| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Ist das ein gefährlicher Trojaner Trj/CI.AWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
14.11.2011, 13:15
| #1 |
 |  Ist das ein gefährlicher Trojaner Trj/CI.A Hallo, hoffe hier sehr auf Hilfe, mein PC öffnet plötzlich mehrere explorer, Und wenn ich eine Internetseite öffne setzt diese sich auf google zurück. Bei Mozilla auch so. Kann nicht mehr zocken online, da meine Seite sich dann auf google zurück setzt. Habe mit Panda online den PC gescannt und dieser hat was gefunden. Trj/CI.A hätte ich wohl. Ich weiss nicht ob das wirklich so ist. Kann mir jemand helfen was zu tun ist. das komische hab in 2 PC angeschlossen genau das gleiche. Den einen hatte ich schon neu aufgesetzt immer noch da. hab noch ein screenshot vom fund mit hochgeladen |
|
14.11.2011, 14:55
| #2 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Ist das ein gefährlicher Trojaner Trj/CI.AZitat:
__________________ |
|
14.11.2011, 18:13
| #3 |
| | Ist das ein gefährlicher Trojaner Trj/CI.A Hi,
__________________was genau soll ich posten? |
|
14.11.2011, 20:12
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Ist das ein gefährlicher Trojaner Trj/CI.A Ja was steht denn da? Was hab ich zitiert? Womit hast du gescannt? => Panda! Von dem Tool will ich das Log sehen
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
15.11.2011, 00:18
| #5 |
| | Ist das ein gefährlicher Trojaner Trj/CI.A Hi, so hab nun mal ein HijackThis gesagt. Kann mir jemand helfen? HiJackthis Logfile: Code:
ATTFilter Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 00:08:35, on 15.11.2011 Platform: Windows 7 (WinNT 6.00.3504) MSIE: Internet Explorer v8.00 (8.00.7600.16385) Boot mode: Normal Running processes: C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe C:\Program Files\AVAST Software\Avast\AvastUI.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe C:\Windows\SysWow64\Macromed\Flash\FlashUtil10c.exe C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Users\WirBeide\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GH1TSIVQ\HiJackThis204[1].exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5811&r=17361111m316pe4c5v1k5w55i1u65p R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5811&r=17361111m316pe4c5v1k5w55i1u65p R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5811&r=17361111m316pe4c5v1k5w55i1u65p R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5811&r=17361111m316pe4c5v1k5w55i1u65p R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = F2 - REG:system.ini: UserInit=userinit.exe O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Partner BHO Class - {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:\ProgramData\Partner\Partner.dll O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.7018.1622\swg.dll O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe O4 - HKLM\..\Run: [BackupManagerTray] "C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -h -k O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [Hotkey Utility] C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe O4 - HKLM\..\Run: [EgisTecLiveUpdate] "C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKLM\..\Run: [ArcadeDeluxeAgent] "C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe" O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui O4 - HKCU\..\Run: [Global Registration] "C:\Program Files (x86)\Acer\Registration\GREG.exe" BOOT O4 - HKCU\..\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) - hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab O23 - Service: AAV UpdateService - Unknown owner - C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe O23 - Service: ABBYY PDF Transformer 3.0 Licensing Service (ABBYY.Licensing.PDFTransformer.Site License.3.0) - ABBYY - C:\Program Files (x86)\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing) O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing) O23 - Service: Avira Planer (AntiVirSchedulerService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira Echtzeit Scanner (AntiVirService) - Avira Operations GmbH & Co. KG - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing) O23 - Service: GRegService (Greg_Service) - Acer Incorporated - C:\Program Files (x86)\Acer\Registration\GregHSRW.exe O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe O23 - Service: Google Update-Dienst (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing) O23 - Service: MyWinLocker Service (MWLService) - Egis Technology Inc. - C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: NTI IScheduleSvc - NewTech Infosystems, Inc. - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe O23 - Service: Partner Service - Google Inc. - C:\ProgramData\Partner\Partner.exe O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing) O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing) O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing) O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing) O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing) O23 - Service: Intel(R) Management & Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe O23 - Service: Updater Service - Acer - C:\Program Files\Acer\Acer Updater\UpdaterService.exe O23 - Service: USBS3S4Detection - Unknown owner - C:\OEM\USBDECTION\USBS3S4Detection.exe O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing) O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing) O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing) O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing) O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing) -- End of file - 12177 bytes Das sagt mir Malwarebytes, da ist nichts gefunden. Und Avast auch nicht Malwarebytes' Anti-Malware 1.51.2.1300 www.malwarebytes.org Datenbank Version: 8162 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 14.11.2011 23:06:30 mbam-log-2011-11-14 (23-06-30).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|) Durchsuchte Objekte: 275005 Laufzeit: 39 Minute(n), 21 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) |
|
15.11.2011, 00:21
| #6 |
| | Ist das ein gefährlicher Trojaner Trj/CI.A Das Problem besteht nach wie vor. Explorer setzt sich weiterhin auf die eingestellt Startseite zurück. PC hab ich schon neu formatiert Fehler immer noch vorhanden bei Mozilla auch, bin echt total verzweifelt |
|
15.11.2011, 00:53
| #7 |
| | Ist das ein gefährlicher Trojaner Trj/CI.A Und das bei Panda Active Scan ;***************************************************************************************************************************************************** ****************************** ANALYSIS: 2011-11-15 00:48:19 PROTECTIONS: 2 MALWARE: 11 SUSPECTS: 0 ;***************************************************************************************************************************************************** ****************************** PROTECTIONS Description Version Active Updated ;===================================================================================================================================================== ============================== avast! Antivirus Yes Yes Avira Desktop Yes Yes ;===================================================================================================================================================== ============================== MALWARE Id Description Type Active Severity Disinfectable Disinfected Location ;===================================================================================================================================================== ============================== 00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No c:\users\wirbeide\appdata\roaming\microsoft\windows\cookies\low\wirbeide@doubleclick[2].txt 00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No c:\users\wirbeide\appdata\roaming\microsoft\windows\cookies\low\wirbeide@atdmt[2].txt 00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No c:\users\wirbeide\appdata\roaming\microsoft\windows\cookies\wirbeide@atdmt[2].txt 00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No c:\users\wirbeide\appdata\roaming\microsoft\windows\cookies\low\wirbeide@tribalfusion[1].txt 00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No c:\users\wirbeide\appdata\roaming\microsoft\windows\cookies\low\wirbeide@mediaplex[1].txt 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No c:\users\wirbeide\appdata\roaming\microsoft\windows\cookies\low\wirbeide@ad.yieldmanager[2].txt 00168061 Cookie/Apmebf TrackingCookie No 0 Yes No c:\users\wirbeide\appdata\roaming\microsoft\windows\cookies\low\wirbeide@apmebf[1].txt 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No c:\users\wirbeide\appdata\roaming\microsoft\windows\cookies\low\wirbeide@serving-sys[1].txt 00168109 Cookie/Adtech TrackingCookie No 0 Yes No c:\users\wirbeide\appdata\roaming\microsoft\windows\cookies\low\wirbeide@adtech[2].txt 00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No c:\users\wirbeide\appdata\roaming\microsoft\windows\cookies\low\wirbeide@questionmarket[2].txt 00207936 Cookie/Adviva TrackingCookie No 0 Yes No c:\users\wirbeide\appdata\roaming\microsoft\windows\cookies\low\wirbeide@adviva[1].txt 00273339 Cookie/Smartadserver TrackingCookie No 0 Yes No c:\users\wirbeide\appdata\roaming\microsoft\windows\cookies\low\wirbeide@smartadserver[2].txt ;===================================================================================================================================================== ============================== SUSPECTS Sent Location ;===================================================================================================================================================== ============================== ;===================================================================================================================================================== ============================== VULNERABILITIES Id Severity Description ;===================================================================================================================================================== ============================== ;===================================================================================================================================================== ============================== |
|
15.11.2011, 09:15
| #8 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Ist das ein gefährlicher Trojaner Trj/CI.AZitat:
 Ich kann ja verstehen, dass du keine Computer-Experting bist, aber ein wenig die Augen aufmachen hier muss man schon im Bord! Bitte nun routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten! ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten |
|
15.11.2011, 13:22
| #9 |
| | Ist das ein gefährlicher Trojaner Trj/CI.A So hallo erstmal und danke das du dich meiner an nimmst. sorry wegen dem HijackThis hier die logs Eset: ESETSmartInstaller@High as CAB hook log: OnlineScanner64.ocx - registred OK Malwarebytes' Anti-Malware 1.51.2.1300 Malwarebytes : Free anti-malware, anti-virus and spyware removal download Datenbank Version: 8166 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 15.11.2011 12:57:22 mbam-log-2011-11-15 (12-57-22).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|) Durchsuchte Objekte: 270992 Laufzeit: 12 Minute(n), 56 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) ältere hab ich nicht nur das was oben schon steht von gestern OnlineScanner.ocx - registred OK |
|
15.11.2011, 13:28
| #10 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Ist das ein gefährlicher Trojaner Trj/CI.AZitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
15.11.2011, 13:34
| #11 |
| | Ist das ein gefährlicher Trojaner Trj/CI.A Sorry, aber wie mach ich das denn? wie ich als admin den explorer öffne weiss ich schon, aber wie bekomm ich denn das programm da rein |
|
15.11.2011, 13:58
| #12 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Ist das ein gefährlicher Trojaner Trj/CI.AZitat:
Firefox oder anderen Browser per Rechtsklick => als Admin ausführen Dann erst auf die ESET Seite gehen! Wo ist da der riesige Unterschied?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
15.11.2011, 15:08
| #13 |
| | Ist das ein gefährlicher Trojaner Trj/CI.A So auf ein neues ESETSmartInstaller@High as CAB hook log: OnlineScanner64.ocx - registred OK OnlineScanner.ocx - registred OK # version=7 # iexplore.exe=8.00.7600.16385 (win7_rtm.090713-1255) # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=26197e4ef2feef448aa144f095960ddb # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-11-15 02:05:54 # local_time=2011-11-15 03:05:54 (+0100, Mitteleuropäische Zeit) # country="Germany" # lang=1033 # osver=6.1.7600 NT # compatibility_mode=5893 16776573 100 94 10849 72994330 0 0 # compatibility_mode=8192 67108863 100 0 10470 10470 0 0 # scanned=110705 # found=0 # cleaned=0 # scan_time=1474 |
|
15.11.2011, 15:38
| #14 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Ist das ein gefährlicher Trojaner Trj/CI.A CustomScan mit OTL Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
__________________ Logfiles bitte immer in CODE-Tags posten |
|
15.11.2011, 16:32
| #15 |
| | Ist das ein gefährlicher Trojaner Trj/CI.A hier das Ergebnis:OTL Logfile: Code:
ATTFilter OTL logfile created on: 15.11.2011 16:28:58 - Run 1 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\WirBeide\Desktop 64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 5,93 Gb Total Physical Memory | 4,45 Gb Available Physical Memory | 75,04% Memory free 11,86 Gb Paging File | 10,31 Gb Available in Paging File | 87,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 455,95 Gb Total Space | 413,18 Gb Free Space | 90,62% Space Free | Partition Type: NTFS Drive D: | 456,46 Gb Total Space | 455,79 Gb Free Space | 99,85% Space Free | Partition Type: NTFS Computer Name: WIRBEIDE-PC | User Name: WirBeide | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.11.15 16:27:04 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\WirBeide\Desktop\OTL.exe PRC - [2009.12.22 19:28:16 | 000,128,296 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe PRC - [2009.12.22 19:11:42 | 000,181,480 | ---- | M] (Acer Corp.) -- C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe PRC - [2009.12.09 10:24:16 | 000,076,320 | ---- | M] () -- C:\OEM\USBDECTION\USBS3S4Detection.exe PRC - [2009.10.13 19:25:54 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe PRC - [2009.10.13 19:25:30 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe PRC - [2009.09.30 19:34:22 | 002,314,240 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe PRC - [2009.09.30 19:33:08 | 000,262,144 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe PRC - [2009.09.10 14:42:30 | 000,349,480 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe PRC - [2009.08.28 10:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe PRC - [2009.08.18 08:27:26 | 000,629,280 | ---- | M] () -- C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe PRC - [2009.08.12 23:04:44 | 000,062,208 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe PRC - [2009.08.12 22:58:28 | 000,261,888 | ---- | M] (NewTech Infosystems, Inc.) -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe PRC - [2009.08.04 06:09:34 | 000,199,464 | ---- | M] (Egis Technology Inc.) -- C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe PRC - [2009.07.18 04:12:12 | 000,257,440 | R--- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10c.exe PRC - [2009.07.04 02:47:12 | 000,240,160 | ---- | M] (Acer) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe PRC - [2009.05.14 16:07:12 | 000,759,048 | ---- | M] (ABBYY) -- C:\Program Files (x86)\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe PRC - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe PRC - [2008.10.25 00:35:44 | 000,128,296 | ---- | M] () -- C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe ========== Modules (No Company Name) ========== MOD - [2009.08.18 08:31:22 | 000,163,840 | ---- | M] () -- C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyHook.dll MOD - [2009.08.18 08:27:26 | 000,629,280 | ---- | M] () -- C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe MOD - [2009.02.03 01:33:56 | 000,460,199 | ---- | M] () -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll ========== Win32 Services (SafeList) ========== SRV:64bit: - [2010.01.13 15:04:08 | 000,202,752 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV - [2009.12.09 10:24:16 | 000,076,320 | ---- | M] () [Auto | Running] -- C:\OEM\USBDECTION\USBS3S4Detection.exe -- (USBS3S4Detection) SRV - [2009.10.13 19:25:30 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe -- (IAANTMON) Intel(R) SRV - [2009.09.30 19:34:22 | 002,314,240 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R) SRV - [2009.09.30 19:33:08 | 000,262,144 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R) SRV - [2009.09.10 14:42:46 | 000,305,448 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe -- (MWLService) SRV - [2009.08.28 10:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Registration\GregHSRW.exe -- (Greg_Service) SRV - [2009.08.12 23:04:44 | 000,062,208 | ---- | M] (NewTech Infosystems, Inc.) [Auto | Running] -- C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc) SRV - [2009.07.04 02:47:12 | 000,240,160 | ---- | M] (Acer) [Auto | Running] -- C:\Programme\Acer\Acer Updater\UpdaterService.exe -- (Updater Service) SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009.05.14 16:07:12 | 000,759,048 | ---- | M] (ABBYY) [Auto | Running] -- C:\Program Files (x86)\ABBYY PDF Transformer 3.0\NetworkLicenseServer.exe -- (ABBYY.Licensing.PDFTransformer.Site License.3.0) SRV - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService) SRV - [2008.10.25 00:35:44 | 000,128,296 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe -- (AAV UpdateService) ========== Driver Services (SafeList) ========== DRV:64bit: - [2010.01.13 15:26:00 | 006,327,296 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atipmdag.sys -- (amdkmdag) DRV:64bit: - [2010.01.13 14:10:56 | 000,185,344 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap) DRV:64bit: - [2009.10.29 09:14:38 | 000,115,824 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\jraid.sys -- (JRAID) DRV:64bit: - [2009.10.13 19:16:40 | 000,409,624 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:64bit: - [2009.09.30 02:34:30 | 000,121,872 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService) DRV:64bit: - [2009.09.23 10:11:04 | 000,283,824 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1k62x64.sys -- (e1kexpress) Intel(R) DRV:64bit: - [2009.09.17 05:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64) Intel(R) DRV:64bit: - [2009.07.14 02:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2009.07.14 02:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 02:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.30 10:37:16 | 000,033,800 | ---- | M] (Panda Security, S.L.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\pavboot64.sys -- (pavboot) DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.06.02 12:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk) DRV:64bit: - [2009.06.02 12:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter) DRV:64bit: - [2009.06.02 12:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ) DRV:64bit: - [2009.05.06 00:46:08 | 000,018,432 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr) DRV:64bit: - [2009.05.06 00:46:08 | 000,016,896 | ---- | M] (NewTech Infosystems Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper) DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5811&r=17361111m316pe4c5v1k5w55i1u65p IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5811&r=17361111m316pe4c5v1k5w55i1u65p IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5811&r=17361111m316pe4c5v1k5w55i1u65p IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5811&r=17361111m316pe4c5v1k5w55i1u65p IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5811&r=17361111m316pe4c5v1k5w55i1u65p IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5811&r=17361111m316pe4c5v1k5w55i1u65p IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\3.0.40624.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pandasecurity.com/activescan: C:\Program Files (x86)\Panda Security\ActiveScan 2.0\npwrapper.dll (Panda Security, S.L.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.11.14 21:54:01 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.11.14 21:54:00 | 000,000,000 | ---D | M] [2011.11.14 21:54:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\WirBeide\AppData\Roaming\mozilla\Extensions [2011.11.14 21:54:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\WirBeide\AppData\Roaming\mozilla\Firefox\Profiles\gk512yjg.default\extensions [2011.11.14 21:54:00 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2011.11.03 16:21:59 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.11.03 16:21:59 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2011.11.03 16:21:59 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2011.11.03 16:21:59 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2011.11.03 16:21:59 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found. O4:64bit: - HKLM..\Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe (Egis Technology Inc.) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [ArcadeDeluxeAgent] C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.) O4 - HKLM..\Run: [BackupManagerTray] C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.) O4 - HKLM..\Run: [EgisTecLiveUpdate] C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe (Egis Technology Inc.) O4 - HKLM..\Run: [Hotkey Utility] C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe () O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe () O4 - HKLM..\Run: [PlayMovie] C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.) O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited) O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control) O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab (ActiveScan 2.0 Installer Class) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{32D33DE0-981E-4996-9D7A-848F55219933}: DhcpNameServer = 192.168.2.1 192.168.2.1 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.11.15 16:27:01 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\WirBeide\Desktop\OTL.exe [2011.11.15 12:46:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET [2011.11.15 12:42:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2011.11.15 12:42:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2011.11.15 05:26:21 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\XPSViewer [2011.11.15 05:26:21 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\de-DE [2011.11.15 05:26:21 | 000,000,000 | ---D | C] -- C:\Windows\de-DE [2011.11.15 05:26:21 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\de [2011.11.15 05:26:21 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\0407 [2011.11.15 05:26:20 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\de-DE [2011.11.15 05:26:20 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\de [2011.11.15 05:26:20 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\0407 [2011.11.15 05:25:48 | 000,011,776 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrSerId.sys.mui [2011.11.15 05:25:48 | 000,011,776 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrSerIb.sys.mui [2011.11.15 05:25:47 | 000,004,096 | ---- | C] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\de-DE\pscr.sys.mui [2011.11.15 05:25:47 | 000,002,560 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrParwdm.sys.mui [2011.11.15 05:20:25 | 000,000,000 | ---D | C] -- C:\Windows\NAPP_Dism_Log [2011.11.14 22:40:38 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Roaming\TS3Client [2011.11.14 22:31:16 | 000,254,400 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe [2011.11.14 22:30:21 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software [2011.11.14 22:30:21 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software [2011.11.14 22:25:47 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Roaming\Malwarebytes [2011.11.14 22:25:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2011.11.14 22:25:17 | 000,025,416 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2011.11.14 22:05:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy [2011.11.14 22:05:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy [2011.11.14 22:05:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy [2011.11.14 21:54:06 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Roaming\Mozilla [2011.11.14 21:54:06 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Local\Mozilla [2011.11.14 21:54:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox [2011.11.14 21:53:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2011.11.14 21:51:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client [2011.11.14 21:51:53 | 000,000,000 | ---D | C] -- C:\Program Files\TeamSpeak 3 Client [2011.11.14 21:48:47 | 000,033,800 | ---- | C] (Panda Security, S.L.) -- C:\Windows\SysNative\drivers\pavboot64.sys [2011.11.14 21:48:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Panda Security [2011.11.14 21:30:43 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Screensaver [2011.11.14 21:30:43 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Roaming\Macromedia [2011.11.14 21:28:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Works [2011.11.14 21:26:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Visual Studio 8 [2011.11.14 21:25:59 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Local\Microsoft Help [2011.11.14 21:24:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft SQL Server Compact Edition [2011.11.14 21:23:38 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Roaming\Adobe [2011.11.14 21:23:33 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Roaming\Google [2011.11.14 21:23:32 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Local\Google [2011.11.14 21:23:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft [2011.11.14 21:23:13 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\microsoft [2011.11.14 21:23:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Windows Live SkyDrive [2011.11.14 21:23:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live [2011.11.14 21:22:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Windows Live [2011.11.14 21:21:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Windows Live [2011.11.14 21:20:16 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer Arcade Deluxe [2011.11.14 21:20:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Cyberlink [2011.11.14 21:18:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Acer Arcade Deluxe [2011.11.14 21:18:37 | 000,000,000 | ---D | C] -- C:\ProgramData\CyberLink [2011.11.14 21:18:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Temp [2011.11.14 21:17:09 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Roaming\InstallShield [2011.11.14 21:16:22 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Roaming\ATI [2011.11.14 21:16:22 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Local\ATI [2011.11.14 21:16:22 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI [2011.11.14 21:16:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\postureAgent [2011.11.14 21:15:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AcerSystem [2011.11.14 21:15:40 | 000,000,000 | ---D | C] -- C:\ProgramData\McQcModifier-5c47-a7b0 [2011.11.14 21:15:40 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Local\EgisTec [2011.11.14 21:15:40 | 000,000,000 | ---D | C] -- C:\ProgramData\EgisTec [2011.11.14 21:15:40 | 000,000,000 | ---D | C] -- C:\book [2011.11.14 21:15:22 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup [2011.11.14 21:15:22 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\Searches [2011.11.14 21:15:22 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools [2011.11.14 21:15:14 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Roaming\Identities [2011.11.14 21:15:12 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Local\Apple [2011.11.14 21:15:11 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\Contacts [2011.11.14 21:15:09 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Local\VirtualStore [2011.11.14 21:06:50 | 000,000,000 | ---D | C] -- C:\Program Files\Acer Accessory Store [2011.11.14 21:06:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OEM [2011.11.14 21:06:32 | 000,000,000 | --SD | C] -- C:\Users\WirBeide\AppData\Roaming\Microsoft [2011.11.14 21:06:32 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\Videos [2011.11.14 21:06:32 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\Saved Games [2011.11.14 21:06:32 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\Pictures [2011.11.14 21:06:32 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\Music [2011.11.14 21:06:32 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance [2011.11.14 21:06:32 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\Links [2011.11.14 21:06:32 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\Favorites [2011.11.14 21:06:32 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\Downloads [2011.11.14 21:06:32 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\Documents [2011.11.14 21:06:32 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\Desktop [2011.11.14 21:06:32 | 000,000,000 | R--D | C] -- C:\Users\WirBeide\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories [2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Vorlagen [2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\AppData\Local\Verlauf [2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\AppData\Local\Temporary Internet Files [2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Startmenü [2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\SendTo [2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Recent [2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Netzwerkumgebung [2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Lokale Einstellungen [2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Documents\Eigene Videos [2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Documents\Eigene Musik [2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Eigene Dateien [2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Documents\Eigene Bilder [2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Druckumgebung [2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Cookies [2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\AppData\Local\Anwendungsdaten [2011.11.14 21:06:32 | 000,000,000 | -HSD | C] -- C:\Users\WirBeide\Anwendungsdaten [2011.11.14 21:06:32 | 000,000,000 | -H-D | C] -- C:\Users\WirBeide\AppData [2011.11.14 21:06:32 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Local\Temp [2011.11.14 21:06:32 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Local\Microsoft [2011.11.14 21:06:32 | 000,000,000 | ---D | C] -- C:\Users\WirBeide\AppData\Roaming\Media Center Programs [2011.11.14 21:06:13 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen [2011.11.14 21:06:13 | 000,000,000 | -HSD | C] -- C:\Recovery [2011.11.14 21:06:13 | 000,000,000 | -HSD | C] -- C:\Programme [2011.11.14 21:06:13 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien [2011.11.14 21:06:13 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten [2011.11.14 21:06:13 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos [2011.11.14 21:06:13 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik [2011.11.14 21:06:13 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder [2011.11.14 21:06:13 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen [2011.11.14 21:06:13 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente [2011.11.14 21:06:13 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten [2011.11.14 20:52:05 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\RTCOM [2011.11.14 20:52:05 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek [2011.11.14 20:52:01 | 000,513,536 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSX64.dll [2011.11.14 20:52:01 | 000,363,008 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEP64A.dll [2011.11.14 20:52:01 | 000,304,640 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DHT64.dll [2011.11.14 20:52:01 | 000,304,640 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DAA64.dll [2011.11.14 20:52:01 | 000,211,376 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSH64.dll [2011.11.14 20:52:01 | 000,198,656 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEED64A.dll [2011.11.14 20:52:01 | 000,193,536 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSHP64.dll [2011.11.14 20:52:01 | 000,150,528 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSWOW64.dll [2011.11.14 20:52:01 | 000,095,744 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEL64A.dll [2011.11.14 20:52:01 | 000,073,216 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEG64A.dll [2011.11.14 20:52:00 | 000,320,512 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO20.dll [2011.11.14 20:52:00 | 000,310,784 | ---- | C] (Fortemedia Corporation) -- C:\Windows\SysNative\FMAPO64.dll [2011.11.14 20:52:00 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Temp [2011.11.14 20:52:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Realtek [2011.11.14 20:49:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ATI Technologies [2011.11.14 20:49:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center [2011.11.14 20:49:16 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ATI Technologies [2011.11.14 20:49:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ATI Technologies [2011.11.14 20:49:08 | 000,000,000 | ---D | C] -- C:\Program Files\ATI [2011.11.14 20:48:36 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution [2011.11.14 20:45:46 | 000,000,000 | -HSD | C] -- C:\System Volume Information ========== Files - Modified Within 30 Days ========== [2011.11.15 16:27:04 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\WirBeide\Desktop\OTL.exe [2011.11.15 16:00:01 | 000,000,350 | ---- | M] () -- C:\Windows\tasks\Acer Registration Reminder.job [2011.11.15 15:47:00 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.11.15 12:47:39 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.11.15 12:47:39 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.11.15 12:47:18 | 001,472,002 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2011.11.15 12:47:18 | 000,643,628 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2011.11.15 12:47:18 | 000,606,992 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2011.11.15 12:47:18 | 000,126,188 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2011.11.15 12:47:18 | 000,103,370 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2011.11.15 12:42:45 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.11.15 12:40:32 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.11.15 12:40:09 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.11.15 12:40:03 | 479,510,527 | -HS- | M] () -- C:\hiberfil.sys [2011.11.15 05:26:14 | 000,295,922 | ---- | M] () -- C:\Windows\SysNative\perfi007.dat [2011.11.15 05:26:14 | 000,038,104 | ---- | M] () -- C:\Windows\SysNative\perfd007.dat [2011.11.15 05:25:48 | 000,011,776 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrSerId.sys.mui [2011.11.15 05:25:48 | 000,011,776 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrSerIb.sys.mui [2011.11.15 05:25:47 | 000,004,096 | ---- | M] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\de-DE\pscr.sys.mui [2011.11.15 05:25:47 | 000,002,560 | ---- | M] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrParwdm.sys.mui [2011.11.15 05:20:24 | 000,011,453 | ---- | M] () -- C:\Windows\ChangeLang_Done.tag [2011.11.14 22:31:17 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt [2011.11.14 22:05:16 | 000,001,258 | ---- | M] () -- C:\Users\WirBeide\Desktop\Spybot - Search & Destroy.lnk [2011.11.14 21:54:07 | 000,000,000 | ---- | M] () -- C:\Windows\nsreg.dat [2011.11.14 21:54:01 | 000,001,939 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2011.11.14 21:51:56 | 000,000,971 | ---- | M] () -- C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk [2011.11.14 21:39:21 | 000,361,696 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2011.11.14 21:24:03 | 000,000,020 | ---- | M] () -- C:\Windows\Àù· [2011.11.14 21:06:50 | 000,001,962 | ---- | M] () -- C:\Users\Public\Desktop\Acer Zubehör Shop.lnk [2011.11.14 21:06:47 | 000,002,609 | ---- | M] () -- C:\Users\Public\Desktop\eBay.lnk [2011.11.14 21:05:19 | 000,052,953 | ---- | M] () -- C:\Windows\SysWow64\license.rtf [2011.11.14 21:05:19 | 000,052,953 | ---- | M] () -- C:\Windows\SysNative\license.rtf [2011.11.14 20:54:29 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin [2011.11.14 20:53:31 | 000,000,003 | ---- | M] () -- C:\Windows\SysNative\PLD_Framework.cmd ========== Files Created - No Company Name ========== [2011.11.15 12:42:45 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.11.15 05:29:17 | 000,011,453 | ---- | C] () -- C:\Windows\ChangeLang_Done.tag [2011.11.15 05:26:43 | 000,643,628 | ---- | C] () -- C:\Windows\SysNative\perfh007.dat [2011.11.15 05:26:43 | 000,295,922 | ---- | C] () -- C:\Windows\SysNative\perfi007.dat [2011.11.15 05:26:43 | 000,126,188 | ---- | C] () -- C:\Windows\SysNative\perfc007.dat [2011.11.15 05:26:43 | 000,038,104 | ---- | C] () -- C:\Windows\SysNative\perfd007.dat [2011.11.15 01:05:24 | 000,000,350 | ---- | C] () -- C:\Windows\tasks\Acer Registration Reminder.job [2011.11.14 22:31:16 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\config.nt [2011.11.14 22:05:16 | 000,001,258 | ---- | C] () -- C:\Users\WirBeide\Desktop\Spybot - Search & Destroy.lnk [2011.11.14 21:54:07 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat [2011.11.14 21:54:01 | 000,001,939 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2011.11.14 21:51:56 | 000,000,971 | ---- | C] () -- C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk [2011.11.14 21:37:35 | 000,001,110 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.11.14 21:37:35 | 000,001,106 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.11.14 21:28:21 | 000,002,569 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office PowerPoint Viewer 2007.lnk [2011.11.14 21:28:13 | 000,001,193 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Works-Start.lnk [2011.11.14 21:24:02 | 000,000,020 | ---- | C] () -- C:\Windows\Àù· [2011.11.14 21:15:30 | 000,001,405 | ---- | C] () -- C:\Users\WirBeide\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk [2011.11.14 21:15:25 | 000,001,439 | ---- | C] () -- C:\Users\WirBeide\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk [2011.11.14 21:06:57 | 000,002,495 | ---- | C] () -- C:\Users\Public\Desktop\Serif WEBPLUS X4.lnk [2011.11.14 21:06:57 | 000,001,833 | ---- | C] () -- C:\Users\Public\Desktop\RADIOTRACKER.lnk [2011.11.14 21:06:57 | 000,001,656 | ---- | C] () -- C:\Users\Public\Desktop\PDF Transformer.lnk [2011.11.14 21:06:50 | 000,001,962 | ---- | C] () -- C:\Users\Public\Desktop\Acer Zubehör Shop.lnk [2011.11.14 21:06:47 | 000,002,609 | ---- | C] () -- C:\Users\Public\Desktop\eBay.lnk [2011.11.14 20:54:29 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2011.11.14 20:53:31 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\PLD_Framework.cmd [2011.11.14 20:45:46 | 479,510,527 | -HS- | C] () -- C:\hiberfil.sys [2010.03.23 16:35:44 | 000,001,035 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat [2010.03.23 16:03:34 | 000,131,472 | ---- | C] () -- C:\ProgramData\FullRemove.exe [2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT [2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat [2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat ========== LOP Check ========== [2011.11.14 23:19:22 | 000,000,000 | ---D | M] -- C:\Users\WirBeide\AppData\Roaming\TS3Client [2011.11.15 16:30:01 | 000,000,350 | ---- | M] () -- C:\Windows\Tasks\Acer Registration Reminder.job [2009.07.14 06:08:49 | 000,004,142 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < ESETSmartInstaller@High as CAB hook log: > < OnlineScanner64.ocx - registred OK > < OnlineScanner.ocx - registred OK > < # version=7 > < # iexplore.exe=8.00.7600.16385 (win7_rtm.090713-1255) > < # OnlineScanner.ocx=1.0.0.6583 > < # api_version=3.0.2 > < # EOSSerial=26197e4ef2feef448aa144f095960ddb > < # end=finished > < # remove_checked=true > < # archives_checked=true > < # unwanted_checked=true > < # unsafe_checked=false > < # antistealth_checked=true > < # utc_time=2011-11-15 02:05:54 > < # local_time=2011-11-15 03:05:54 (+0100, Mitteleuropäische Zeit) > < # country="Germany" > < # lang=1033 > < # osver=6.1.7600 NT > < # compatibility_mode=5893 16776573 100 94 10849 72994330 0 0 > < # compatibility_mode=8192 67108863 100 0 10470 10470 0 0 > < # scanned=110705 > < # found=0 > < # cleaned=0 > < # scan_time=1474 > < End of report > |
|
| Themen zu Ist das ein gefährlicher Trojaner Trj/CI.A |
| angeschlossen, aufgesetzt, explorer, gefährlicher, gescannt, geschlossen, google, interne, internetseite, komische, mozilla, neu, neu aufgesetzt, nicht mehr, online, panda, plötzlich, screenshot, seite, setzt, trj/ci.a, troja, trojaner, wirklich, zocken, öffnet |
Textbox von OTL - wenn OTL auf deutsch ist wird sie mit 
beschriftet
.
