| |
| |||||||
Log-Analyse und Auswertung: OTL.exe mit diversen Funden - konfuse SituationWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
12.12.2011, 21:48
| #1 |
 |  OTL.exe mit diversen Funden - konfuse Situation Was ist los? McAffee hatte einen Fund in einer ca. 622 MB großen Zip-Datei auf der DVD PC-Praxis 12/11 gemeldet. Diese habe ich nicht genutzt, weil dies alles Programme für eine Stick sind. Auf Grund der Rechercheergebnisse habe ich die SVCHOST bei VirusTotal (VT) checken lassen. Ein Fund des Win32.TrojanHorse von einem der Virenscanner. Bei Chip habe ich Nachgefragt unter dem Titel: McAffee findet W32/YahLover.worm. Leider erhalte ich seit ca. 2 Tagen keine Antwort mehr, obwohl der "Bearbeiter" aktiv ist. Deshalb habe ich mich dort aus dem Thread abgemeldet und stelle mein Problem hier vor. Habe weiter nach Lösungen und Informationen gesucht und deshalb auch Programme wie Netmeter oder whireshark installiert. Leider komme ich damit kaum, bis gar nicht zu recht. Aktuelle Schwierigkeiten: McAffee Echtzeit-Scan lässt sich nicht einschalten. Manueller - Scan lässt sich zwar anschalten, zeigt aber keine untersuchte Datei, auch die Prozentanzeige verändert sich nicht. Malwarbites, Adaware finden mit den Standardeinstellungen nichts. Gestern ging Windows-Defender nicht. Nun liefert der Schnelldurchlauf keinen Fund. Firefox leitet alle, auch google, Seiten auf eine Seite mit chinesischem (?) Schriftsatz um. In der OTL.exe und der SVCHOST.exe werden durch VT diese Funde angezeigt: SVCHOST.EXE eSafe 7.0.17.0 2011.12.11 Win32.TrojanHorse MD5 : 54a47f6b5e09a77e61649109c6a08866 SHA1 : 4af001b3c3816b860660cf2de2c0fd3c1dfb4878 SHA256: 121118a0f5e0e8c933efd28c9901e54e42792619a8a3a6d11e1f0025a7324bc2 OTL.exe Antiy-AVL 2.0.3.7 2011.12.12 Trojan/win32.agent.gen ByteHero 1.0.0.1 2011.12.07 Trojan.Win32.Heur.087 ClamAV 0.97.3.0 2011.12.12 PUA.Packed.PECompact-1 eSafe 7.0.17.0 2011.12.11 Suspicious File Jiangmin 13.0.900 2011.12.12 Trojan/Swisyn.see MD5 : 3270cb86f79b3e23720bafc2e48be3be SHA1 : 590bf47c71b26cd01d70b34c567c75f9613341ac SHA256: 851a1822872f6c47711ff5377f46d3063c4ac94422fb83d38226b8d080f7a044 Defogger.exe lief nicht durch. Lt. TaskManager war der Prozeß ohne Aktivität.Nach ca. 30 min. ohne Aktivität habe ich das System manuell rebeootet. Der Log sieht so aus: defogger_disable by jpshortstuff (23.02.10.1) Log created at 19:06 on 12/12/2011 (Ghost) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- OTL - eine Extra.txt wurde nicht erstellt. OTL.txt OTL Logfile: Code:
ATTFilter OTL logfile created on: 12.12.2011 21:09:05 - Run 6 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Ghost\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 7,98 Gb Total Physical Memory | 6,00 Gb Available Physical Memory | 75,26% Memory free 15,95 Gb Paging File | 13,68 Gb Available in Paging File | 85,76% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 111,69 Gb Total Space | 37,70 Gb Free Space | 33,76% Space Free | Partition Type: NTFS Drive D: | 224,61 Gb Total Space | 206,68 Gb Free Space | 92,02% Space Free | Partition Type: NTFS Drive E: | 241,15 Gb Total Space | 190,42 Gb Free Space | 78,96% Space Free | Partition Type: NTFS Drive G: | 465,64 Gb Total Space | 381,59 Gb Free Space | 81,95% Space Free | Partition Type: FAT32 Computer Name: GHOST-PC | User Name: Ghost | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.12.12 16:47:13 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Ghost\Desktop\OTL.exe PRC - [2011.11.03 19:25:09 | 002,358,656 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe PRC - [2011.10.28 19:35:26 | 002,152,152 | ---- | M] (Lavasoft Limited) -- D:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe PRC - [2011.10.28 19:35:26 | 001,187,072 | ---- | M] (Lavasoft Limited) -- D:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe PRC - [2011.08.31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) -- d:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2011.04.29 23:32:54 | 000,013,592 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe PRC - [2011.04.29 23:32:50 | 000,284,440 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe PRC - [2010.12.07 15:32:24 | 001,097,344 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\TurboV EVO\TurboVHelp.exe PRC - [2010.12.02 09:37:22 | 001,425,536 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\AI Suite II.exe PRC - [2010.12.02 03:15:14 | 000,915,584 | R--- | M] () -- C:\Program Files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe PRC - [2010.11.26 20:50:04 | 002,931,328 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe PRC - [2010.11.17 02:53:16 | 000,113,288 | ---- | M] (Renesas Electronics Corporation) -- C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe PRC - [2010.11.16 09:38:22 | 000,654,464 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\iPhone Simulator\pnSvc.exe PRC - [2010.11.10 10:23:44 | 001,204,656 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\EPU\EPUHelp.exe PRC - [2010.11.09 09:34:26 | 002,529,920 | R--- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\Simulator\EC Simulator.exe PRC - [2010.11.03 10:30:14 | 000,918,144 | R--- | M] () -- C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe PRC - [2010.10.21 10:52:26 | 000,586,880 | R--- | M] () -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe PRC - [2010.10.12 15:39:50 | 001,115,776 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\DIGI+ VRM\VRMHelp.exe PRC - [2010.09.28 14:47:10 | 000,252,544 | R--- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\Simulator\AsShellProcess.exe PRC - [2010.09.24 20:29:32 | 001,115,776 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\AlertHelper.exe PRC - [2010.06.30 15:46:32 | 000,121,456 | ---- | M] () -- C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DTSRVC.exe PRC - [2010.06.30 15:46:30 | 001,264,240 | ---- | M] (Portrait Displays, Inc) -- C:\Program Files (x86)\Acer Display\eDisplay Management\DTHtml.exe PRC - [2010.06.30 15:46:08 | 000,129,648 | ---- | M] () -- C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\AM\dtsslsrv.exe PRC - [2010.05.13 15:34:48 | 000,711,792 | ---- | M] () -- C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\floater.exe PRC - [2010.05.13 15:34:42 | 000,674,928 | ---- | M] () -- C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe PRC - [2010.04.16 14:34:34 | 000,109,168 | ---- | M] (Portrait Displays, Inc.) -- C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe PRC - [2010.02.23 10:01:28 | 000,329,168 | ---- | M] () -- C:\Program Files (x86)\Verbindungsassistent\WTGService.exe PRC - [2010.01.15 13:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe PRC - [2010.01.08 13:15:24 | 001,118,208 | ---- | M] (Realtek Semiconductor Corp.) -- C:\Program Files (x86)\Realtek\RTL8187 Wireless LAN Utility\RtWlan.exe PRC - [2009.12.07 12:49:24 | 000,040,960 | ---- | M] (Realtek) -- C:\Program Files (x86)\Realtek\RTL8187 Wireless LAN Utility\RtlService.exe PRC - [2009.03.05 16:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- D:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe PRC - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- D:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe PRC - [2009.01.16 11:12:28 | 000,221,184 | ---- | M] () -- C:\Windows\system\cm106eye.exe ========== Modules (No Company Name) ========== MOD - [2011.10.29 14:29:11 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\b2622080e047040fa044dd21a04ff10d\System.Runtime.Remoting.ni.dll MOD - [2011.10.29 14:29:11 | 000,014,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\33cecc66284ef59208b639ec72b0f565\IAStorCommon.ni.dll MOD - [2011.10.29 14:29:10 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\d7a64c28cf0c90e6c48af4f7d6f9ed41\WindowsBase.ni.dll MOD - [2011.10.29 14:29:09 | 000,492,544 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\e8339b699235ebf2f904ccb8383de342\IAStorUtil.ni.dll MOD - [2011.10.29 14:29:08 | 012,433,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6e592e424a204aafeadbe22b6b31b9db\System.Windows.Forms.ni.dll MOD - [2011.10.29 14:29:04 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\3b2cfd85528a27eb71dc41d8067359a1\System.Drawing.ni.dll MOD - [2011.10.29 14:28:50 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\130ad4d9719e566ca933ac7158a04203\System.Xml.ni.dll MOD - [2011.10.29 14:28:48 | 007,963,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\abab08afa60a6f06bdde0fcc9649c379\System.ni.dll MOD - [2011.10.29 14:28:48 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\2d5bcbeb9475ef62189f605bcca1cec6\System.Configuration.ni.dll MOD - [2011.10.29 14:28:44 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll MOD - [2011.04.12 08:43:06 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll MOD - [2010.12.03 15:12:48 | 001,027,072 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Probe_II\ProbeII.dll MOD - [2010.12.02 16:28:36 | 000,143,360 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\AssistFunc.dll MOD - [2010.12.01 11:33:32 | 001,244,672 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\MyLogo\MyLogo.dll MOD - [2010.11.19 09:55:00 | 001,246,208 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Settings\Settings.dll MOD - [2010.11.19 09:53:34 | 000,963,584 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\BarGadget\BarGadget.dll MOD - [2010.11.16 09:37:20 | 000,086,016 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\iPhone Simulator\AsNetlib.dll MOD - [2010.11.13 00:26:08 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll MOD - [2010.11.11 02:09:26 | 000,703,488 | R--- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\Simulator\CpuFreq.dll MOD - [2010.10.15 16:40:30 | 001,031,680 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Update\Update.dll MOD - [2010.09.27 19:51:16 | 001,607,168 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Sensor Graph\SensorGraph.dll MOD - [2010.09.27 19:51:12 | 000,881,664 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Sensor\Sensor.dll MOD - [2010.09.19 20:52:50 | 000,094,208 | ---- | M] () -- C:\Windows\SysWOW64\IccLibDll.dll MOD - [2010.08.23 03:17:40 | 000,662,016 | R--- | M] () -- C:\Program Files (x86)\ASUS\AAHM\1.00.13\aaHMLib.dll MOD - [2010.08.06 17:13:48 | 000,886,272 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\TabGadget\TabGadget.dll MOD - [2010.08.06 17:11:20 | 000,850,944 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Splitter\Splitter.dll MOD - [2010.07.30 10:28:32 | 000,670,208 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\iPhone Simulator\asacpiEx.dll MOD - [2010.07.15 19:04:40 | 000,661,504 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\iPhone Simulator\aaHMLib.dll MOD - [2010.07.15 19:04:40 | 000,253,952 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\iPhone Simulator\pngio.dll MOD - [2010.07.15 19:04:40 | 000,208,896 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\iPhone Simulator\ImageHelper.dll MOD - [2010.06.30 15:46:26 | 000,084,592 | ---- | M] () -- C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\CC\gui.dll MOD - [2010.06.30 15:37:38 | 000,172,032 | ---- | M] () -- C:\Program Files (x86)\Common Files\Portrait Displays\Shared\PresetsCOM.dll MOD - [2010.06.23 04:54:36 | 000,114,688 | R--- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\Simulator\AssistFunc.dll MOD - [2010.06.21 14:21:22 | 000,208,896 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\Sensor\AlertHelper\ImageHelper.dll MOD - [2010.06.21 14:21:22 | 000,208,896 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ImageHelper.dll MOD - [2010.05.13 15:34:48 | 000,711,792 | ---- | M] () -- C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\floater.exe MOD - [2010.05.13 15:34:42 | 000,674,928 | ---- | M] () -- C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe MOD - [2010.02.24 09:56:40 | 000,661,504 | R--- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\Simulator\aaHMLib.dll MOD - [2009.08.12 19:15:52 | 000,253,952 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\pngio.dll MOD - [2009.05.21 09:14:14 | 000,253,952 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\TurboV EVO\pngio.dll MOD - [2009.05.21 03:14:14 | 000,053,248 | ---- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\TurboV EVO\HookKey32.dll MOD - [2009.01.16 11:12:28 | 000,221,184 | ---- | M] () -- C:\Windows\system\cm106eye.exe MOD - [2007.10.31 10:51:00 | 000,061,440 | R--- | M] () -- C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\Simulator\AsMultiLang.dll MOD - [2006.09.13 06:08:00 | 000,491,520 | ---- | M] () -- C:\Windows\system\cmau106.dll ========== Win32 Services (SafeList) ========== SRV:64bit: - [2011.10.26 03:00:58 | 000,204,288 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV:64bit: - [2011.10.18 17:01:08 | 000,502,032 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee\VirusScan\mcods.exe -- (McODS) SRV:64bit: - [2011.10.18 14:32:28 | 000,161,168 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Windows\SysNative\mfevtps.exe -- (mfevtp) SRV:64bit: - [2011.10.18 14:23:24 | 000,208,536 | ---- | M] () [Unknown | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe -- (mfefire) SRV:64bit: - [2011.10.18 14:23:06 | 000,199,272 | ---- | M] () [Unknown | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe -- (McShield) SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (MSK80Service) SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McProxy) SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McNASvc) SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McNaiAnn) SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (mcmscsvc) SRV:64bit: - [2011.01.27 18:28:20 | 000,249,936 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe -- (McMPFSvc) SRV - [2011.12.08 18:39:32 | 000,419,624 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2011.11.03 19:25:09 | 002,358,656 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6) SRV - [2011.10.28 19:35:26 | 002,152,152 | ---- | M] (Lavasoft Limited) [Auto | Running] -- D:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service) SRV - [2011.08.31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- d:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2011.06.08 12:02:00 | 000,633,856 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011.04.29 23:32:54 | 000,013,592 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R) SRV - [2011.03.21 16:19:16 | 001,845,248 | ---- | M] (Locktime Software) [Auto | Running] -- D:\Program Files\NetLimiter 3\nlsvc.exe -- (nlsvc) SRV - [2010.12.02 03:15:14 | 000,915,584 | R--- | M] () [Auto | Running] -- C:\Program Files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe -- (asHmComSvc) SRV - [2010.11.03 10:30:14 | 000,918,144 | R--- | M] () [Auto | Running] -- C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe -- (asComSvc) SRV - [2010.10.27 15:18:52 | 000,052,896 | ---- | M] (Atheros Commnucations) [Auto | Running] -- C:\Program Files (x86)\Bluetooth Suite\adminservice.exe -- (AtherosSvc) SRV - [2010.10.21 10:52:26 | 000,586,880 | R--- | M] () [Auto | Running] -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe -- (AsSysCtrlService) SRV - [2010.06.30 15:46:32 | 000,121,456 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DTSRVC.exe -- (DTSRVC) SRV - [2010.06.30 15:46:08 | 000,129,648 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\AM\dtsslsrv.exe -- (Asset Management Daemon) SRV - [2010.06.25 18:07:20 | 000,117,264 | ---- | M] (CACE Technologies, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WinPcap\rpcapd.exe -- (rpcapd) Remote Packet Capture Protocol v.0 (experimental) SRV - [2010.04.16 14:34:34 | 000,109,168 | ---- | M] (Portrait Displays, Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe -- (PdiService) SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.02.23 10:01:28 | 000,329,168 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Verbindungsassistent\WTGService.exe -- (WTGService) SRV - [2010.01.15 13:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService) SRV - [2009.12.07 12:49:24 | 000,040,960 | ---- | M] (Realtek) [Auto | Running] -- C:\Program Files (x86)\Realtek\RTL8187 Wireless LAN Utility\RtlService.exe -- (Realtek87B) SRV - [2009.07.13 18:15:38 | 000,093,848 | ---- | M] (SiSoftware) [On_Demand | Stopped] -- d:\Program Files\SiSoftware\SiSoftware Sandra Lite 2011.SP4\RpcAgentSrv.exe -- (SandraAgentSrv) SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- D:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService) ========== Driver Services (SafeList) ========== DRV:64bit: - [2011.12.06 11:40:33 | 000,230,864 | ---- | M] (TrueCrypt Foundation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\truecrypt.sys -- (truecrypt) DRV:64bit: - [2011.10.28 19:35:28 | 000,069,376 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\Lbd.sys -- (Lbd) DRV:64bit: - [2011.10.26 04:05:10 | 010,496,512 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag) DRV:64bit: - [2011.10.26 02:21:58 | 000,326,656 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap) DRV:64bit: - [2011.10.15 13:16:16 | 000,647,080 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\Windows\SysNative\drivers\mfehidk.sys -- (mfehidk) DRV:64bit: - [2011.10.15 13:16:16 | 000,481,768 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\Windows\SysNative\drivers\mfefirek.sys -- (mfefirek) DRV:64bit: - [2011.10.15 13:16:16 | 000,284,648 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\Windows\SysNative\drivers\mfewfpk.sys -- (mfewfpk) DRV:64bit: - [2011.10.15 13:16:16 | 000,229,528 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\Windows\SysNative\drivers\mfeavfk.sys -- (mfeavfk) DRV:64bit: - [2011.10.15 13:16:16 | 000,160,280 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\Windows\SysNative\drivers\mfeapfk.sys -- (mfeapfk) DRV:64bit: - [2011.10.15 13:16:16 | 000,100,912 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Stopped] -- C:\Windows\SysNative\drivers\mferkdet.sys -- (mferkdet) DRV:64bit: - [2011.10.15 13:16:16 | 000,075,808 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mfenlfk.sys -- (mfenlfk) DRV:64bit: - [2011.10.15 13:16:16 | 000,065,264 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\Windows\SysNative\drivers\cfwids.sys -- (cfwids) DRV:64bit: - [2011.08.31 17:00:50 | 000,025,416 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector) DRV:64bit: - [2011.08.01 14:59:06 | 000,045,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64) DRV:64bit: - [2011.07.19 09:39:45 | 000,116,864 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard) DRV:64bit: - [2011.07.19 09:39:45 | 000,116,224 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbfake.sys -- (hwusbfake) DRV:64bit: - [2011.07.19 09:39:45 | 000,112,896 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewsercd.sys -- (ewsercd) DRV:64bit: - [2011.06.10 06:34:52 | 000,539,240 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:64bit: - [2011.06.06 23:07:00 | 000,231,440 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService) DRV:64bit: - [2011.04.26 10:07:36 | 000,557,848 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:64bit: - [2011.03.21 16:44:30 | 000,033,416 | ---- | M] (Locktime Software) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nlndis.sys -- (NLNdisPT) DRV:64bit: - [2011.03.21 16:44:30 | 000,033,416 | ---- | M] (Locktime Software) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nlndis.sys -- (NLNdisMP) DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.12.10 06:50:36 | 000,181,248 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc) DRV:64bit: - [2010.12.10 06:50:36 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub) DRV:64bit: - [2010.11.22 08:09:06 | 000,303,408 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mv91xx.sys -- (mv91xx) DRV:64bit: - [2010.11.21 04:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.11.21 04:23:48 | 000,032,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser.sys -- (usbser) DRV:64bit: - [2010.11.21 04:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.21 04:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD) DRV:64bit: - [2010.10.27 14:50:28 | 000,301,680 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_a2dp.sys -- (BTATH_A2DP) DRV:64bit: - [2010.10.27 14:50:28 | 000,279,152 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btfilter.sys -- (BtFilter) DRV:64bit: - [2010.10.27 14:50:28 | 000,203,624 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_hcrp.sys -- (BTATH_HCRP) DRV:64bit: - [2010.10.27 14:50:28 | 000,156,520 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_rcp.sys -- (BTATH_RCP) DRV:64bit: - [2010.10.27 14:50:28 | 000,058,992 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_lwflt.sys -- (BTATH_LWFLT) DRV:64bit: - [2010.10.27 14:50:28 | 000,055,336 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AthDfu.sys -- (ATHDFU) DRV:64bit: - [2010.10.27 14:50:28 | 000,038,248 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_flt.sys -- (AthBTPort) DRV:64bit: - [2010.10.27 14:50:28 | 000,031,080 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_bus.sys -- (BTATH_BUS) DRV:64bit: - [2010.10.19 15:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) Intel(R) DRV:64bit: - [2010.08.17 18:28:32 | 000,026,136 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ICCWDT.sys -- (ICCWDT) Intel(R) Watchdog Timer Driver (Intel(R) WDT) DRV:64bit: - [2010.06.25 18:07:26 | 000,035,344 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\npf.sys -- (NPF) DRV:64bit: - [2010.04.16 14:34:06 | 000,020,592 | ---- | M] (Portrait Displays, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\PdiPorts.sys -- (PdiPorts) DRV:64bit: - [2010.01.07 10:20:22 | 000,448,512 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtl8187.sys -- (RTL8187) DRV:64bit: - [2009.10.01 11:04:54 | 001,307,648 | ---- | M] (C-Media Electronics Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CM10664.sys -- (USBMULCD) DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.07.14 01:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam) DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2008.08.28 11:44:42 | 000,025,600 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys -- (pccsmcfd) DRV - [2011.12.03 14:37:48 | 000,017,152 | ---- | M] () [Kernel | On_Demand | Running] -- D:\Program Files (x86)\Lavasoft\Ad-Aware\kernexplorer64.sys -- (Lavasoft Kernexplorer) DRV - [2011.07.22 09:43:25 | 000,116,224 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\ewusbfake.sys -- (hwusbfake) DRV - [2011.07.22 09:43:25 | 000,112,896 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\ewsercd.sys -- (ewsercd) DRV - [2011.03.21 16:44:28 | 000,088,200 | ---- | M] (Locktime Software) [Kernel | System | Running] -- D:\Program Files\NetLimiter 3\nltdi.sys -- (nltdi) DRV - [2009.08.07 22:46:56 | 000,023,112 | ---- | M] (SiSoftware) [Kernel | On_Demand | Stopped] -- d:\Program Files\SiSoftware\SiSoftware Sandra Lite 2011.SP4\WNt500x64\sandra.sys -- (SANDRA) DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) DRV - [2008.12.13 10:28:20 | 000,116,864 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\ewusbmdm.sys -- (hwdatacard) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 5C 38 7E 4F A1 6C CC 01 [binary data] IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultengine: "Search-Results" FF - prefs.js..browser.search.defaultenginename: "Search-Results" FF - prefs.js..browser.search.order.1: "Search-Results" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "www.google.de" FF - prefs.js..keyword.URL: "hxxp://websearch.search-results.com/redirect?client=ff&src=kw&tb=STC-SRS&o=41648033&locale=de_DE&apn_uid=27585E9B-37D2-4465-BA12-110E4DBA700F&apn_ptnrs=96&apn_sauid=C6E5D6B3-9E65-46E4-9D52-6E7458A9F170&apn_dtid=YYYYYYYYDE&q=" FF - prefs.js..network.proxy.ftp: "46.249.35.176" FF - prefs.js..network.proxy.ftp_port: 80 FF - prefs.js..network.proxy.http: "46.249.35.176" FF - prefs.js..network.proxy.http_port: 80 FF - prefs.js..network.proxy.socks: "46.249.35.176" FF - prefs.js..network.proxy.socks_port: 80 FF - prefs.js..network.proxy.ssl: "46.249.35.176" FF - prefs.js..network.proxy.ssl_port: 80 FF - prefs.js..network.proxy.type: 1 FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF:64bit: - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL () FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\progra~2\mcafee\msc\npmcsn~1.dll () FF - HKLM\Software\MozillaPlugins\@mcafee.com/MVT: C:\Program Files (x86)\McAfee\Supportability\MVT\npmvtplugin.dll (McAfee, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Ghost\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Ghost\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{D19CA586-DD6C-4a0a-96F8-14644F340D60}: C:\Program Files (x86)\Common Files\McAfee\SystemCore [2011.11.22 20:20:50 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.12.12 08:16:13 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.12.09 18:06:36 | 000,000,000 | ---D | M] [2011.12.04 16:10:47 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ghost\AppData\Roaming\mozilla\Extensions [2011.12.11 17:27:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\gcl7g18u.default\extensions [2011.10.24 21:23:31 | 000,000,000 | ---D | M] (Screenshot Pimp) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\gcl7g18u.default\extensions\{056d0610-e44d-11df-bccf-0800200c9a66} [2011.11.25 22:43:52 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\gcl7g18u.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b} [2011.12.08 23:04:46 | 000,000,000 | ---D | M] (Personas Rotator) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\gcl7g18u.default\extensions\{6e73f6b7-b9ab-44b8-b744-6393e3c2e351} [2011.11.19 09:42:32 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\gcl7g18u.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2011.11.20 15:41:38 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\gcl7g18u.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2011.12.03 20:48:36 | 000,000,000 | ---D | M] (BitDefender QuickScan) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\gcl7g18u.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2011.11.05 12:53:06 | 000,000,000 | ---D | M] (Ghostery) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\gcl7g18u.default\extensions\firefox@ghostery.com [2011.11.26 22:22:36 | 000,000,000 | ---D | M] (Low Quality Flash) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\gcl7g18u.default\extensions\low_quality_flash@pie2k.com [2011.12.07 22:55:27 | 000,000,000 | ---D | M] (samfind Bookmarks Bar) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\gcl7g18u.default\extensions\sam@samfind.com [2011.07.27 14:46:02 | 000,000,000 | ---D | M] (startup.service) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\gcl7g18u.default\extensions\startup.service@mozilla.com [2011.12.12 08:16:13 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2011.11.13 18:37:08 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2011.10.06 15:38:28 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} [2011.12.09 17:46:22 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} [2011.11.22 20:20:50 | 000,000,000 | ---D | M] (McAfee ScriptScan for Firefox) -- C:\PROGRAM FILES (X86)\COMMON FILES\MCAFEE\SYSTEMCORE () (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{1280606B-2510-4FE0-97EF-9B5A22EAFE30}.XPI () (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{1A2D0EC4-75F5-4C91-89C4-3656F6E44B68}.XPI () (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{37E4D8EA-8BDA-4831-8EA1-89053939A250}.XPI () (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{3D7EB24F-2740-49DF-8937-200B1CC08F8A}.XPI () (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{477C4C36-24EB-11DA-94D4-00E08161165F}.XPI () (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{7C9AE782-DB21-4E40-81FB-AD8A53A6233A}.XPI () (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{CE6E6E3B-84DD-4CAC-9F63-8D2AE4F30A4B}.XPI () (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI () (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{D40F5E7B-D2CF-4856-B441-CC613EEFFBE3}.XPI () (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{D4DD63FA-01E4-46A7-B6B1-EDAB7D6AD389}.XPI () (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{DDC359D1-844A-42A7-9AA1-88A850A938A8}.XPI () (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\{E10A6337-382E-4FE6-96DE-936ADC34DD04}.XPI () (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\ADBLOCKPOPUPS@JESSEHAKANEN.NET.XPI () (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\ADDON@MUSIC-CLIPS.NET.XPI () (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\ADONIS.CUHK@GMAIL.COM.XPI () (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\ANTICONTAINER@DOWNTHEMALL.NET.XPI () (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\AUTOPAGER@MOZILLA.ORG.XPI () (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\INFO@CONVERT2MP3.NET.XPI () (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\INFO@YOUTUBE-MP3.ORG.XPI () (No name found) -- C:\USERS\GHOST\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\GCL7G18U.DEFAULT\EXTENSIONS\PERSONAS@CHRISTOPHER.BEARD.XPI [2011.11.21 05:21:43 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2011.04.14 13:01:38 | 000,024,376 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\mozilla firefox\components\Scriptff.dll [2011.12.09 17:46:17 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2011.07.11 22:48:12 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll [2011.11.21 02:17:49 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.11.21 02:09:48 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2011.11.21 02:17:49 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2011.11.21 02:17:49 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2011.09.11 11:28:14 | 000,002,503 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\SearchResults.xml [2011.11.21 02:17:49 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2011.11.21 02:17:49 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms} CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Ghost\AppData\Local\Google\Chrome\Application\15.0.874.121\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll CHR - plugin: Java Deployment Toolkit 6.0.290.11 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll CHR - plugin: Java(TM) Platform SE 6 U29 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Users\Ghost\AppData\Local\Google\Chrome\Application\15.0.874.121\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Disabled) = C:\Users\Ghost\AppData\Local\Google\Chrome\Application\15.0.874.121\pdf.dll CHR - plugin: BitDefender QuickScan (Enabled) = C:\Users\Ghost\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie\0.9.9.100_0\npqscan.dll CHR - plugin: Winamp Application Detector (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll CHR - plugin: McAfee Virtual Technician (Enabled) = C:\Program Files (x86)\McAfee\Supportability\MVT\npmvtplugin.dll CHR - plugin: McAfee SecurityCenter (Enabled) = c:\progra~2\mcafee\msc\npmcsn~1.dll CHR - plugin: Default Plug-in (Enabled) = default_plugin CHR - Extension: WOT = C:\Users\Ghost\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp\1.2.9_0\ CHR - Extension: BitDefender QuickScan = C:\Users\Ghost\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie\0.9.9.100_0\ O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (no name) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - No CLSID value found. O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O2:64bit: - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Programme\Common Files\McAfee\SystemCore\ScriptSn.20111122201814.dll (McAfee, Inc.) O2:64bit: - BHO: (no name) - {9D717F81-9148-4f12-8568-69135F087DB0} - No CLSID value found. O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (AC-Pro) - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Program Files (x86)\AutocompletePro\AutocompletePro.dll (SimplyGen) O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\Programme\McAfee\MSK\mskapbho.dll () O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation) O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20111122201814.dll (McAfee, Inc.) O2 - BHO: (CIESpeechBHO Class) - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations) O2 - BHO: (no name) - {9D717F81-9148-4f12-8568-69135F087DB0} - No CLSID value found. O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation) O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - {99079a25-328f-4bd4-be04-00955acaa0a7} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O4:64bit: - HKLM..\Run: [Cm106Sound] C:\Windows\Syswow64\cm106.dll (C-Media Corporation) O4:64bit: - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation) O4 - HKLM..\Run: [ASUS ShellProcess Execute] C:\Program Files (x86)\ASUS\AI Suite II\ASUS Mobilink\Simulator\AsShellProcess.exe (ASUSTeK Computer Inc.) O4 - HKLM..\Run: [DT ACR] C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DT_startup.exe () O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.) O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation) O4 - HKLM..\Run: [PivotSoftware] C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\Pivot_startup.exe () O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKCU..\Run: [ccleaner] C:\Program Files\CCleaner\CCleaner64.exe (Piriform Ltd) O4 - HKCU..\Run: [NetLimiter] D:\Program Files\NetLimiter 3\NLClientApp.exe (Locktime Software) O4 - HKCU..\Run: [SpybotSD TeaTimer] d:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~3\Office14\ONBttnIE.dll/105 File not found O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000 File not found O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~3\Office14\ONBttnIE.dll/105 File not found O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000 File not found O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - Reg Error: Value error. File not found O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations) O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O15 - HKCU\..Trusted Domains: internet ([]about in Trusted sites) O15 - HKCU\..Trusted Domains: mcafee.com ([]http in Trusted sites) O15 - HKCU\..Trusted Domains: mcafee.com ([]https in Trusted sites) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6C802738-AE9D-4E6D-A478-99D6D0B66991}: DhcpNameServer = 192.168.2.1 O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18:64bit: - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Programme\McAfee\MSC\McSnIePl64.dll (McAfee, Inc.) O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\progra~2\mcafee\msc\mcsniepl.dll (McAfee, Inc.) O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\WIA6EB~1\Datamngr\x64\datamngr.dll) - File not found O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\WIA6EB~1\Datamngr\x64\IEBHO.dll) - File not found O20 - AppInit_DLLs: (C:\PROGRA~2\WIA6EB~1\Datamngr\datamngr.dll) - File not found O20 - AppInit_DLLs: (C:\PROGRA~2\WIA6EB~1\Datamngr\IEBHO.dll) - File not found O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: GinaDLL - (C:\Windows\SYSTEM32\RtlGina\RtlGina.DLL) - File not found O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.02.09 14:59:36 | 000,000,000 | RH-D | M] - G:\autorun -- [ FAT32 ] O32 - AutoRun File - [2002.10.17 09:56:50 | 000,000,036 | RH-- | M] () - G:\Autorun.inf.bak -- [ FAT32 ] O33 - MountPoints2\{80b033ea-b1e1-11e0-909f-f46d049c99d9}\Shell - "" = AutoRun O33 - MountPoints2\{80b033ea-b1e1-11e0-909f-f46d049c99d9}\Shell\AutoRun\command - "" = H:\.\Autorun.exe AUTORUN=1 O33 - MountPoints2\{fb99ba64-b1d1-11e0-9f0c-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{fb99ba64-b1d1-11e0-9f0c-806e6f6e6963}\Shell\AutoRun\command - "" = F:\.\Bin\ASSETUP.exe O34 - HKLM BootExecute: (autocheck autochk *) O34 - HKLM BootExecute: (lsdelete) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP MsConfig:64bit - StartUpFolder: C:^Users^Ghost^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.3.lnk - D:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe - () MsConfig:64bit - StartUpFolder: C:^Users^Ghost^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^WISO Mein Steuer-Sparbuch heute.lnk - C:\PROGRA~2\WISO\STEUER~1\MSHAKT~1.EXE - () MsConfig:64bit - StartUpReg: *D7 - hkey= - key= - C:\Windows\SysNative\cmd.exe (Microsoft Corporation) MsConfig:64bit - StartUpReg: AthBtTray - hkey= - key= - C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe (Atheros Commnucations) MsConfig:64bit - StartUpReg: AtherosBtStack - hkey= - key= - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe (Atheros Communications) MsConfig:64bit - StartUpReg: BCSSync - hkey= - key= - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation) MsConfig:64bit - StartUpReg: d: - hkey= - key= - Reg Error: Value error. File not found MsConfig:64bit - StartUpReg: Google Update - hkey= - key= - C:\Users\Ghost\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.) MsConfig:64bit - StartUpReg: HP Software Update - hkey= - key= - C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe (Hewlett-Packard) MsConfig:64bit - StartUpReg: Malwarebytes' Anti-Malware - hkey= - key= - d:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) MsConfig:64bit - StartUpReg: OfficeSyncProcess - hkey= - key= - C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE (Microsoft Corporation) MsConfig:64bit - StartUpReg: RtHDVCpl - hkey= - key= - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) MsConfig:64bit - StartUpReg: StartCCC - hkey= - key= - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) MsConfig:64bit - StartUpReg: Steam - hkey= - key= - C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation) MsConfig:64bit - StartUpReg: WinampAgent - hkey= - key= - D:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.) MsConfig:64bit - State: "services" - Reg Error: Key error. CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2011.12.12 20:51:50 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Ghost\Desktop\OTL.exe [2011.12.12 20:07:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee [2011.12.12 07:34:21 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis [2011.12.12 07:33:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trend Micro [2011.12.11 21:54:10 | 000,000,000 | ---D | C] -- C:\Program Files\HashTab Shell Extension [2011.12.10 20:45:16 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\EVEMon [2011.12.10 12:43:56 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI [2011.12.10 12:36:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD APP [2011.12.10 12:36:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center [2011.12.10 12:25:54 | 000,000,000 | ---D | C] -- C:\ATI [2011.12.10 12:10:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TweakNow PowerPack 2011 [2011.12.10 12:08:43 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\TweakNow PowerPack 2011 [2011.12.09 21:39:31 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Local\Locktime [2011.12.09 21:36:46 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\Wireshark [2011.12.09 21:24:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPcap [2011.12.09 21:24:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WinPcap [2011.12.09 21:12:34 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NetLimiter 3 [2011.12.09 21:10:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Locktime [2011.12.09 18:06:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe [2011.12.09 18:06:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe [2011.12.09 17:46:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java [2011.12.09 16:56:48 | 000,000,000 | ---D | C] -- C:\Program Files\Java [2011.12.07 19:27:15 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Audials USB 8 [2011.12.07 18:51:02 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Local\CrashRpt [2011.12.07 18:50:58 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Audials USB 9 [2011.12.07 18:36:54 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Local\RapidSolution [2011.12.06 11:41:11 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\TrueCrypt [2011.12.06 11:40:33 | 000,230,864 | ---- | C] (TrueCrypt Foundation) -- C:\Windows\SysNative\drivers\truecrypt.sys [2011.12.06 11:40:24 | 000,000,000 | ---D | C] -- C:\Program Files\TrueCrypt [2011.12.04 16:22:25 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\Malwarebytes [2011.12.04 16:21:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2011.12.04 16:21:00 | 000,025,416 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2011.12.04 12:21:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy [2011.12.03 23:40:19 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\QuickScan [2011.12.03 23:32:40 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\Opera [2011.12.03 23:32:40 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Local\Opera [2011.12.03 23:32:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Opera [2011.12.03 15:06:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Safer Networking [2011.12.03 14:37:48 | 000,055,384 | ---- | C] (Sunbelt Software) -- C:\Windows\SysNative\drivers\SBREDrv.sys [2011.12.03 14:36:18 | 000,069,376 | ---- | C] (Lavasoft AB) -- C:\Windows\SysNative\drivers\Lbd.sys [2011.12.03 14:35:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Lavasoft [2011.11.30 19:13:46 | 000,000,000 | ---D | C] -- C:\Users\Ghost\Documents\EVEMon_3264_2011-11-30 [2011.11.27 20:49:26 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\NetSpeedMonitor [2011.11.27 20:32:05 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\NetMeter [2011.11.27 20:31:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NetMeter [2011.11.22 18:20:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth [2011.11.20 15:44:25 | 000,000,000 | ---D | C] -- C:\Users\Ghost\dwhelper [2011.11.18 18:31:31 | 000,000,000 | ---D | C] -- C:\Windows\pss [2011.11.18 18:12:37 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\TeamViewer [2011.11.18 18:11:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TeamViewer [2011.11.18 16:44:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner [2011.11.18 16:44:38 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner [2011.11.18 16:39:54 | 000,131,072 | ---- | C] (FoolishIT.com) -- C:\Windows\goog.exe [2011.11.18 16:22:55 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\Booster [2011.07.19 15:18:48 | 001,802,976 | ---- | C] (CCP hf.) -- C:\Program Files (x86)\EVE_Premium_Setup_246350.exe [2011.07.19 15:13:16 | 003,504,060 | ---- | C] (battleclinic.com) -- C:\Program Files (x86)\EVEMon-install-1.3.4.2523.exe ========== Files - Modified Within 30 Days ========== [2011.12.12 21:04:00 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2438057823-3161982914-410875986-1000UA.job [2011.12.12 20:19:00 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.12.12 20:19:00 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.12.12 20:11:05 | 000,021,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.12.12 20:11:05 | 000,021,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.12.12 20:09:18 | 001,621,744 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2011.12.12 20:09:18 | 000,700,278 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2011.12.12 20:09:18 | 000,654,990 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2011.12.12 20:09:18 | 000,149,074 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2011.12.12 20:09:18 | 000,121,862 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2011.12.12 20:03:52 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.12.12 20:03:51 | 2129,297,407 | -HS- | M] () -- C:\hiberfil.sys [2011.12.12 19:34:38 | 000,437,312 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2011.12.12 19:06:54 | 000,000,000 | ---- | M] () -- C:\Users\Ghost\defogger_reenable [2011.12.12 19:04:00 | 000,001,068 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2438057823-3161982914-410875986-1000Core.job [2011.12.12 16:47:13 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Ghost\Desktop\OTL.exe [2011.12.12 08:16:13 | 000,001,138 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2011.12.12 07:53:34 | 000,003,288 | ---- | M] () -- C:\bootsqm.dat [2011.12.12 07:34:21 | 000,002,975 | ---- | M] () -- C:\Users\Ghost\Desktop\HiJackThis.lnk [2011.12.11 17:00:08 | 000,000,440 | ---- | M] () -- C:\Windows\tasks\vtscheduletask.job [2011.12.10 22:45:08 | 000,000,353 | ---- | M] () -- C:\Users\Ghost\AppData\Roaming\Network Meter_Settings.ini [2011.12.10 21:30:05 | 000,071,786 | ---- | M] () -- C:\Users\Ghost\Documents\EVEMon_Settings_3290.xml.bak [2011.12.10 20:45:11 | 000,071,849 | ---- | M] () -- C:\Users\Ghost\Documents\EVEMon_Settings_3289.xml.bak [2011.12.10 14:38:58 | 000,000,064 | ---- | M] () -- C:\Windows\SysWow64\rp_stats.dat [2011.12.10 14:38:58 | 000,000,044 | ---- | M] () -- C:\Windows\SysWow64\rp_rules.dat [2011.12.10 12:10:45 | 000,000,912 | ---- | M] () -- C:\Users\Public\Desktop\TweakNow PowerPack 2011.lnk [2011.12.10 12:04:02 | 000,011,296 | ---- | M] () -- C:\Users\Ghost\Documents\cc_20111210_120359.reg [2011.12.10 11:17:44 | 000,001,476 | ---- | M] () -- C:\Users\Ghost\Desktop\AudialsOne 8 USB starten.lnk [2011.12.10 10:46:48 | 000,000,000 | ---- | M] () -- C:\Windows\Path.idx [2011.12.10 10:45:16 | 001,025,648 | ---- | M] () -- C:\Windows\PE_Rom.dll [2011.12.10 10:33:07 | 000,000,128 | ---- | M] () -- C:\Users\Ghost\AppData\Roaming\Sandra.ldb [2011.12.09 21:36:46 | 000,000,218 | ---- | M] () -- C:\Users\Ghost\.recently-used.xbel [2011.12.09 21:31:04 | 000,000,164 | ---- | M] () -- C:\Users\Ghost\Documents\Whiresark_00001_20111209213058 [2011.12.09 21:30:50 | 000,000,033 | ---- | M] () -- C:\Users\Ghost\.gtk-bookmarks [2011.12.09 18:06:36 | 000,002,019 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk [2011.12.09 17:34:10 | 000,000,035 | ---- | M] () -- C:\Users\Public\Documents\AtherosServiceConfig.ini [2011.12.09 16:58:44 | 000,002,183 | ---- | M] () -- C:\Users\Ghost\Documents\Antwort auf Chip.com [2011.12.07 18:50:59 | 000,001,476 | ---- | M] () -- C:\Users\Ghost\Desktop\AudialsOne 9 USB starten.lnk [2011.12.06 11:40:33 | 000,230,864 | ---- | M] (TrueCrypt Foundation) -- C:\Windows\SysNative\drivers\truecrypt.sys [2011.12.06 11:40:33 | 000,000,875 | ---- | M] () -- C:\Users\Ghost\Desktop\TrueCrypt.lnk [2011.12.04 16:22:04 | 000,000,786 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.12.04 12:22:53 | 000,000,929 | ---- | M] () -- C:\Users\Ghost\Desktop\Spybot - Search & Destroy.lnk [2011.12.04 11:08:20 | 000,039,344 | ---- | M] () -- C:\Users\Ghost\Documents\cc_20111204_110817.reg [2011.12.03 23:32:35 | 000,001,829 | ---- | M] () -- C:\Users\Public\Desktop\Opera.lnk [2011.12.03 23:30:40 | 000,881,077 | ---- | M] () -- C:\Users\Ghost\AppData\Local\census.cache [2011.12.03 23:30:18 | 000,140,117 | ---- | M] () -- C:\Users\Ghost\AppData\Local\ars.cache [2011.12.03 23:10:30 | 000,000,036 | ---- | M] () -- C:\Users\Ghost\AppData\Local\housecall.guid.cache [2011.12.03 14:37:31 | 000,016,432 | ---- | M] () -- C:\Windows\SysNative\lsdelete.exe [2011.12.03 14:37:27 | 000,055,384 | ---- | M] (Sunbelt Software) -- C:\Windows\SysNative\drivers\SBREDrv.sys [2011.12.03 14:36:19 | 000,000,819 | ---- | M] () -- C:\Users\Public\Desktop\Ad-Aware.lnk [2011.11.27 21:06:08 | 000,001,308 | ---- | M] () -- C:\Users\Ghost\Desktop\Tcpview - Verknüpfung.lnk [2011.11.27 20:42:23 | 000,000,648 | ---- | M] () -- C:\Users\Public\Desktop\NetMeter.lnk [2011.11.27 12:18:20 | 000,001,591 | ---- | M] () -- C:\Users\Ghost\Desktop\eve - Testserver.lnk [2011.11.26 22:35:09 | 000,341,193 | ---- | M] () -- C:\Users\Ghost\Eve_PI_Diagrams_v1_4.pdf [2011.11.26 20:58:22 | 000,005,168 | ---- | M] () -- C:\Users\Ghost\Documents\cc_20111126_205818.reg [2011.11.25 20:32:10 | 000,121,331 | ---- | M] () -- C:\Users\Ghost\Anomalien_Eve.pdf [2011.11.22 18:20:37 | 000,002,212 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk [2011.11.19 11:10:05 | 000,000,744 | ---- | M] () -- C:\Users\Ghost\Documents\Der ist es jetzt aber.trs [2011.11.19 09:41:20 | 000,009,202 | ---- | M] () -- C:\Users\Ghost\Documents\cc_20111119_094117.reg [2011.11.18 18:12:16 | 000,001,162 | ---- | M] () -- C:\Users\Public\Desktop\TeamViewer 6.lnk [2011.11.18 17:51:22 | 000,000,942 | ---- | M] () -- C:\Windows\wiso.ini [2011.11.18 17:15:33 | 000,100,352 | ---- | M] () -- C:\Users\Ghost\Documents\cc_20111118_171527.reg [2011.11.18 16:44:41 | 000,000,822 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk [2011.11.18 16:39:41 | 000,131,072 | ---- | M] (FoolishIT.com) -- C:\Windows\goog.exe [2011.11.18 16:39:20 | 000,024,576 | ---- | M] () -- C:\Windows\SysNative\FoolishEventLogMsgHelper.dll ========== Files Created - No Company Name ========== [2011.12.12 19:34:33 | 000,437,312 | ---- | C] () -- C:\Windows\SysNative\FNTCACHE.DAT [2011.12.12 19:06:54 | 000,000,000 | ---- | C] () -- C:\Users\Ghost\defogger_reenable [2011.12.12 11:27:21 | 001,624,553 | ---- | C] () -- C:\img35.jpg [2011.12.12 08:16:13 | 000,001,150 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2011.12.12 08:16:13 | 000,001,138 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2011.12.12 07:53:34 | 000,003,288 | ---- | C] () -- C:\bootsqm.dat [2011.12.12 07:34:21 | 000,002,975 | ---- | C] () -- C:\Users\Ghost\Desktop\HiJackThis.lnk [2011.12.10 21:30:36 | 000,071,786 | ---- | C] () -- C:\Users\Ghost\Documents\EVEMon_Settings_3290.xml.bak [2011.12.10 21:27:40 | 000,071,849 | ---- | C] () -- C:\Users\Ghost\Documents\EVEMon_Settings_3289.xml.bak [2011.12.10 12:10:45 | 000,000,912 | ---- | C] () -- C:\Users\Public\Desktop\TweakNow PowerPack 2011.lnk [2011.12.10 12:04:01 | 000,011,296 | ---- | C] () -- C:\Users\Ghost\Documents\cc_20111210_120359.reg [2011.12.10 10:46:48 | 000,000,000 | ---- | C] () -- C:\Windows\Path.idx [2011.12.10 10:33:05 | 000,000,128 | ---- | C] () -- C:\Users\Ghost\AppData\Roaming\Sandra.ldb [2011.12.09 21:36:46 | 000,000,218 | ---- | C] () -- C:\Users\Ghost\.recently-used.xbel [2011.12.09 21:30:58 | 000,000,164 | ---- | C] () -- C:\Users\Ghost\Documents\Whiresark_00001_20111209213058 [2011.12.09 21:30:50 | 000,000,033 | ---- | C] () -- C:\Users\Ghost\.gtk-bookmarks [2011.12.09 21:23:05 | 000,000,679 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wireshark.lnk [2011.12.09 20:38:27 | 000,016,432 | ---- | C] () -- C:\Windows\SysNative\lsdelete.exe [2011.12.09 18:06:36 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk [2011.12.09 18:06:36 | 000,002,019 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk [2011.12.09 17:03:33 | 000,000,064 | ---- | C] () -- C:\Windows\SysWow64\rp_stats.dat [2011.12.09 17:03:33 | 000,000,044 | ---- | C] () -- C:\Windows\SysWow64\rp_rules.dat [2011.12.09 16:23:14 | 000,002,183 | ---- | C] () -- C:\Users\Ghost\Documents\Antwort auf Chip.com [2011.12.07 19:27:16 | 000,001,476 | ---- | C] () -- C:\Users\Ghost\Desktop\AudialsOne 8 USB starten.lnk [2011.12.07 18:50:59 | 000,001,476 | ---- | C] () -- C:\Users\Ghost\Desktop\AudialsOne 9 USB starten.lnk [2011.12.06 11:40:33 | 000,000,875 | ---- | C] () -- C:\Users\Ghost\Desktop\TrueCrypt.lnk [2011.12.04 16:22:04 | 000,000,786 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.12.04 12:22:53 | 000,000,929 | ---- | C] () -- C:\Users\Ghost\Desktop\Spybot - Search & Destroy.lnk [2011.12.04 11:08:18 | 000,039,344 | ---- | C] () -- C:\Users\Ghost\Documents\cc_20111204_110817.reg [2011.12.03 23:32:35 | 000,001,841 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk [2011.12.03 23:32:35 | 000,001,829 | ---- | C] () -- C:\Users\Public\Desktop\Opera.lnk [2011.12.03 23:30:40 | 000,881,077 | ---- | C] () -- C:\Users\Ghost\AppData\Local\census.cache [2011.12.03 23:30:18 | 000,140,117 | ---- | C] () -- C:\Users\Ghost\AppData\Local\ars.cache [2011.12.03 23:10:30 | 000,000,036 | ---- | C] () -- C:\Users\Ghost\AppData\Local\housecall.guid.cache [2011.12.03 14:36:19 | 000,000,819 | ---- | C] () -- C:\Users\Public\Desktop\Ad-Aware.lnk [2011.11.27 21:06:30 | 000,001,308 | ---- | C] () -- C:\Users\Ghost\Desktop\Tcpview - Verknüpfung.lnk [2011.11.27 20:42:23 | 000,000,648 | ---- | C] () -- C:\Users\Public\Desktop\NetMeter.lnk [2011.11.27 12:17:13 | 000,001,591 | ---- | C] () -- C:\Users\Ghost\Desktop\eve - Testserver.lnk [2011.11.26 22:35:09 | 000,341,193 | ---- | C] () -- C:\Users\Ghost\Eve_PI_Diagrams_v1_4.pdf [2011.11.26 20:58:20 | 000,005,168 | ---- | C] () -- C:\Users\Ghost\Documents\cc_20111126_205818.reg [2011.11.25 20:32:51 | 000,121,331 | ---- | C] () -- C:\Users\Ghost\Anomalien_Eve.pdf [2011.11.22 18:20:37 | 000,002,212 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk [2011.11.19 09:41:18 | 000,009,202 | ---- | C] () -- C:\Users\Ghost\Documents\cc_20111119_094117.reg [2011.11.18 18:12:16 | 000,001,174 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 6.lnk [2011.11.18 18:12:16 | 000,001,162 | ---- | C] () -- C:\Users\Public\Desktop\TeamViewer 6.lnk [2011.11.18 17:15:30 | 000,100,352 | ---- | C] () -- C:\Users\Ghost\Documents\cc_20111118_171527.reg [2011.11.18 16:44:41 | 000,000,822 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk [2011.11.18 16:39:20 | 000,024,576 | ---- | C] () -- C:\Windows\SysNative\FoolishEventLogMsgHelper.dll [2011.10.26 02:38:38 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat [2011.10.26 02:38:38 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat [2011.10.25 21:21:48 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OpenVideo.dll [2011.10.25 21:21:34 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OVDecoder.dll [2011.09.16 21:27:56 | 000,000,275 | ---- | C] () -- C:\Users\Ghost\AppData\Local\HamsterVideoConverterSettings.cfg [2011.09.12 23:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat [2011.08.08 18:53:05 | 001,598,638 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2011.07.28 18:22:32 | 000,000,412 | ---- | C] () -- C:\Users\Ghost\AppData\Roaming\All CPU Meter_Settings.ini [2011.07.28 17:42:14 | 000,000,353 | ---- | C] () -- C:\Users\Ghost\AppData\Roaming\Network Meter_Settings.ini [2011.07.28 12:19:46 | 001,025,648 | ---- | C] () -- C:\Windows\PE_Rom.dll [2011.07.28 12:10:12 | 000,094,208 | ---- | C] () -- C:\Windows\SysWow64\IccLibDll.dll [2011.07.28 12:07:32 | 000,030,436 | ---- | C] () -- C:\Windows\Ascd_log.ini [2011.07.28 12:07:12 | 000,013,440 | R--- | C] () -- C:\Windows\SysWow64\drivers\AsIO.sys [2011.07.28 12:07:11 | 000,011,832 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp64.sys [2011.07.23 20:25:01 | 000,143,360 | ---- | C] () -- C:\Windows\Vmix106.dll [2011.07.23 20:24:45 | 000,000,604 | ---- | C] () -- C:\Windows\Cm106.ini.cfl [2011.07.23 20:20:05 | 000,003,059 | ---- | C] () -- C:\Windows\Cm106.ini.cfg [2011.07.23 20:20:05 | 000,001,085 | ---- | C] () -- C:\Windows\Cm106.ini.imi [2011.07.22 13:31:56 | 000,000,942 | ---- | C] () -- C:\Windows\wiso.ini [2011.07.20 20:40:34 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI [2011.07.19 21:25:56 | 000,005,120 | ---- | C] () -- C:\Users\Ghost\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.07.19 16:50:27 | 011,137,024 | ---- | C] () -- C:\Users\Ghost\AppData\Roaming\Sandra.mdb [2011.07.19 15:13:16 | 014,521,609 | ---- | C] () -- C:\Program Files (x86)\evepremiumpatch264377-267203_m.exe [2011.07.19 09:49:05 | 000,451,072 | ---- | C] () -- C:\Windows\SysWow64\ISSRemoveSP.exe [2011.07.19 09:31:35 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2011.07.19 08:47:02 | 000,007,432 | ---- | C] () -- C:\Windows\SysWow64\Machnm32.sys [2011.07.19 07:50:37 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini [2011.07.19 07:50:32 | 000,027,946 | ---- | C] () -- C:\Windows\Ascd_tmp.ini [2010.08.03 06:21:24 | 000,014,464 | R--- | C] () -- C:\Windows\SysWow64\drivers\AsUpIO.sys [2010.07.08 11:10:32 | 000,000,964 | ---- | C] () -- C:\Windows\cm106.ini [2010.06.25 18:03:12 | 000,053,299 | ---- | C] () -- C:\Windows\SysWow64\pthreadVC.dll [2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT [2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat [2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat [2009.04.02 13:30:14 | 000,010,296 | ---- | C] () -- C:\Windows\SysWow64\drivers\ASUSHWIO.SYS [2008.01.04 06:34:42 | 000,010,216 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp32.sys ========== LOP Check ========== [2011.09.16 16:40:00 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\Ashampoo [2011.11.18 16:22:55 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\Booster [2011.07.22 13:31:56 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\Buhl Data Service [2011.11.19 11:01:51 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\Buhl Data Service GmbH [2011.07.20 21:03:51 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\DataDesign [2011.07.19 08:48:04 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\DisplayTune [2011.12.02 20:27:45 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\EveHQ [2011.12.10 21:27:40 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\EVEMon [2011.11.18 17:13:18 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\FileZilla [2011.09.16 20:32:02 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\FreeVideoConverter [2011.11.09 22:26:56 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\GHISLER [2011.12.09 21:30:53 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\gtk-2.0 [2011.10.16 13:46:54 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\Indicium Technologies [2011.12.02 23:05:55 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\NetMeter [2011.12.12 21:10:50 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\NetSpeedMonitor [2011.11.09 23:08:59 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\Notepad++ [2011.09.29 16:17:00 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\OpenOffice.org [2011.12.03 23:32:40 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\Opera [2011.08.27 12:56:06 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\PC Suite [2011.12.11 23:57:25 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\QuickScan [2011.11.18 18:36:22 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\TeamViewer [2011.12.06 11:46:14 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\TrueCrypt [2011.11.19 14:43:56 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\TS3Client [2011.07.27 14:45:08 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\ts3overlay [2011.12.10 12:08:43 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\TweakNow PowerPack 2011 [2011.07.31 10:27:53 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\Verbindungsassistent [2011.12.09 21:36:46 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\Wireshark [2011.11.27 12:02:17 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2011.12.11 17:00:08 | 000,000,440 | ---- | M] () -- C:\Windows\Tasks\vtscheduletask.job ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2011.07.19 07:44:59 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin [2011.10.19 19:13:32 | 000,000,000 | ---D | M] -- C:\Alexander [2011.07.19 09:28:41 | 000,000,000 | ---D | M] -- C:\AMD [2011.12.10 12:25:54 | 000,000,000 | ---D | M] -- C:\ATI [2011.12.12 18:17:10 | 000,000,000 | -HSD | M] -- C:\Config.Msi [2009.07.14 06:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings [2011.07.19 07:44:53 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen [2011.07.19 07:51:16 | 000,000,000 | ---D | M] -- C:\Intel [2011.08.08 18:29:25 | 000,000,000 | RH-D | M] -- C:\MSOCache [2009.07.14 04:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs [2011.12.11 21:54:10 | 000,000,000 | R--D | M] -- C:\Program Files [2011.12.12 07:33:32 | 000,000,000 | R--D | M] -- C:\Program Files (x86) [2011.12.10 12:43:56 | 000,000,000 | -H-D | M] -- C:\ProgramData [2011.07.19 07:44:53 | 000,000,000 | -HSD | M] -- C:\Programme [2011.07.19 07:44:53 | 000,000,000 | -HSD | M] -- C:\Recovery [2011.12.12 21:10:32 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2011.08.01 08:05:07 | 000,000,000 | ---D | M] -- C:\totalcmd [2011.07.19 07:44:56 | 000,000,000 | R--D | M] -- C:\Users [2011.12.12 20:03:52 | 000,000,000 | ---D | M] -- C:\Windows < %PROGRAMFILES%\*.exe > [2011.04.06 20:31:46 | 003,504,060 | ---- | M] (battleclinic.com) -- C:\Program Files (x86)\EVEMon-install-1.3.4.2523.exe [2011.06.21 21:32:02 | 014,521,609 | ---- | M] () -- C:\Program Files (x86)\evepremiumpatch264377-267203_m.exe [2011.04.06 17:48:04 | 001,802,976 | ---- | M] (CCP hf.) -- C:\Program Files (x86)\EVE_Premium_Setup_246350.exe < %LOCALAPPDATA%\*.exe > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.manifest /3 > < MD5 for: AFD.SYS > [2010.11.21 04:24:08 | 000,499,712 | ---- | M] (Microsoft Corporation) MD5=D31DC7A16DEA4A9BAF179F3D6FBDB38C -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17514_none_360e4801750ca991\afd.sys [2011.04.25 03:34:03 | 000,499,200 | ---- | M] (Microsoft Corporation) MD5=D5B031C308A409A0A576BFF4CF083D30 -- C:\Windows\SysNative\drivers\afd.sys [2011.04.25 03:34:03 | 000,499,200 | ---- | M] (Microsoft Corporation) MD5=D5B031C308A409A0A576BFF4CF083D30 -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17603_none_3618198975057170\afd.sys [2011.04.25 04:09:35 | 000,499,200 | ---- | M] (Microsoft Corporation) MD5=F4AD06143EAC303F55D0E86C40802976 -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.21712_none_3695e61e8e2c13d4\afd.sys < MD5 for: EXPLORER.EXE > [2011.02.26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe [2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe [2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe [2011.02.26 07:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe [2010.11.21 04:24:25 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe [2010.11.21 04:24:11 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe < MD5 for: REGEDIT.EXE > [2009.07.14 02:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=2E2C937846A0B8789E5E91739284D17A -- C:\Windows\winsxs\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5023a70bf589ad3e\regedit.exe [2009.07.14 02:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\regedit.exe [2009.07.14 02:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\SysWOW64\regedit.exe [2009.07.14 02:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\winsxs\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5a78515e29ea6f39\regedit.exe < MD5 for: USERINIT.EXE > [2010.11.21 04:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe [2010.11.21 04:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe [2010.11.21 04:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe [2010.11.21 04:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe < MD5 for: WININIT.EXE > [2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe [2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe [2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe [2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe < MD5 for: WINLOGON.EXE > [2010.11.21 04:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe [2010.11.21 04:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > < End of report > Ich freue mich, wenn mir jemand helfen kann, diesen Knoten zu lösen. verrant Geändert von verrant (12.12.2011 um 22:25 Uhr) Grund: den Log-Text einbinden |
|
13.12.2011, 12:48
| #2 |
| /// Malware-holic   | OTL.exe mit diversen Funden - konfuse Situation 1. die beiden auf vt geprüften files sind sauber.
__________________2. deinstaliere spybot es kann die reinigung stören außerdem nicht mehr sonders zeitgemäß, pc neustarten 3. öffne malwarebytes, logdateien, poste sie alle. falls der windows defender funde hatte die ebenfalls posten 4. combofix: Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde! Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.
__________________ |
|
13.12.2011, 18:55
| #3 | ||||
| | OTL.exe mit diversen Funden - konfuse SituationZitat:
Zitat:
Zitat:
Alle Malwarebite-Logs die ich habe: Code:
ATTFilter Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org
Datenbank Version: 8308
Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421
04.12.2011 16:23:59
mbam-log-2011-12-04 (16-23-59).txt
Art des Suchlaufs: Flash-Scan
Durchsuchte Objekte: 136096
Laufzeit: 20 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org
Datenbank Version: 8308
Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421
04.12.2011 20:04:24
mbam-log-2011-12-04 (20-04-24).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|G:\|)
Durchsuchte Objekte: 391151
Laufzeit: 3 Stunde(n), 39 Minute(n), 58 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org
Datenbank Version: 8336
Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421
09.12.2011 03:46:57
mbam-log-2011-12-09 (03-46-57).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|G:\|)
Durchsuchte Objekte: 405500
Laufzeit: 3 Stunde(n), 55 Minute(n), 39 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org
Datenbank Version: 8356
Windows 6.1.7601 Service Pack 1 (Safe Mode)
Internet Explorer 9.0.8112.16421
12.12.2011 08:36:30
mbam-log-2011-12-12 (08-36-30).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|G:\|)
Durchsuchte Objekte: 396394
Laufzeit: 9 Minute(n), 56 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org
Datenbank Version: 8358
Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421
12.12.2011 22:23:12
mbam-log-2011-12-12 (22-23-12).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|G:\|)
Durchsuchte Objekte: 398502
Laufzeit: 12 Minute(n), 59 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
Protection Log 2011-12-04.txt
16:23:27 Ghost MESSAGE Protection started successfully
16:23:31 Ghost MESSAGE IP Protection started successfully
18:29:35 Ghost IP-BLOCK 77.95.231.41 (Type: outgoing, Port: 5352, Process: firefox.exe)
18:29:35 Ghost IP-BLOCK 77.95.231.41 (Type: outgoing, Port: 5411, Process: firefox.exe)
18:32:07 Ghost IP-BLOCK 77.95.231.41 (Type: outgoing, Port: 5486, Process: firefox.exe)
20:09:32 Ghost MESSAGE IP Protection stopped
20:09:34 Ghost MESSAGE Database updated successfully
20:09:34 Ghost MESSAGE IP Protection started successfully
Protection Log 2011-12-05.txt
07:31:48 Ghost MESSAGE Protection started successfully
07:31:51 Ghost MESSAGE IP Protection started successfully
07:33:00 Ghost MESSAGE Scheduled update executed successfully
07:33:23 Ghost MESSAGE IP Protection stopped
07:33:24 Ghost MESSAGE Database updated successfully
07:33:24 Ghost MESSAGE IP Protection started successfully
11:17:09 Ghost MESSAGE Protection started successfully
11:17:12 Ghost MESSAGE IP Protection started successfully
22:43:05 Ghost IP-BLOCK 77.95.231.41 (Type: outgoing, Port: 5703, Process: ccpbrowser.exe)
22:43:05 Ghost IP-BLOCK 77.95.231.41 (Type: outgoing, Port: 5704, Process: ccpbrowser.exe)
22:47:37 Ghost IP-BLOCK 77.95.231.41 (Type: outgoing, Port: 5724, Process: firefox.exe)
22:47:37 Ghost IP-BLOCK 77.95.231.41 (Type: outgoing, Port: 5728, Process: firefox.exe)
22:47:37 Ghost IP-BLOCK 77.95.231.41 (Type: outgoing, Port: 5729, Process: firefox.exe)
22:47:45 Ghost IP-BLOCK 77.95.231.41 (Type: outgoing, Port: 5730, Process: firefox.exe)
22:47:45 Ghost IP-BLOCK 77.95.231.41 (Type: outgoing, Port: 5731, Process: firefox.exe)
22:48:57 Ghost IP-BLOCK 77.95.231.41 (Type: outgoing, Port: 5748, Process: ccpbrowser.exe)
22:48:57 Ghost IP-BLOCK 77.95.231.41 (Type: outgoing, Port: 5749, Process: ccpbrowser.exe)
22:48:57 Ghost IP-BLOCK 77.95.231.41 (Type: outgoing, Port: 5750, Process: ccpbrowser.exe)
22:48:57 Ghost IP-BLOCK 77.95.231.41 (Type: outgoing, Port: 5751, Process: ccpbrowser.exe)
22:48:57 Ghost IP-BLOCK 77.95.231.41 (Type: outgoing, Port: 5752, Process: ccpbrowser.exe)
22:48:57 Ghost IP-BLOCK 77.95.231.41 (Type: outgoing, Port: 5753, Process: ccpbrowser.exe)
22:48:57 Ghost IP-BLOCK 77.95.231.41 (Type: outgoing, Port: 5754, Process: ccpbrowser.exe)
22:48:57 Ghost IP-BLOCK 77.95.231.41 (Type: outgoing, Port: 5755, Process: ccpbrowser.exe)
22:48:57 Ghost IP-BLOCK 77.95.231.41 (Type: outgoing, Port: 5756, Process: ccpbrowser.exe)
22:48:57 Ghost IP-BLOCK 77.95.231.41 (Type: outgoing, Port: 5758, Process: ccpbrowser.exe)
23:22:02 Ghost IP-BLOCK 77.95.231.41 (Type: outgoing, Port: 5997, Process: ccpbrowser.exe)
23:22:02 Ghost IP-BLOCK 77.95.231.41 (Type: outgoing, Port: 5998, Process: ccpbrowser.exe)
23:22:02 Ghost IP-BLOCK 77.95.231.41 (Type: outgoing, Port: 5999, Process: ccpbrowser.exe)
23:22:02 Ghost IP-BLOCK 77.95.231.41 (Type: outgoing, Port: 6000, Process: ccpbrowser.exe)
23:22:02 Ghost IP-BLOCK 77.95.231.41 (Type: outgoing, Port: 6002, Process: ccpbrowser.exe)
23:22:02 Ghost IP-BLOCK 77.95.231.41 (Type: outgoing, Port: 6005, Process: ccpbrowser.exe)
23:22:02 Ghost IP-BLOCK 77.95.231.41 (Type: outgoing, Port: 6006, Process: ccpbrowser.exe)
23:22:02 Ghost IP-BLOCK 77.95.231.41 (Type: outgoing, Port: 6007, Process: ccpbrowser.exe)
23:22:02 Ghost IP-BLOCK 77.95.231.41 (Type: outgoing, Port: 6008, Process: ccpbrowser.exe)
23:22:02 Ghost IP-BLOCK 77.95.231.41 (Type: outgoing, Port: 6009, Process: ccpbrowser.exe)
Protection Log 2011-12-06.txt
10:50:55 Ghost MESSAGE Protection started successfully
10:52:15 Ghost MESSAGE Scheduled update executed successfully
10:52:16 Ghost MESSAGE Database updated successfully
20:37:17 Ghost MESSAGE Protection started successfully
Protection Log 2011-12-07.txt
00:47:33 Ghost MESSAGE Scheduled update executed successfully
00:47:34 Ghost MESSAGE Database updated successfully
10:09:23 Ghost MESSAGE Protection started successfully
Protection Log 2011-12-08.txt
07:26:34 Ghost MESSAGE Protection started successfully
07:27:40 Ghost MESSAGE Scheduled update executed successfully
07:27:41 Ghost MESSAGE Database updated successfully
18:41:35 Ghost MESSAGE Protection started successfully
23:51:09 Ghost MESSAGE Database updated successfully
Protection Log 2011-12-09.txt
17:04:36 Ghost MESSAGE Protection started successfully
17:26:16 Ghost MESSAGE Protection started successfully
17:34:39 Ghost MESSAGE Protection started successfully
Protection Log 2011-12-10.txt
10:30:34 Ghost MESSAGE Scheduled update executed successfully
Protection Log 2011-12-11.txt
11:27:21 Ghost MESSAGE Scheduled update executed successfully
Protection Log 2011-12-12.txt
07:26:39 Ghost MESSAGE Scheduled update executed successfully
Protection Log 2011-12-13.txt
08:13:14 Ghost MESSAGE Scheduled update executed successfully
Zitat:
Habe ComboFix aus Chrome-Fußzeile zum Installieren gestartet. Programm lief sofort los. Also vor dem O.K.-Knopf von ComboFix noch AdAware und MCAffee deaktiviert. An Defender nicht gedacht und Notepadd++ als offenes Programm übersehen.  Code:
ATTFilter Combofix Logfile: Wegen Textgröße als txt.Datei angefügt. Combofix auf dem Desktop. Auch Defender ist aus - Puh Combofix Logfile: Code:
ATTFilter ComboFix 11-12-12.02 - Ghost 13.12.2011 17:44:35.3.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.8169.6054 [GMT 1:00]
ausgeführt von:: c:\users\Ghost\Desktop\ComboFix.exe
AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}
AV: McAfee Anti-Virus und Anti-Spyware *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
FW: McAfee Firewall *Disabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}
SP: McAfee Anti-Virus und Anti-Spyware *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((( Dateien erstellt von 2011-11-13 bis 2011-12-13 ))))))))))))))))))))))))))))))
.
.
2011-12-13 16:47 . 2011-12-13 16:47 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-12-13 07:13 . 2011-11-30 01:21 8822856 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C8490BD8-AE91-4993-9E1D-1E9BC3D14938}\mpengine.dll
2011-12-12 06:33 . 2011-12-12 06:33 388096 ----a-r- c:\users\Ghost\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-12-12 06:33 . 2011-12-12 06:33 -------- d-----w- c:\program files (x86)\Trend Micro
2011-12-11 20:54 . 2011-12-11 20:54 -------- d-----w- c:\program files\HashTab Shell Extension
2011-12-10 11:43 . 2011-12-10 11:43 -------- d-----w- c:\programdata\ATI
2011-12-10 11:36 . 2011-12-10 11:36 -------- d-----w- c:\program files (x86)\AMD APP
2011-12-10 11:25 . 2011-12-10 11:25 -------- d-----w- C:\ATI
2011-12-10 11:08 . 2011-12-10 11:08 -------- d-----w- c:\users\Ghost\AppData\Roaming\TweakNow PowerPack 2011
2011-12-09 20:39 . 2011-12-09 20:39 -------- d-----w- c:\users\Ghost\AppData\Local\Locktime
2011-12-09 20:36 . 2011-12-09 20:36 -------- d-----w- c:\users\Ghost\AppData\Roaming\Wireshark
2011-12-09 20:24 . 2011-12-09 20:24 -------- d-----w- c:\program files (x86)\WinPcap
2011-12-09 20:10 . 2011-12-09 20:10 -------- d-----w- c:\programdata\Locktime
2011-12-09 19:38 . 2011-12-03 13:37 16432 ----a-w- c:\windows\system32\lsdelete.exe
2011-12-09 17:06 . 2011-12-09 17:06 -------- d-----w- c:\program files (x86)\Common Files\Adobe
2011-12-09 16:46 . 2011-12-09 16:46 -------- d-----w- c:\program files (x86)\Common Files\Java
2011-12-09 15:56 . 2011-12-09 15:56 525544 ----a-w- c:\windows\system32\deployJava1.dll
2011-12-09 15:56 . 2011-12-09 15:56 -------- d-----w- c:\program files\Java
2011-12-07 17:51 . 2011-12-07 17:51 -------- d-----w- c:\users\Ghost\AppData\Local\CrashRpt
2011-12-07 17:36 . 2011-12-07 18:08 -------- d-----w- c:\users\Ghost\AppData\Local\RapidSolution
2011-12-06 10:41 . 2011-12-06 10:46 -------- d-----w- c:\users\Ghost\AppData\Roaming\TrueCrypt
2011-12-06 10:40 . 2011-12-06 10:40 230864 ----a-w- c:\windows\system32\drivers\truecrypt.sys
2011-12-06 10:40 . 2011-12-06 10:40 -------- d-----w- c:\program files\TrueCrypt
2011-12-04 15:22 . 2011-12-04 15:22 -------- d-----w- c:\users\Ghost\AppData\Roaming\Malwarebytes
2011-12-04 15:21 . 2011-12-04 15:21 -------- d-----w- c:\programdata\Malwarebytes
2011-12-04 15:21 . 2011-08-31 16:00 25416 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-12-04 11:21 . 2011-12-13 15:38 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2011-12-03 22:40 . 2011-12-11 22:57 -------- d-----w- c:\users\Ghost\AppData\Roaming\QuickScan
2011-12-03 22:32 . 2011-12-03 22:32 -------- d-----w- c:\users\Ghost\AppData\Local\Opera
2011-12-03 22:32 . 2011-12-07 22:07 -------- d-----w- c:\program files (x86)\Opera
2011-12-03 13:37 . 2011-12-03 13:37 55384 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-12-03 13:36 . 2011-10-28 18:35 69376 ----a-w- c:\windows\system32\drivers\Lbd.sys
2011-12-03 13:35 . 2011-12-03 13:36 -------- d-----w- c:\programdata\Lavasoft
2011-11-27 19:49 . 2011-12-13 16:46 -------- d-----w- c:\users\Ghost\AppData\Roaming\NetSpeedMonitor
2011-11-27 19:32 . 2011-12-02 22:05 -------- d-----w- c:\users\Ghost\AppData\Roaming\NetMeter
2011-11-22 19:18 . 2011-10-18 13:29 28760 ----a-w- c:\program files (x86)\Mozilla Firefox\ScriptFF.dll
2011-11-20 14:44 . 2011-11-20 14:44 -------- d-----w- c:\users\Ghost\dwhelper
2011-11-18 17:12 . 2011-11-18 17:36 -------- d-----w- c:\users\Ghost\AppData\Roaming\TeamViewer
2011-11-18 17:11 . 2011-11-18 17:11 -------- d-----w- c:\program files (x86)\TeamViewer
2011-11-18 15:44 . 2011-12-04 09:06 -------- d-----w- c:\program files\CCleaner
2011-11-18 15:39 . 2011-11-18 15:39 131072 ----a-w- c:\windows\goog.exe
2011-11-18 15:39 . 2011-11-18 15:39 24576 ----a-w- c:\windows\system32\FoolishEventLogMsgHelper.dll
2011-11-18 15:22 . 2011-11-18 15:22 -------- d-----w- c:\users\Ghost\AppData\Roaming\Booster
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-10 09:45 . 2011-07-28 11:19 1025648 ----a-w- c:\windows\PE_Rom.dll
2011-12-09 16:46 . 2011-07-19 14:32 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
2011-12-09 16:04 . 2011-07-19 20:38 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-11-15 13:29 . 2010-11-21 03:27 270720 ------w- c:\windows\system32\MpSigStub.exe
2011-10-26 03:05 . 2011-10-26 03:05 10496512 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2011-10-26 02:16 . 2011-10-26 02:16 24866816 ----a-w- c:\windows\system32\atio6axx.dll
2011-10-26 02:06 . 2011-10-26 02:06 159744 ----a-w- c:\windows\system32\atiapfxx.exe
2011-10-26 02:05 . 2010-09-29 01:55 748544 ----a-w- c:\windows\SysWow64\aticfx32.dll
2011-10-26 02:04 . 2010-09-29 01:54 892416 ----a-w- c:\windows\system32\aticfx64.dll
2011-10-26 02:01 . 2011-10-26 02:01 466944 ----a-w- c:\windows\system32\ATIDEMGX.dll
2011-10-26 02:01 . 2011-10-26 02:01 517120 ----a-w- c:\windows\system32\atieclxx.exe
2011-10-26 02:00 . 2011-10-26 02:00 204288 ----a-w- c:\windows\system32\atiesrxx.exe
2011-10-26 01:59 . 2011-10-26 01:59 18757120 ----a-w- c:\windows\SysWow64\atioglxx.dll
2011-10-26 01:59 . 2011-10-26 01:59 120320 ----a-w- c:\windows\system32\atitmm64.dll
2011-10-26 01:59 . 2011-10-26 01:59 423424 ----a-w- c:\windows\system32\atipdl64.dll
2011-10-26 01:59 . 2010-09-29 01:49 356352 ----a-w- c:\windows\SysWow64\atipdlxx.dll
2011-10-26 01:59 . 2011-10-26 01:59 278528 ----a-w- c:\windows\SysWow64\Oemdspif.dll
2011-10-26 01:58 . 2011-10-26 01:58 21504 ----a-w- c:\windows\system32\atimuixx.dll
2011-10-26 01:58 . 2011-10-26 01:58 59392 ----a-w- c:\windows\system32\atiedu64.dll
2011-10-26 01:58 . 2011-10-26 01:58 43520 ----a-w- c:\windows\SysWow64\ati2edxx.dll
2011-10-26 01:55 . 2010-09-29 01:46 4292096 ----a-w- c:\windows\SysWow64\atidxx32.dll
2011-10-26 01:46 . 2010-09-29 01:37 5041664 ----a-w- c:\windows\system32\atidxx64.dll
2011-10-26 01:43 . 2011-10-26 01:43 1113088 ----a-w- c:\windows\system32\atiumd6v.dll
2011-10-26 01:43 . 2011-10-26 01:43 1828864 ----a-w- c:\windows\SysWow64\atiumdmv.dll
2011-10-26 01:43 . 2011-10-26 01:43 4044288 ----a-w- c:\windows\system32\atiumd6a.dll
2011-10-26 01:38 . 2011-10-26 01:38 51200 ----a-w- c:\windows\system32\aticalrt64.dll
2011-10-26 01:38 . 2011-10-26 01:38 46080 ----a-w- c:\windows\SysWow64\aticalrt.dll
2011-10-26 01:38 . 2011-10-26 01:38 44544 ----a-w- c:\windows\system32\aticalcl64.dll
2011-10-26 01:38 . 2011-10-26 01:38 44032 ----a-w- c:\windows\SysWow64\aticalcl.dll
2011-10-26 01:38 . 2011-10-26 01:38 9978880 ----a-w- c:\windows\system32\aticaldd64.dll
2011-10-26 01:35 . 2010-09-29 01:28 4353536 ----a-w- c:\windows\SysWow64\atiumdag.dll
2011-10-26 01:34 . 2011-10-26 01:34 8449024 ----a-w- c:\windows\SysWow64\aticaldd.dll
2011-10-26 01:32 . 2010-09-29 01:22 4189184 ----a-w- c:\windows\SysWow64\atiumdva.dll
2011-10-26 01:29 . 2011-10-26 01:29 5510144 ----a-w- c:\windows\system32\atiumd64.dll
2011-10-26 01:29 . 2010-09-29 01:23 58880 ----a-w- c:\windows\system32\coinst.dll
2011-10-26 01:22 . 2011-10-26 01:22 486912 ----a-w- c:\windows\system32\atiadlxx.dll
2011-10-26 01:22 . 2010-09-29 01:15 339968 ----a-w- c:\windows\SysWow64\atiadlxy.dll
2011-10-26 01:22 . 2011-10-26 01:22 17408 ----a-w- c:\windows\system32\atig6pxx.dll
2011-10-26 01:22 . 2011-10-26 01:22 14336 ----a-w- c:\windows\SysWow64\atiglpxx.dll
2011-10-26 01:22 . 2011-10-26 01:22 14336 ----a-w- c:\windows\system32\atiglpxx.dll
2011-10-26 01:22 . 2011-10-26 01:22 39936 ----a-w- c:\windows\system32\atig6txx.dll
2011-10-26 01:22 . 2011-10-26 01:22 32768 ----a-w- c:\windows\SysWow64\atigktxx.dll
2011-10-26 01:21 . 2011-10-26 01:21 326656 ----a-w- c:\windows\system32\drivers\atikmpag.sys
2011-10-26 01:21 . 2010-09-29 01:14 40960 ----a-w- c:\windows\system32\atiuxp64.dll
2011-10-26 01:21 . 2010-09-29 01:14 31744 ----a-w- c:\windows\SysWow64\atiuxpag.dll
2011-10-26 01:21 . 2011-10-26 01:21 38912 ----a-w- c:\windows\system32\atiu9p64.dll
2011-10-26 01:20 . 2010-09-29 01:13 29184 ----a-w- c:\windows\SysWow64\atiu9pag.dll
2011-10-26 01:20 . 2011-10-26 01:20 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2011-10-26 01:16 . 2011-10-26 01:16 54784 ----a-w- c:\windows\system32\atimpc64.dll
2011-10-26 01:16 . 2011-10-26 01:16 54784 ----a-w- c:\windows\system32\amdpcom64.dll
2011-10-26 01:15 . 2011-10-26 01:15 53760 ----a-w- c:\windows\SysWow64\atimpc32.dll
2011-10-26 01:15 . 2011-10-26 01:15 53760 ----a-w- c:\windows\SysWow64\amdpcom32.dll
2011-10-25 20:21 . 2011-10-25 20:21 66560 ----a-w- c:\windows\system32\OpenVideo64.dll
2011-10-25 20:21 . 2011-10-25 20:21 56832 ----a-w- c:\windows\SysWow64\OpenVideo.dll
2011-10-25 20:21 . 2011-10-25 20:21 66560 ----a-w- c:\windows\system32\OVDecoder64.dll
2011-10-25 20:21 . 2011-10-25 20:21 56832 ----a-w- c:\windows\SysWow64\OVDecoder.dll
2011-10-25 20:21 . 2011-10-25 20:21 16991744 ----a-w- c:\windows\system32\amdocl64.dll
2011-10-25 20:20 . 2011-10-25 20:20 13950464 ----a-w- c:\windows\SysWow64\amdocl.dll
2011-10-25 20:19 . 2011-10-25 20:19 51200 ----a-w- c:\windows\system32\OpenCL.dll
2011-10-25 20:19 . 2011-10-25 20:19 44032 ----a-w- c:\windows\SysWow64\OpenCL.dll
2011-10-18 13:32 . 2011-07-27 16:31 161168 ----a-w- c:\windows\system32\mfevtps.exe
2011-10-15 12:16 . 2011-07-27 17:17 10248 ----a-w- c:\windows\system32\drivers\mfeclnk.sys
2011-10-15 12:16 . 2011-07-27 17:17 75808 ----a-w- c:\windows\system32\drivers\mfenlfk.sys
2011-10-15 12:16 . 2011-07-27 17:17 65264 ----a-w- c:\windows\system32\drivers\cfwids.sys
2011-10-15 12:16 . 2011-07-27 17:17 481768 ----a-w- c:\windows\system32\drivers\mfefirek.sys
2011-10-15 12:16 . 2011-07-27 17:17 284648 ----a-w- c:\windows\system32\drivers\mfewfpk.sys
2011-10-15 12:16 . 2011-07-27 17:17 229528 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2011-10-15 12:16 . 2011-07-27 17:17 100912 ----a-w- c:\windows\system32\drivers\mferkdet.sys
2011-10-15 12:16 . 2011-03-13 09:20 647080 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2011-10-15 12:16 . 2011-03-13 09:20 160280 ----a-w- c:\windows\system32\drivers\mfeapfk.sys
2011-10-06 17:40 . 2011-07-19 13:58 1092400 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-09-29 16:29 . 2011-11-08 20:38 1923952 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-09-29 04:03 . 2011-11-08 20:38 3144704 ----a-w- c:\windows\system32\win32k.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccleaner"="c:\program files\CCleaner\CCleaner64.exe" [2011-11-28 4533056]
"NetLimiter"="d:\program files\NetLimiter 3\NLClientApp.exe" [2011-03-21 2910208]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-04-29 284440]
"PivotSoftware"="c:\program files (x86)\Portrait Displays\Pivot Pro Plugin\Pivot_startup.exe" [2010-05-13 110192]
"DT ACR"="c:\program files (x86)\Common Files\Portrait Displays\Shared\DT_startup.exe" [2010-06-30 121456]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2011-09-16 1674896]
"ASUS ShellProcess Execute"="c:\program files (x86)\ASUS\AI Suite II\ASUS Mobilink\Simulator\AsShellProcess.exe" [2010-09-28 252544]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-10-25 343168]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update-Dienst (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-10 136176]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;d:\program files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2011-10-28 2152152]
R3 ALSysIO;ALSysIO;c:\users\Ghost\AppData\Local\Temp\ALSysIO64.sys [x]
R3 ATHDFU;Atheros Valkyrie USB BootROM;c:\windows\system32\Drivers\AthDfu.sys [x]
R3 ewsercd;Huawei DataCard USB Serial Port;c:\windows\system32\DRIVERS\ewsercd.sys [2011-07-19 112896]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-10 136176]
R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys [2011-07-19 116224]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [x]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]
R3 NLNdisPT;NetLimiter Ndis Protocol Service;c:\windows\system32\DRIVERS\nlndis.sys [x]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [x]
R3 SandraAgentSrv;SiSoftware Deployment Agent Service;d:\program files\SiSoftware\SiSoftware Sandra Lite 2011.SP4\RpcAgentSrv.exe [2009-07-13 93848]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 X6va005;X6va005;c:\users\Ghost\AppData\Local\Temp\005A498.tmp [x]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [x]
S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [x]
S0 mv91xx;mv91xx;c:\windows\system32\DRIVERS\mv91xx.sys [x]
S1 AsUpIO;AsUpIO;SysWow64\drivers\AsUpIO.sys [x]
S1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\DRIVERS\mfenlfk.sys [x]
S1 nltdi;nltdi;d:\program files\NetLimiter 3\nltdi.sys [2011-03-21 88200]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 asComSvc;ASUS Com Service;c:\program files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe [2010-11-03 918144]
S2 asHmComSvc;ASUS HM Com Service;c:\program files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe [2010-12-02 915584]
S2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe [2010-10-21 586880]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe [2010-10-27 52896]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-04-29 13592]
S2 MBAMService;MBAMService;d:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
S2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-01-27 249936]
S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [2011-01-27 249936]
S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [2011-10-18 208536]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [x]
S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [x]
S2 PdiService;Portrait Displays SDK Service;c:\program files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe [2010-04-16 109168]
S2 Realtek87B;Realtek87B;c:\program files (x86)\Realtek\RTL8187 Wireless LAN Utility\RtlService.exe [2009-12-07 40960]
S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-11-03 2358656]
S2 WTGService;WTGService;c:\program files (x86)\Verbindungsassistent\WTGService.exe [2010-02-23 329168]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [x]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [x]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [x]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [x]
S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [x]
S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [x]
S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [x]
S3 ICCWDT;Intel(R) Watchdog Timer Driver (Intel(R) WDT);c:\windows\system32\DRIVERS\ICCWDT.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [x]
S3 NLNdisMP;NLNdisMP;c:\windows\system32\DRIVERS\nlndis.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 RTL8187;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\rtl8187.sys [x]
S3 USBMULCD;USB Multi-Channel Audio Device Interface;c:\windows\system32\drivers\CM10664.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - Lavasoft Kernexplorer
*Deregistered* - mfeavfk01
.
Inhalt des "geplante Tasks" Ordners
.
2011-12-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-10 20:03]
.
2011-12-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-10 20:03]
.
2011-12-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2438057823-3161982914-410875986-1000Core.job
- c:\users\Ghost\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-19 14:43]
.
2011-12-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2438057823-3161982914-410875986-1000UA.job
- c:\users\Ghost\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-19 14:43]
.
2011-12-13 c:\windows\Tasks\vtscheduletask.job
- c:\program files (x86)\McAfee\Supportability\MVT\MvtApp.exe [2011-07-27 12:25]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cm106Sound"="c:\windows\Syswow64\cm106.dll" [2010-07-01 8151040]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 2417032]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: An OneNote s&enden - c:\progra~2\MICROS~3\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~3\Office14\EXCEL.EXE/3000
Trusted Zone: internet
Trusted Zone: mcafee.com
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{6C802738-AE9D-4E6D-A478-99D6D0B66991}: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Ghost\AppData\Roaming\Mozilla\Firefox\Profiles\gcl7g18u.default\
FF - prefs.js: browser.startup.homepage - www.google.de
FF - prefs.js: keyword.URL - hxxp://websearch.search-results.com/redirect?client=ff&src=kw&tb=STC-SRS&o=41648033&locale=de_DE&apn_uid=27585E9B-37D2-4465-BA12-110E4DBA700F&apn_ptnrs=96&apn_sauid=C6E5D6B3-9E65-46E4-9D52-6E7458A9F170&apn_dtid=YYYYYYYYDE&q=
FF - prefs.js: network.proxy.ftp - 46.249.35.176
FF - prefs.js: network.proxy.ftp_port - 80
FF - prefs.js: network.proxy.http - 46.249.35.176
FF - prefs.js: network.proxy.http_port - 80
FF - prefs.js: network.proxy.socks - 46.249.35.176
FF - prefs.js: network.proxy.socks_port - 80
FF - prefs.js: network.proxy.ssl - 46.249.35.176
FF - prefs.js: network.proxy.ssl_port - 80
FF - prefs.js: network.proxy.type - 1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-10 - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va005]
"ImagePath"="\??\c:\users\Ghost\AppData\Local\Temp\005A498.tmp"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10d.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10d.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2011-12-13 17:48:42
ComboFix-quarantined-files.txt 2011-12-13 16:48
ComboFix2.txt 2011-12-13 16:42
ComboFix3.txt 2011-12-13 16:29
.
Vor Suchlauf: 15 Verzeichnis(se), 38.910.857.216 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 38.853.726.208 Bytes frei
.
- - End Of File - - 439245B8756402079B7168CBB2B6916A
Nachtrag 1 Hatte ich vergessen beim Eingangsthread anzuführen: Bevor ich schlauer wurde, habe ich otl genutzt um eine "redirect.dll" zu löschen. Den genauen Pfad erinnere ich nicht mehr, aber ich glaube es kam darin noch "Office14" vor. Nachtrag 2 Der Pfad "Eigene Dateien" ist verschlossen. Die Pfade zu den anderen Standard"bibliotheken" ebenfalls, aber über eine Verknüpfung zu erreichen. Unter C:\ sind die "Documents and Settings", "Dokumente und Einstellungen" und "Programme" mit einem Schloß gesperrt, das Icon ist jeweils blass und alle 3 lassen sich trotz Rechte als Administrator nicht öffnen. Gruß verrant |
|
13.12.2011, 19:09
| #4 |
| /// Malware-holic | OTL.exe mit diversen Funden - konfuse Situation 1. bitte verzichte auf komplette zitate das zieht alles unnötig in die länge 2. warum löschts du einfach irgendwas mit otl? 3. öffne computer, c: qoobox rechtsklick quarantain hochladen. http://www.trojaner-board.de/54791-a...ner-board.html 4. hast du die anleitung von combofix gelesen da steht doch alles haar klein drinn...
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
13.12.2011, 22:32
| #5 |
| | OTL.exe mit diversen Funden - konfuse Situation Danke für die schnelle Antwort. Aus einer unnötigen Laune heraus OTL genutzt. Passiert nicht wieder. Solche Aktionen nur noch auf Anweisung. Die Anleitung habe ich gelesen, aber n o c h nicht vorsichtig/genau genug umgesetzt. Werde mich bemühen, Anleitungen präziser abzuarbeiten. Die Ordneransicht habe ich entsprechend der Anleitung für "Computer" angepasst. Etwas ist mir in deiner kurzen Anleitung unklar geblieben: Was ist mit dem Rechtsklick nach dem Öffnen des Ordners Qoobox gemeint? Was aus dem Kontextmenü soll ich womit machen? Ordner Quarantine packen und hochladen? Gerade aufgefallen: McAffee scheint wieder zu funktionieren. Echtzeitscan bleibt an und manueller Scan zeigt verarbeitete Dateien. Gruß verrant Geändert von verrant (13.12.2011 um 22:53 Uhr) Grund: Zusammenhängender Formuliert |
|
14.12.2011, 13:40
| #6 |
| /// Malware-holic | OTL.exe mit diversen Funden - konfuse Situation du sollst nen rechtsklick machen und je nach dem was du nutzt dann winrar ein archiv erstellen lassen, also zu quarantain.rar hinzufügen, oder 7zip oder winzip etc nutzen
__________________ --> OTL.exe mit diversen Funden - konfuse Situation |
|
14.12.2011, 14:31
| #7 |
| | OTL.exe mit diversen Funden - konfuse Situation ZIP-Datei hochgeladen |
|
14.12.2011, 14:38
| #8 |
| /// Malware-holic | OTL.exe mit diversen Funden - konfuse Situation hmm sehe keine falls zu groß File-Upload.net - Ihr kostenloser File Hoster! dort hochladen und link als private nachicht an mich
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
14.12.2011, 15:12
| #9 |
| /// Malware-holic | OTL.exe mit diversen Funden - konfuse Situation lade hitmanpro: http://dl.surfright.nl/HitmanPro36beta2_x64.exe öffnen settings, license, testlicense scanner dort funde in quarantäne im letzten schritt solltest du einen bericht speichern können, den anhängen.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
14.12.2011, 15:29
| #10 |
| | OTL.exe mit diversen Funden - konfuse Situation HitmanPro3_6_0_log.xml hochgeladen Es gab keine Funde - keine Quarantäne. Geändert von verrant (14.12.2011 um 15:32 Uhr) Grund: Ergänzung weil ich XML nicht lesen kann |
|
14.12.2011, 15:44
| #11 |
| /// Malware-holic | OTL.exe mit diversen Funden - konfuse Situation leitet firefox noch die verbindung um?
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
14.12.2011, 15:46
| #12 |
| | OTL.exe mit diversen Funden - konfuse Situation ja, Firefox leitet noch um |
|
14.12.2011, 15:54
| #13 |
| /// Malware-holic | OTL.exe mit diversen Funden - konfuse Situation zu ner speziellen seite oder sinds immer unterschiedliche, falls ne spezielle seite sag sie mir mal.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
14.12.2011, 16:03
| #14 |
| | OTL.exe mit diversen Funden - konfuse Situation In der Adresszeile von Firefox steht: Google So sieht die Site aus: 错误 您所请求的网址（URL）无法获取 当尝试读取以下网址（URL）时： Google 发生了下列的错误： Access Denied. 拒绝访问 Access control configuration prevents your request from being allowed at this time. Please contact your service provider if you feel this is incorrect. 当前的存取控制设定禁止您的请求被接受，如果您觉得这是错误的，请与您网路服务的提供者联系。 本缓存服务器管理员：webmaster Generated Wed, 14 Dec 2011 13:03:11 GMT by yestruereligionjeans.com (squid/2.6.STABLE21) In der Adresszeile WEB.DE - E-Mail - Suche - DSL - De-Mail - Shopping - Entertainment eingegeben. Site bleibt die Gleiche, nur für web.de und die Uhrziet unten ändert sich. |
|
14.12.2011, 16:12
| #15 |
| /// Malware-holic | OTL.exe mit diversen Funden - konfuse Situation ok schaun wir mal weiter. lade den CCleaner standard: CCleaner Download - CCleaner 3.13.1600 falls der CCleaner bereits instaliert, überspringen. instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen. hinter, jedes von dir benötigte programm, schreibe notwendig. hinter, jedes, von dir nicht benötigte, unnötig. hinter, dir unbekannte, unbekannt. liste posten.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
| Themen zu OTL.exe mit diversen Funden - konfuse Situation |
| 0x00000001, ad-aware, autorun, bho, c:\windows\system32\rundll32.exe, document, error, google, google earth, helper, hijack, home, langs, logfile, phishing, plug-in, problem, realtek, registry, required, safer networking, scan, security, security scan, senden, software, stick, svchost, svchost.exe, system, taskmanager, usb, usb 3.0, version=1.0, virus, webcheck, windows-defender, wiso, zip-datei |
Linear-Darstellung
