLE wichtigen Daten, auch wenn meistens alles glatt geht. Hinweis: Mach bitte NICHT den MBR-Fix, wenn du noch andere Betriebssysteme wie zB Ubuntu installiert hast, ein MBR-Fix mit Windows-Tools macht ein parallel installiertes (Dualboot) Linux unbootbar. Starte nach der Datensicherung aswmbr erneut und klick auf den Button FIXMBR. Anschließend Windows neu starten und ein neues Log mit aswMBR machen.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
28.10.2011, 10:59
| #15 |
| | Trojaner Ursache für Probleme mit dem Drucker?Code:
ATTFilter aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-10-28 11:38:34
-----------------------------
11:38:34.531 OS Version: Windows 5.1.2600 Service Pack 3
11:38:34.531 Number of processors: 2 586 0xE08
11:38:34.531 ComputerName: NOTEBOOK UserName:
11:38:39.093 Initialize success
11:38:57.390 AVAST engine defs: 11102700
11:38:59.406 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
11:38:59.406 Disk 0 Vendor: TOSHIBA_ AH20 Size: 95396MB BusType: 3
11:38:59.437 Disk 0 MBR read successfully
11:38:59.437 Disk 0 MBR scan
11:38:59.546 Disk 0 Windows XP default MBR code
11:38:59.578 Disk 0 scanning sectors +195365520
11:38:59.750 Disk 0 scanning C:\WINDOWS\system32\drivers
11:39:25.125 Service scanning
11:39:26.218 Modules scanning
11:39:33.250 Disk 0 trace - called modules:
11:39:33.265 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll iaStor.sys
11:39:33.265 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x89dc09c0]
11:39:33.265 3 CLASSPNP.SYS[ba108fd7] -> nt!IofCallDriver -> \Device\0000008e[0x89d08958]
11:39:33.265 5 ACPI.sys[b9f7e620] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x89d2b028]
11:39:34.312 AVAST engine scan C:\WINDOWS
11:39:57.984 AVAST engine scan C:\WINDOWS\system32
11:41:44.359 AVAST engine scan C:\WINDOWS\system32\drivers
11:42:01.531 AVAST engine scan C:\Dokumente und Einstellungen\Administrator
11:49:34.265 AVAST engine scan C:\Dokumente und Einstellungen\All Users
11:51:04.343 Scan finished successfully
11:58:06.609 Disk 0 MBR has been saved successfully to "C:\Dokumente und Einstellungen\Administrator\Desktop\MBR.dat"
11:58:06.609 The log file has been saved successfully to "C:\Dokumente und Einstellungen\Administrator\Desktop\aswMBR3.txt"
|
|
| Themen zu Trojaner Ursache für Probleme mit dem Drucker? |
| 0x00000001, adobe, alternate, auftrag, avg, avg secure search, avg security toolbar, bho, c:\windows\system32\rundll32.exe, converter, downloader, einstellungen, explorer, firefox, format, frage, java/trojandownloader.openstream.ncm, logfile, mozilla, mp3, object, plug-in, problem, registry, rundll, scan, secunia psi, secure search, security, senden, software, superantispyware, trojaner, version=1.0, virenquarantäne, virus, win32/softonicdownloader.a, winlogon.exe |
Hybrid-Darstellung
