| |
| |||||||
Log-Analyse und Auswertung: Google/Yahoo Weiterleitung über thealltimes.comWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
06.02.2012, 14:27
| #1 | ||
| |  Google/Yahoo Weiterleitung über thealltimes.com Hi, ein Kumpel von mir hat sich auf seinem Laptop etwas eingefangen, dass ihn bei der google.de oder yahoo.de website immer über thealltimes.com wo anderst hin umleitet. Auch die Wiederherstellung wurde deaktiviert. Das Windows Security Center ebenfalls. Ein manueller Start in den Prozessen ist nicht mehr möglich. Platte wurde mit GDATA Antivir 2012 BootCD und dem Avira Antivir gescanned. Ohne Fund. Spybot findet nur die Tatsache, dass das Security Center deaktiviert ist, kann es aber nicht beheben. Proxies sind keine eingestellt. Temporäre Dateien und Cookies sind gelöscht. Sowohl Firefox als auch iexplore sind betroffen. Hier noch die Logs: OCL: OTL Logfile: Code:
ATTFilter OTL logfile created on: 06.02.2012 14:01:12 - Run 3 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Julian\Downloads 64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 2,65 Gb Available Physical Memory | 66,27% Memory free 8,00 Gb Paging File | 6,45 Gb Available in Paging File | 80,64% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 149,04 Gb Total Space | 111,89 Gb Free Space | 75,07% Space Free | Partition Type: NTFS Drive D: | 149,04 Gb Total Space | 4,44 Gb Free Space | 2,98% Space Free | Partition Type: NTFS Drive E: | 136,35 Gb Total Space | 136,21 Gb Free Space | 99,90% Space Free | Partition Type: NTFS Drive F: | 149,04 Gb Total Space | 148,91 Gb Free Space | 99,91% Space Free | Partition Type: NTFS Drive H: | 12,69 Gb Total Space | 12,59 Gb Free Space | 99,18% Space Free | Partition Type: NTFS Computer Name: JULIAN-PC | User Name: Julian | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.02.05 23:49:28 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Julian\Downloads\OTL.exe PRC - [2012.01.29 17:12:47 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe PRC - [2012.01.13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2012.01.13 14:53:18 | 000,460,872 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2011.12.27 23:21:08 | 003,508,624 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe PRC - [2011.12.15 14:59:48 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe PRC - [2011.12.15 14:59:38 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe PRC - [2011.12.15 14:59:37 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe PRC - [2011.10.15 09:53:00 | 002,253,120 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe PRC - [2011.10.15 00:54:40 | 000,381,248 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe PRC - [2010.11.20 13:17:56 | 000,164,864 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Windows Media Player\wmplayer.exe PRC - [2010.05.04 11:07:22 | 000,503,080 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Nero\Update\NASvc.exe ========== Modules (No Company Name) ========== MOD - [2012.01.29 17:12:47 | 001,911,768 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll MOD - [2011.10.15 00:54:26 | 000,265,536 | ---- | M] () -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll ========== Win32 Services (SafeList) ========== SRV:64bit: - [2009.07.14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2012.01.13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2011.12.15 14:59:48 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011.12.15 14:59:38 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.10.15 09:53:00 | 002,253,120 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService) SRV - [2011.10.15 00:54:40 | 000,381,248 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service) SRV - [2010.05.04 11:07:22 | 000,503,080 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009.09.23 21:59:36 | 001,037,824 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- D:\Programme\HP\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC) SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) ========== Driver Services (SafeList) ========== DRV:64bit: - [2011.12.15 15:00:00 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr) DRV:64bit: - [2011.12.15 14:59:59 | 000,130,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2011.12.15 14:59:59 | 000,097,312 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2011.12.10 15:24:08 | 000,023,152 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector) DRV:64bit: - [2011.12.08 05:22:38 | 000,203,320 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudmdm.sys -- (ssudmdm) SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.) DRV:64bit: - [2011.12.08 05:22:38 | 000,098,616 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssudbus.sys -- (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.) DRV:64bit: - [2011.08.02 17:38:56 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64) DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.11.20 10:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus) DRV:64bit: - [2010.07.05 02:25:15 | 000,015,928 | ---- | M] (ASUS) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ATK64AMD.sys -- (MTsensor) DRV:64bit: - [2009.11.23 17:38:00 | 000,016,008 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LGVirHid.sys -- (LGVirHid) DRV:64bit: - [2009.11.23 17:37:50 | 000,022,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGBusEnum.sys -- (LGBusEnum) DRV:64bit: - [2009.07.21 00:48:32 | 000,274,480 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP) DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.07.14 02:18:06 | 000,281,088 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BrSerIb.sys -- (BrSerIb) Brother MFC Serial Interface Driver(WDM) DRV:64bit: - [2009.06.25 16:04:20 | 000,067,584 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimmpx64.sys -- (rimmptsk) DRV:64bit: - [2009.06.25 15:38:52 | 000,057,856 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rixdpx64.sys -- (rismxdp) DRV:64bit: - [2009.06.25 15:13:44 | 000,055,296 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimspx64.sys -- (rimsptsk) DRV:64bit: - [2009.06.10 21:41:10 | 000,015,360 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BrUsbSIb.sys -- (BrUsbSIb) Brother MFC Serial USB Driver(WDM) DRV:64bit: - [2009.06.10 21:35:28 | 005,434,368 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\netw5v64.sys -- (netw5v64) Intel(R) DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.05.22 21:52:30 | 000,215,040 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:64bit: - [2009.05.18 12:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = D1 BA D1 14 15 E4 CC 01 [binary data] IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.10 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26 FF - prefs.js..network.proxy.type: 0 FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Oracle) FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.02.06 10:36:02 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010.07.05 00:17:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Julian\AppData\Roaming\mozilla\Extensions [2012.02.05 17:13:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Julian\AppData\Roaming\mozilla\Firefox\Profiles\yjc1fxga.default\extensions [2012.02.05 17:13:25 | 000,000,000 | ---D | M] (BitDefender QuickScan) -- C:\Users\Julian\AppData\Roaming\mozilla\Firefox\Profiles\yjc1fxga.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2012.02.06 10:36:02 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions () (No name found) -- C:\USERS\JULIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\YJC1FXGA.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI [2012.01.29 17:12:48 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2012.01.29 15:02:49 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.01.29 14:50:55 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012.01.29 15:02:49 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2012.01.29 15:02:49 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012.01.29 15:02:49 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012.01.29 15:02:49 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2012.02.06 10:14:09 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O4:64bit: - HKLM..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 217.0.43.177 217.0.43.161 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{66D8168D-7F18-4E5F-BE8B-A427574AE81E}: DhcpNameServer = 217.0.43.177 217.0.43.161 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CDA2650D-3986-43EF-B15B-A0B920F58248}: DhcpNameServer = 192.168.2.1 O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2012.02.06 13:38:45 | 000,000,000 | ---D | C] -- C:\_OTL [2012.02.06 13:14:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UBCD4Win [2012.02.06 13:13:15 | 000,000,000 | ---D | C] -- C:\Users\Julian\Desktop\Malwarebekämpfung [2012.02.06 13:12:07 | 000,000,000 | ---D | C] -- C:\UBCD4Win [2012.02.06 12:14:43 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN [2012.02.06 10:36:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2012.02.06 10:20:53 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner [2012.02.06 10:08:15 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe [2012.02.06 10:08:15 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe [2012.02.06 10:08:15 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe [2012.02.06 10:08:10 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT [2012.02.06 10:06:22 | 000,000,000 | ---D | C] -- C:\Qoobox [2012.02.06 09:49:38 | 000,000,000 | ---D | C] -- C:\Config.Msi [2012.02.05 17:20:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy [2012.02.05 17:20:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy [2012.02.05 17:20:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Spybot - Search & Destroy [2012.02.05 17:13:32 | 000,000,000 | ---D | C] -- C:\Users\Julian\AppData\Roaming\QuickScan [2012.02.05 16:59:45 | 000,000,000 | ---D | C] -- C:\Users\Julian\SmitfraudFix [2012.02.05 16:56:55 | 000,000,000 | ---D | C] -- C:\Users\Julian\Desktop\backups [2012.02.05 16:44:52 | 000,000,000 | ---D | C] -- C:\Users\Julian\Desktop\SmitfraudFix [2012.02.05 14:55:52 | 000,000,000 | ---D | C] -- C:\Users\Julian\AppData\Roaming\Avira [2012.02.05 14:35:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira [2012.02.05 14:35:00 | 000,130,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys [2012.02.05 14:35:00 | 000,097,312 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys [2012.02.05 14:35:00 | 000,027,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys [2012.02.05 14:35:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira [2012.02.05 14:35:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira [2012.02.05 12:56:42 | 000,000,000 | ---D | C] -- C:\Users\Julian\AppData\Roaming\Malwarebytes [2012.02.05 12:56:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.02.05 12:56:37 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.02.05 12:56:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2012.02.05 12:56:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.02.03 11:55:20 | 000,000,000 | ---D | C] -- C:\Users\Julian\Desktop\LOL [2012.01.31 17:50:15 | 000,000,000 | ---D | C] -- C:\Temp [2012.01.31 17:47:00 | 000,203,320 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudmdm.sys [2012.01.31 17:47:00 | 000,098,616 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudbus.sys [2012.01.31 17:40:35 | 000,000,000 | ---D | C] -- C:\Users\Julian\AppData\Local\Samsung [2012.01.31 17:40:25 | 000,000,000 | ---D | C] -- C:\Users\Julian\AppData\Roaming\Samsung [2012.01.31 17:40:23 | 000,000,000 | ---D | C] -- C:\Users\Julian\Documents\samsung [2012.01.31 17:36:51 | 004,659,712 | ---- | C] (Dmitry Streblechenko) -- C:\Windows\SysWow64\Redemption.dll [2012.01.31 17:36:46 | 000,821,824 | ---- | C] (Devguru Co., Ltd.) -- C:\Windows\SysWow64\dgderapi.dll [2012.01.31 17:29:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung [2012.01.31 17:26:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Samsung [2012.01.31 17:26:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Samsung [2012.01.31 17:26:01 | 000,000,000 | ---D | C] -- C:\Program Files\Samsung [2012.01.31 17:25:27 | 000,000,000 | ---D | C] -- C:\Users\Julian\AppData\Local\Downloaded Installations [2012.01.30 20:11:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes [2012.01.30 20:11:08 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes [2012.01.30 20:11:08 | 000,000,000 | ---D | C] -- C:\Program Files\iPod [2012.01.20 21:30:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XSplit [2012.01.20 21:30:21 | 000,000,000 | ---D | C] -- C:\ProgramData\SplitMediaLabs [2012.01.20 21:29:17 | 000,000,000 | ---D | C] -- C:\Users\Julian\AppData\Roaming\SplitMediaLabs [2012.01.15 17:24:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation [2012.01.15 17:21:49 | 000,068,928 | ---- | C] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll [2012.01.15 17:21:49 | 000,061,248 | ---- | C] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll ========== Files - Modified Within 30 Days ========== [2012.02.06 13:47:49 | 000,021,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.02.06 13:47:49 | 000,021,216 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.02.06 13:44:53 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.02.06 13:44:53 | 000,654,400 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.02.06 13:44:53 | 000,616,242 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.02.06 13:44:53 | 000,130,240 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.02.06 13:44:53 | 000,106,622 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.02.06 13:40:28 | 000,000,316 | ---- | M] () -- C:\Windows\tasks\ctwb.job [2012.02.06 13:40:25 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.02.06 13:40:17 | 3220,623,360 | -HS- | M] () -- C:\hiberfil.sys [2012.02.06 13:14:14 | 000,001,325 | ---- | M] () -- C:\Users\Public\Desktop\UBCD4Win.lnk [2012.02.06 12:59:41 | 000,089,088 | ---- | M] () -- C:\Windows\SysNative\mbr.exe [2012.02.06 10:36:02 | 000,001,064 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2012.02.06 10:29:19 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif [2012.02.06 10:14:09 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts [2012.02.04 17:06:36 | 000,122,880 | RHS- | M] () -- C:\Windows\SysWow64\ir41_qcxl.dll [2012.02.04 13:15:25 | 000,533,993 | ---- | M] () -- C:\Users\Julian\Desktop\asdasd.jpg [2012.02.04 02:09:32 | 009,809,512 | ---- | M] () -- C:\Users\Julian\Desktop\Skrillex & Katy Perry - E.T. (Bugzz Equinox Remix).mp3 [2012.02.04 01:40:18 | 012,207,611 | ---- | M] () -- C:\Users\Julian\Desktop\M.I.A - Paper Planes (Reload Beatz Dubstep Remix).mp3 [2012.01.31 18:11:39 | 014,599,212 | ---- | M] () -- C:\Users\Julian\Desktop\Pumped Up Kicks (Butch Clancy Remix).mp3 [2012.01.31 18:08:33 | 007,921,704 | ---- | M] () -- C:\Users\Julian\Desktop\Adele vs. Skrillex - Set Fire To Everybody.mp3 [2012.01.30 23:34:38 | 006,234,708 | ---- | M] () -- C:\Users\Julian\Desktop\The Way I Are (Timbaland Vs. Nephew) (Ft. Keri Hilson & D.O.E.).mp3 ========== Files Created - No Company Name ========== [2012.02.06 13:14:14 | 000,001,325 | ---- | C] () -- C:\Users\Public\Desktop\UBCD4Win.lnk [2012.02.06 13:00:41 | 000,089,088 | ---- | C] () -- C:\Windows\SysNative\mbr.exe [2012.02.06 10:36:02 | 000,001,076 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2012.02.06 10:36:02 | 000,001,064 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2012.02.06 10:08:15 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe [2012.02.06 10:08:15 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe [2012.02.06 10:08:15 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe [2012.02.06 10:08:15 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe [2012.02.06 10:08:15 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe [2012.02.04 17:06:36 | 000,122,880 | RHS- | C] () -- C:\Windows\SysWow64\ir41_qcxl.dll [2012.02.04 17:06:36 | 000,000,316 | ---- | C] () -- C:\Windows\tasks\ctwb.job [2012.02.04 13:15:25 | 000,533,993 | ---- | C] () -- C:\Users\Julian\Desktop\asdasd.jpg [2012.02.04 02:08:59 | 009,809,512 | ---- | C] () -- C:\Users\Julian\Desktop\Skrillex & Katy Perry - E.T. (Bugzz Equinox Remix).mp3 [2012.02.04 01:37:47 | 012,207,611 | ---- | C] () -- C:\Users\Julian\Desktop\M.I.A - Paper Planes (Reload Beatz Dubstep Remix).mp3 [2012.01.30 23:34:21 | 006,234,708 | ---- | C] () -- C:\Users\Julian\Desktop\The Way I Are (Timbaland Vs. Nephew) (Ft. Keri Hilson & D.O.E.).mp3 [2012.01.30 23:25:07 | 007,921,704 | ---- | C] () -- C:\Users\Julian\Desktop\Adele vs. Skrillex - Set Fire To Everybody.mp3 [2012.01.30 23:16:27 | 014,599,212 | ---- | C] () -- C:\Users\Julian\Desktop\Pumped Up Kicks (Butch Clancy Remix).mp3 [2012.01.16 19:03:42 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk [2011.12.23 20:58:28 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe [2011.12.23 20:58:24 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll [2011.12.23 20:58:24 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll [2011.12.23 20:58:24 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll [2011.12.23 20:58:24 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll [2011.11.13 10:46:44 | 000,251,629 | ---- | C] () -- C:\Windows\hpwins21.dat [2011.10.15 00:54:52 | 000,321,856 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe [2011.02.04 21:11:23 | 001,526,948 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2010.12.06 20:13:27 | 000,073,139 | ---- | C] () -- C:\Windows\War3Unin.dat [2010.07.06 12:27:35 | 000,000,416 | ---- | C] () -- C:\Windows\BRWMARK.INI [2010.07.06 12:27:35 | 000,000,034 | ---- | C] () -- C:\Windows\SysWow64\BD7320.DAT [2010.07.05 02:14:51 | 000,146,432 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL [2010.07.05 02:14:51 | 000,072,704 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL [2010.07.05 00:27:33 | 000,000,017 | ---- | C] () -- C:\Users\Julian\AppData\Local\resmon.resmoncfg [2009.11.06 12:03:31 | 000,000,428 | ---- | C] () -- C:\Windows\hpwmdl21.dat [2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT [2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat [2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat [2005.01.17 06:10:16 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\BRTCPCON.DLL [2004.08.09 06:00:42 | 000,000,114 | ---- | C] () -- C:\Windows\SysWow64\BRLMW03A.INI ========== LOP Check ========== [2010.07.05 09:16:27 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\LolClient [2010.11.28 22:14:36 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\MobMapUpdater [2010.08.21 12:13:06 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\OpenOffice.org [2012.02.05 17:13:40 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\QuickScan [2012.01.31 17:40:25 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\Samsung [2012.01.20 21:29:17 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\SplitMediaLabs [2011.12.18 15:42:58 | 000,000,000 | ---D | M] -- C:\Users\Julian\AppData\Roaming\TS3Client [2012.02.06 13:40:28 | 000,000,316 | ---- | M] () -- C:\Windows\Tasks\ctwb.job [2011.12.28 23:09:36 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > Log von Malwarebytes: Zitat:
Zitat:
|
|
06.02.2012, 20:19
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Google/Yahoo Weiterleitung über thealltimes.com Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt?
__________________Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.
__________________ |
|
07.02.2012, 09:02
| #3 |
| | Google/Yahoo Weiterleitung über thealltimes.com In den vorigen Logs steht das gleiche. Ich habe ihn nur vom Vorabend bis zu dem Morgen 5 mal mit aktualisierter Datenbank laufen lassen, in der Hoffnung, dass dadurch der Störenfried gefunden wird. Nie wurde etwas schadhaftes gefunden oder gar gefixed.
__________________ |
|
07.02.2012, 12:24
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Google/Yahoo Weiterleitung über thealltimes.com Führ bitte auch ESET aus, danach sehen wir weiter: ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
08.02.2012, 16:43
| #5 |
| | Google/Yahoo Weiterleitung über thealltimes.com Hi, also auch dieser Scanner hatte nichts gefunden. Der Kumpel hat den Laptop jetzt mittlerweile formatiert. War ja eh unumgänglich. Hätte mich nur interessiert, was das für ein Ding war, das sich vor jedem Scanner verstecken konnte sogar mit Updates von gestern. Auch Bootsektorscanner haben nichts gefunden, also keine Ahnung, wo sich das Ding verkrochen hat. Bitte jetzt nicht schreien, warum ich derartige Dinger benutzt habe: Ich habe Informatik studiert und traue mir durchaus bißchen was bzgl. PCs zu, war also kein "Ich probiere einfach mal bißchen aus"-Test Danke für die Hilfeversuche Arne. |
|
| Themen zu Google/Yahoo Weiterleitung über thealltimes.com |
| 64-bit, antivir, asus, autorun, avira, bho, dateisystem, defender, desktop, device driver, error, explorer, firefox, format, gdata, heuristiks/extra, heuristiks/shuriken, iexplore, langs, logfile, mozilla, nodrives, nvidia, officejet, opera, plug-in, programme, prozesse, realtek, registry, safer networking, security, software, thealltimes.com, usb, version=1.0, windows |
Linear-Darstellung
