| |
| |||||||
Log-Analyse und Auswertung: Bundeskriminalamttrojaner auf dem Rechner - EXP/java.dldr.AWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
23.02.2012, 12:53
| #1 |
 |  Bundeskriminalamttrojaner auf dem Rechner - EXP/java.dldr.A Hey Leute, ich war im Netz und beim öffnen einer Seite wurde mir plötzlich der Screen mit einem Fake Bilder des BKA´s geliefert, alles hing und nichts ging mehr. Nach dem Neustart war alles normal, doch nach einigen Sekunden ging das Internet wieder auf und das Selbe Bild. In diesem Forum habe ich gelesen, dass ich im Abgesichertem Modus meine Daten retten kann, dass habe ich bis jetzt auch so gut es ging getan. Nach folgender Anleitung bin ich vor gegangen: hxxp://www.redirect301.de/bundespolizei-trojaner-entfernen.html leider bin ich nur bis Punkt 8 gekommen. Dort sollte ich Pfad Virus löschen usw klicken, doch da war ich dann Machtlos, ich habe leider nicht soviel erfahrungen mit solchen sachen. Deshalb habe ich das abgebrochen. Jedenfalls wollte ich heute den Lappi im Abgesicherten Modus Starten, hab zu spät reagiert und somit ist er normal hoch gefahren. Plötzlich, Alles wieder IO ...ich schaltete sofort den Task-Manager ein und schloss alle mir unbekannten exe Anwendungen. Ja und nun kann ich von diesem Rechner aus alles machen. Ich habe einmal Antivier drüber laufen lassen und folgende meldung bekommen: Code:
ATTFilter
Avira AntiVir Personal
Erstellungsdatum der Reportdatei: Donnerstag, 23. Februar 2012 10:45
Es wird nach 3448049 Virenstämmen gesucht.
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : Avira AntiVir Personal - Free Antivirus
Seriennummer : 0000149996-ADJIE-0000001
Plattform : Windows 7 x64
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : Melly Schulz
Computername : MELLYSCHULZ-PC
Versionsinformationen:
BUILD.DAT : 10.2.0.704 Bytes 28.09.2011 13:14:00
AVSCAN.EXE : 10.3.0.7 484008 Bytes 02.07.2011 11:32:33
AVSCAN.DLL : 10.0.5.0 57192 Bytes 02.07.2011 11:32:33
LUKE.DLL : 10.3.0.5 45416 Bytes 02.07.2011 11:32:34
LUKERES.DLL : 10.0.0.0 13672 Bytes 14.01.2010 12:22:40
AVSCPLR.DLL : 10.3.0.7 119656 Bytes 02.07.2011 11:32:34
AVREG.DLL : 10.3.0.9 88833 Bytes 02.08.2011 04:58:17
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 10:49:21
VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 05:52:59
VBASE002.VDF : 7.11.19.170 14374912 Bytes 20.12.2011 19:26:04
VBASE003.VDF : 7.11.21.238 4472832 Bytes 01.02.2012 17:34:47
VBASE004.VDF : 7.11.21.239 2048 Bytes 01.02.2012 17:35:29
VBASE005.VDF : 7.11.21.240 2048 Bytes 01.02.2012 17:35:29
VBASE006.VDF : 7.11.21.241 2048 Bytes 01.02.2012 17:35:30
VBASE007.VDF : 7.11.21.242 2048 Bytes 01.02.2012 17:35:30
VBASE008.VDF : 7.11.21.243 2048 Bytes 01.02.2012 17:35:30
VBASE009.VDF : 7.11.21.244 2048 Bytes 01.02.2012 17:35:30
VBASE010.VDF : 7.11.21.245 2048 Bytes 01.02.2012 17:35:30
VBASE011.VDF : 7.11.21.246 2048 Bytes 01.02.2012 17:35:30
VBASE012.VDF : 7.11.21.247 2048 Bytes 01.02.2012 17:35:31
VBASE013.VDF : 7.11.22.33 1486848 Bytes 03.02.2012 18:35:19
VBASE014.VDF : 7.11.22.56 687616 Bytes 03.02.2012 18:35:57
VBASE015.VDF : 7.11.22.92 178176 Bytes 06.02.2012 18:36:02
VBASE016.VDF : 7.11.22.154 144896 Bytes 08.02.2012 18:36:06
VBASE017.VDF : 7.11.22.155 2048 Bytes 08.02.2012 18:36:06
VBASE018.VDF : 7.11.22.156 2048 Bytes 08.02.2012 18:36:06
VBASE019.VDF : 7.11.22.157 2048 Bytes 08.02.2012 18:36:06
VBASE020.VDF : 7.11.22.158 2048 Bytes 08.02.2012 18:36:06
VBASE021.VDF : 7.11.22.159 2048 Bytes 08.02.2012 18:36:06
VBASE022.VDF : 7.11.22.160 2048 Bytes 08.02.2012 18:36:06
VBASE023.VDF : 7.11.22.161 2048 Bytes 08.02.2012 18:36:07
VBASE024.VDF : 7.11.22.162 2048 Bytes 08.02.2012 18:36:07
VBASE025.VDF : 7.11.22.163 2048 Bytes 08.02.2012 18:36:07
VBASE026.VDF : 7.11.22.164 2048 Bytes 08.02.2012 18:36:08
VBASE027.VDF : 7.11.22.165 2048 Bytes 08.02.2012 18:36:08
VBASE028.VDF : 7.11.22.166 2048 Bytes 08.02.2012 18:36:08
VBASE029.VDF : 7.11.22.167 2048 Bytes 08.02.2012 18:36:08
VBASE030.VDF : 7.11.22.168 2048 Bytes 08.02.2012 18:36:08
VBASE031.VDF : 7.11.22.206 139776 Bytes 10.02.2012 18:36:16
Engineversion : 8.2.8.54
AEVDF.DLL : 8.1.2.2 106868 Bytes 06.11.2011 17:51:09
AESCRIPT.DLL : 8.1.4.5 442745 Bytes 11.02.2012 18:39:46
AESCN.DLL : 8.1.8.2 131444 Bytes 02.02.2012 17:37:14
AESBX.DLL : 8.2.4.5 434549 Bytes 28.12.2011 19:28:39
AERDL.DLL : 8.1.9.15 639348 Bytes 03.10.2011 07:12:19
AEPACK.DLL : 8.2.16.3 799094 Bytes 11.02.2012 18:39:25
AEOFFICE.DLL : 8.1.2.25 201084 Bytes 22.01.2012 18:29:18
AEHEUR.DLL : 8.1.3.27 4391285 Bytes 11.02.2012 18:38:54
AEHELP.DLL : 8.1.19.0 254327 Bytes 22.01.2012 18:29:15
AEGEN.DLL : 8.1.5.21 409971 Bytes 11.02.2012 18:36:22
AEEMU.DLL : 8.1.3.0 393589 Bytes 21.04.2011 05:52:17
AECORE.DLL : 8.1.25.3 201079 Bytes 02.02.2012 17:35:42
AEBB.DLL : 8.1.1.0 53618 Bytes 21.04.2011 05:52:16
AVWINLL.DLL : 10.0.0.0 19304 Bytes 21.04.2011 05:52:39
AVPREF.DLL : 10.0.3.2 44904 Bytes 02.07.2011 11:32:33
AVREP.DLL : 10.0.0.10 174120 Bytes 02.07.2011 11:32:34
AVARKT.DLL : 10.0.26.1 255336 Bytes 02.07.2011 11:32:33
AVEVTLOG.DLL : 10.0.0.9 203112 Bytes 02.07.2011 11:32:33
SQLITE3.DLL : 3.6.19.0 355688 Bytes 28.01.2010 11:59:50
AVSMTP.DLL : 10.0.0.17 63848 Bytes 21.04.2011 05:52:38
NETNT.DLL : 10.0.0.0 11624 Bytes 21.04.2011 05:52:50
RCIMAGE.DLL : 10.0.0.35 2589544 Bytes 02.07.2011 11:32:33
RCTEXT.DLL : 10.0.64.0 98664 Bytes 02.07.2011 11:32:33
Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Lokale Laufwerke
Konfigurationsdatei...................: C:\Program Files (x86)\Avira\AntiVir Desktop\alldrives.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:, F:, G:, E:,
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: aus
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Intelligente Dateiauswahl
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert
Beginn des Suchlaufs: Donnerstag, 23. Februar 2012 10:45
Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'avscan.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'RocketDock.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'LightScribeControlPanel.exe' - '1' Modul(e) wurden durchsucht
Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
[INFO] Es wurde kein Virus gefunden!
[INFO] Bitte starten Sie den Suchlauf erneut mit Administratorrechten
Masterbootsektor HD1
[INFO] Es wurde kein Virus gefunden!
Masterbootsektor HD2
[INFO] Es wurde kein Virus gefunden!
[INFO] Bitte starten Sie den Suchlauf erneut mit Administratorrechten
Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
[INFO] Es wurde kein Virus gefunden!
[INFO] Bitte starten Sie den Suchlauf erneut mit Administratorrechten
Bootsektor 'D:\'
[INFO] Es wurde kein Virus gefunden!
[INFO] Bitte starten Sie den Suchlauf erneut mit Administratorrechten
Bootsektor 'F:\'
[INFO] Im Laufwerk 'F:\' ist kein Datenträger eingelegt!
Bootsektor 'G:\'
[INFO] Es wurde kein Virus gefunden!
Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '150' Dateien ).
Der Suchlauf über die ausgewählten Dateien wird begonnen:
Beginne mit der Suche in 'C:\'
C:\Users\Melly Schulz\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22\52e312d6-13c2fcb9
[0] Archivtyp: ZIP
--> json/Parser.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/Java.Dldr.A
Beginne mit der Suche in 'D:\'
Der zu durchsuchende Pfad D:\ konnte nicht geöffnet werden!
Systemfehler [1005]: Auf dem Datenträger befindet sich kein erkanntes Dateisystem.
Beginne mit der Suche in 'F:\'
Der zu durchsuchende Pfad F:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.
Beginne mit der Suche in 'G:\' <Intenso>
Beginne mit der Suche in 'E:\'
Der zu durchsuchende Pfad E:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.
Beginne mit der Desinfektion:
C:\Users\Melly Schulz\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22\52e312d6-13c2fcb9
[FUND] Enthält Erkennungsmuster des Exploits EXP/Java.Dldr.A
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '49b6b5cb.qua' verschoben!
Ende des Suchlaufs: Donnerstag, 23. Februar 2012 11:26
Benötigte Zeit: 40:29 Minute(n)
Der Suchlauf wurde vollständig durchgeführt.
27872 Verzeichnisse wurden überprüft
335196 Dateien wurden geprüft
1 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
1 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
335195 Dateien ohne Befall
1471 Archive wurden durchsucht
0 Warnungen
1 Hinweise
nun habe ich wie hier schon gelesen mir das Programm Maleware runter geladen und folgendes Ergebnis erhalten: Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.60.1.1000 www.malwarebytes.org Datenbank Version: v2012.02.23.01 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Melly Schulz :: MELLYSCHULZ-PC [Administrator] Schutz: Aktiviert 23.02.2012 12:24:59 mbam-log-2012-02-23 (12-24-59).txt Art des Suchlaufs: Flash-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: Registrierung | Dateisystem | P2P Durchsuchte Objekte: 164149 Laufzeit: 26 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 1 C:\Users\Melly Schulz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0.459932856992547867f76.exe.lnk (Backdoor.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) ist das Problem nun behoben? Wäre nett wenn mir jemand da ein wenig helfen kann! Lg Thomas Geändert von cosinus (23.02.2012 um 14:46 Uhr) |
|
23.02.2012, 14:34
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Bundeskriminalamttrojaner auf dem Rechner - EXP/java.dldr.A Die Logs sind in CODE-Tags zu posten, nicht in PHP-Tags!
__________________Funktioniert nun der normale Modus wieder oder gehts nur im abgesicherten mit Netzwerk?
__________________ |
|
23.02.2012, 14:40
| #3 |
| | Bundeskriminalamttrojaner auf dem Rechner - EXP/java.dldr.A Hey Arne,
__________________erstmal Danke für die schnelle Antwort, des weitern war mir nicht bewusst ob PHP oder Code-Tags...Sorry. Soll ich es nochmal posten? Des weiteren kann ich nur sagen, dass bevor ich die Programme laufen lassen habe, alles wieder funktionierte... Wie kommt das? Also Probleme habe ich nichtmehr? Is es damit behoben? |
|
23.02.2012, 14:47
| #4 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Bundeskriminalamttrojaner auf dem Rechner - EXP/java.dldr.A Ich habs für dich geändert  Zitat:
 ???Nach Malwarebytes und AntiVir geht nichts mehr oder wie ist der Satz zu verstehen?
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
23.02.2012, 15:01
| #5 |
| | Bundeskriminalamttrojaner auf dem Rechner - EXP/java.dldr.A Ich glaube ich drücke mich bissl quer aus...! Ich habe mein PC heute wieder gestartet um im Abgesicherten Modus diverse Programme laufen zu lassen... Ich habe aber vergessen F8 zu drücken und der LapTop ist einfach so hoch gefahren. Dann habe ich sofort den TaskManager geöffnet und alle mir Unbekannten exe Datein geschlossen... Ja und dann, ist nichts passiert... also im Sinne von..Kein BKA Trojaner. Mhhh dann habe ich erstmal Antivier laufen lassen und Malwarebytes, beide habe mir das selbe Ergebnis gebracht : " EXp/java.dldr.A " Ja und so bin ich hier gelandet...! Es funktioniert alles... keine Fehler Meldung mehr...nichts...! Aber ich habe nichts gemacht gehabt.! Soll ich die DDS und Attach noch hier rein stellen und wenn ja, wie kann ich das nachträglich machen... |
|
23.02.2012, 15:03
| #6 | |
| | Bundeskriminalamttrojaner auf dem Rechner - EXP/java.dldr.AZitat:
DDS: Code:
ATTFilter .
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_24
Run by Melly Schulz at 14:53:16 on 2012-02-23
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.49.1031.18.3069.1527 [GMT 1:00]
.
AV: AntiVir Desktop *Enabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: AntiVir Desktop *Enabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Windows\system32\Dwm.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Windows\system32\taskhost.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k HsfXAudioService
C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files (x86)\RocketDock\RocketDock.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\explorer.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\DllHost.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://google.de/
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: MyAshampoo Toolbar: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files (x86)\MyAshampoo\prxtbMyAs.dll
mURLSearchHooks: MyAshampoo Toolbar: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files (x86)\MyAshampoo\prxtbMyAs.dll
mWinlogon: Userinit=userinit.exe,
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll
BHO: DivX Plus Web Player HTML5 <video>: {326e768d-4182-46fd-9c16-1449a49795f4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
BHO: DivX HiQ: {593ddec6-7468-4cdd-90e1-42dadaa222e9} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
BHO: Windows Live ID-Anmelde-Hilfsprogramm: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
BHO: MyAshampoo Toolbar: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files (x86)\MyAshampoo\prxtbMyAs.dll
BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: MyAshampoo Toolbar: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files (x86)\MyAshampoo\prxtbMyAs.dll
TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"
uRun: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
uRun: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
uRun: [RocketDock] "C:\Program Files (x86)\RocketDock\RocketDock.exe"
uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
mRun: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
mRunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to Google Photos Screensa&ver - C:\Windows\system32\GPhotos.scr/200
IE: Nach Microsoft &Excel exportieren - C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} - hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{EF38288C-2FC6-47E6-B2E6-9D57D17D1AE2} : DhcpNameServer = 192.168.2.1
TCP: Interfaces\{EF38288C-2FC6-47E6-B2E6-9D57D17D1AE2}\D2444525D2354756E67656C6E61647F627 : DhcpNameServer = 192.168.178.1
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"
{18DF081C-E8AD-4283-A596-FA578C2EBDC3}
{30F9B915-B755-4826-820B-08FBA6BD249D}
{326E768D-4182-46FD-9C16-1449A49795F4}
{53707962-6F74-2D53-2644-206D7942484F}
{593DDEC6-7468-4cdd-90E1-42DADAA222E9}
{9030D464-4C02-4ABF-8ECC-5164760863C6}
{9FDDE16B-836F-4806-AB1F-1455CBEFF289}
{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}
{d2ce3e00-f94a-4740-988e-03dc2f38c34f}
{DBC80044-A445-435b-BC74-9C25C1C588A9}
{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}
{30F9B915-B755-4826-820B-08FBA6BD249D}
{8dcb7100-df86-4384-8842-8fa844297b3f}
mRun-x64: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun-x64: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
mRunOnce-x64: [ Malwarebytes Anti-Malware ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Melly Schulz\AppData\Roaming\Mozilla\Firefox\Profiles\9mpf25v8.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2475029&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - google.de
FF - component: C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\components\kavlinkfilter.dll
FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
FF - plugin: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Picasa2\npPicasa3.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
.
============= SERVICES / DRIVERS ===============
.
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-6-6 64952]
R2 AntiVirSchedulerService;Avira AntiVir Planer;C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2011-7-1 136360]
R2 AntiVirService;Avira AntiVir Guard;C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2011-7-1 269480]
R2 avgntflt;avgntflt;C:\Windows\system32\DRIVERS\avgntflt.sys --> C:\Windows\system32\DRIVERS\avgntflt.sys [?]
R2 HsfXAudioService;HsfXAudioService;C:\Windows\system32\svchost.exe -k HsfXAudioService [2009-7-14 20992]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-2-23 652360]
R2 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-4-29 2218600]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2011-4-29 1153368]
R3 CAXHWAZL;CAXHWAZL;C:\Windows\system32\DRIVERS\CAXHWAZL.sys --> C:\Windows\system32\DRIVERS\CAXHWAZL.sys [?]
R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\system32\drivers\nvhda64v.sys --> C:\Windows\system32\drivers\nvhda64v.sys [?]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-1-31 158856]
S3 BBSvc;Bing Bar Update Service;C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-4-1 183560]
S3 fssfltr;fssfltr;C:\Windows\system32\DRIVERS\fssfltr.sys --> C:\Windows\system32\DRIVERS\fssfltr.sys [?]
S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2011-5-13 1492840]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\system32\drivers\rdpvideominiport.sys --> C:\Windows\system32\drivers\rdpvideominiport.sys [?]
S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL6.SYS --> C:\Windows\system32\DRIVERS\VSTAZL6.SYS [?]
S3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV6.SYS --> C:\Windows\system32\DRIVERS\VSTDPV6.SYS [?]
S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT6.SYS --> C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [?]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== Created Last 30 ================
.
2012-02-23 10:36:16 -------- d-----w- C:\Users\Melly Schulz\AppData\Roaming\Malwarebytes
2012-02-23 10:36:03 -------- d-----w- C:\ProgramData\Malwarebytes
2012-02-23 10:35:59 23152 ----a-w- C:\Windows\System32\drivers\mbam.sys
2012-02-23 10:35:59 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-02-23 10:33:48 8643640 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{6EDFD83D-656E-4CBB-B5C7-112D1592B953}\mpengine.dll
2012-02-23 09:44:45 -------- d-----w- C:\Users\Melly Schulz\AppData\Roaming\Avira
2012-02-23 09:42:30 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{E0A4CE82-644C-4E7A-B91A-4E74169BBCDA}
2012-02-21 14:24:40 -------- d---a-w- C:\Kaspersky Rescue Disk 10.0
2012-02-21 05:57:23 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{67B841EA-AFDE-471B-9D4B-E8F59BBDA3E5}
2012-02-21 05:57:01 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{09C31F26-E6D9-40D7-83B9-179BF91462D9}
2012-02-20 17:56:35 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{9C370476-74A7-4A6D-A20F-970400747BE5}
2012-02-20 17:56:22 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{40ECD04A-60C1-4005-8A04-88DAC0293BD0}
2012-02-20 05:41:56 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{75752E13-01F8-457D-85C1-7EF82DE3BA64}
2012-02-20 05:41:39 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{9CCCD3A0-1C7D-4E81-8A0A-EABCA3AFB565}
2012-02-19 07:14:33 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{331651DF-FE89-44E7-865D-482C209EFCAB}
2012-02-19 07:14:20 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{03C78A8C-AE78-4A4B-BFE2-B2BD1C5FE4A0}
2012-02-18 19:13:48 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{F2B64C9D-403B-43CF-8DB4-0976AF655FE2}
2012-02-18 19:13:26 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{F1BB877F-F635-4648-818A-2CDFB26DD108}
2012-02-18 07:12:58 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{877FD7CC-1AD9-41C3-8B18-7BC27E6087C2}
2012-02-18 07:12:33 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{A3A389B4-1F07-42F6-B454-C352344C4057}
2012-02-17 19:11:49 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{25019F1A-5007-47E0-A53D-958544D1FBFA}
2012-02-17 19:11:29 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{A97ECA4C-014C-43D3-8124-CD5E820E015D}
2012-02-17 06:21:15 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{50509A4F-48DE-4A8C-A7BD-965BED94E35B}
2012-02-17 06:20:52 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{56255C04-A495-475B-87D4-FCE8614EBF93}
2012-02-16 18:19:14 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{D99F1BC7-F923-409F-B42C-0C6C53CA4C9D}
2012-02-16 18:19:01 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{03D26D72-C77A-4348-8063-520083468433}
2012-02-16 05:23:15 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{13D7989B-9C91-4433-ACF2-13092C4AB26C}
2012-02-16 05:23:02 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{17605753-059F-4225-9F95-B3B73E98D12C}
2012-02-15 07:32:52 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{363914B3-7DDA-4E97-B5BC-552F2E5432CA}
2012-02-15 07:32:30 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{22B8FB6C-D250-410D-BA1A-4E4CBBCF5D09}
2012-02-15 05:33:23 509952 ----a-w- C:\Windows\System32\ntshrui.dll
2012-02-15 05:33:23 442880 ----a-w- C:\Windows\SysWow64\ntshrui.dll
2012-02-15 05:33:21 515584 ----a-w- C:\Windows\System32\timedate.cpl
2012-02-15 05:33:21 478720 ----a-w- C:\Windows\SysWow64\timedate.cpl
2012-02-15 05:33:19 498688 ----a-w- C:\Windows\System32\drivers\afd.sys
2012-02-15 05:33:19 3145728 ----a-w- C:\Windows\System32\win32k.sys
2012-02-15 05:33:15 690688 ----a-w- C:\Windows\SysWow64\msvcrt.dll
2012-02-15 05:33:15 634880 ----a-w- C:\Windows\System32\msvcrt.dll
2012-02-14 19:00:39 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{E6BD3058-EBC7-4104-B293-FA6896CE269F}
2012-02-14 19:00:11 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{7B800ABF-A15C-45FC-A3F7-177DBDBD09AC}
2012-02-14 05:18:28 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{11780F96-0A24-453A-849E-235C909543EB}
2012-02-14 05:18:05 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{E7A5F5DF-12C0-4306-931C-F9F5CD3D088E}
2012-02-13 12:01:50 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{1B7ADD8F-E7F9-4592-8E7E-B8CCB2AA15D5}
2012-02-13 12:01:38 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{02D75284-EC5B-4DAD-BA8C-0AC23EEB4AB2}
2012-02-12 21:13:48 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{CEC131C4-0199-4E3A-9543-4415764F297D}
2012-02-12 21:13:25 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{36F2B80D-0102-45A2-846E-393D0CB9A9F5}
2012-02-12 09:12:45 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{63D7F300-EBA7-49AE-8B92-4423F99038CE}
2012-02-12 09:12:32 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{D9004609-E035-4F3E-B902-D1F5D177FC8D}
2012-02-11 18:33:31 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{E3ADEB0F-F338-4007-B9D3-191B1F8345DD}
2012-02-11 18:33:19 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{AFA6AF86-509F-473F-9AA0-F4C710440251}
2012-02-11 18:33:19 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{8594F631-EA07-4688-BD1B-30B55A353B11}
2012-02-10 18:03:57 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{FD8225DA-1000-483A-BA69-DB5F5F12347A}
2012-02-10 18:03:35 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{5E1E3BA7-6B46-44BA-B0E8-6F04AB7E8938}
2012-02-10 06:03:05 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{DD29878F-E03E-440A-AC3C-EDFFDF1BBBC5}
2012-02-10 06:02:53 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{ED452105-AC03-4F02-8AAA-13A56FEFD2E2}
2012-02-09 09:00:09 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{6C413819-65B6-44C7-BE6D-061F29B71409}
2012-02-09 08:59:58 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{6FC044B4-9029-4AE4-8E4A-E5DCB8C09742}
2012-02-08 21:15:19 -------- d-sh--w- C:\Windows\SysWow64\%APPDATA%
2012-02-08 20:59:29 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{B24FF372-F436-479F-A973-43677CF67CD5}
2012-02-08 20:59:07 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{88828542-E43B-4F89-8321-6892C8B3D063}
2012-02-08 11:28:54 -------- d-----r- C:\Program Files (x86)\Skype
2012-02-08 08:58:10 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{03BD65C4-134A-4DD4-B3C4-12C78F79EC70}
2012-02-08 08:57:58 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{5460F2D1-A8EA-46F7-BE42-871B7629E091}
2012-02-08 08:51:52 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{69290E09-F639-4479-AE7F-FCADE042F96F}
2012-02-08 07:49:24 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\{D9078D90-D873-4854-8A6C-8875F75FDC87}
2012-02-07 20:53:28 -------- d-----w- C:\Users\Melly Schulz\Tracing
2012-02-07 20:41:51 -------- d-----w- C:\Windows\de
2012-02-07 20:36:54 -------- d-----w- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2012-02-07 20:33:21 48488 ----a-w- C:\Windows\System32\drivers\fssfltr.sys
2012-02-07 20:31:28 -------- d-----w- C:\Program Files (x86)\Microsoft
2012-02-07 20:31:23 69464 ----a-w- C:\Windows\SysWow64\XAPOFX1_3.dll
2012-02-07 20:31:23 515416 ----a-w- C:\Windows\SysWow64\XAudio2_5.dll
2012-02-07 20:31:22 523088 ----a-w- C:\Windows\System32\d3dx10_42.dll
2012-02-07 20:31:22 453456 ----a-w- C:\Windows\SysWow64\d3dx10_42.dll
2012-02-07 20:31:08 7450888 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\6aac39821cce5d705\bingbarsetup.exe
2012-02-07 20:31:03 4398360 ----a-w- C:\Windows\System32\d3dx9_32.dll
2012-02-07 20:31:03 3426072 ----a-w- C:\Windows\SysWow64\d3dx9_32.dll
2012-02-07 20:30:48 15712 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\6057a0b21cce5d704\MeshBetaRemover.exe
2012-02-07 20:30:31 94040 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\55e6775e1cce5d703\DSETUP.dll
2012-02-07 20:30:31 525656 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\55e6775e1cce5d703\DXSETUP.exe
2012-02-07 20:30:31 1691480 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\55e6775e1cce5d703\dsetup32.dll
2012-02-07 20:30:24 94040 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\515a76781cce5d702\DSETUP.dll
2012-02-07 20:30:24 525656 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\515a76781cce5d702\DXSETUP.exe
2012-02-07 20:30:24 1691480 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\515a76781cce5d702\dsetup32.dll
2012-02-07 20:30:14 6260088 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\4b1f9c811cce5d701\Silverlight.4.0.exe
2012-02-07 20:29:45 -------- d-----w- C:\Users\Melly Schulz\AppData\Local\Windows Live
2012-02-07 20:29:44 -------- d-----w- C:\Program Files (x86)\Common Files\Windows Live
.
==================== Find3M ====================
.
2012-01-29 04:10:42 279656 ------w- C:\Windows\System32\MpSigStub.exe
2011-12-14 07:11:03 2308096 ----a-w- C:\Windows\System32\jscript9.dll
2011-12-14 07:04:30 1390080 ----a-w- C:\Windows\System32\wininet.dll
2011-12-14 07:03:38 1493504 ----a-w- C:\Windows\System32\inetcpl.cpl
2011-12-14 06:57:28 2382848 ----a-w- C:\Windows\System32\mshtml.tlb
2011-12-14 03:04:54 1798656 ----a-w- C:\Windows\SysWow64\jscript9.dll
2011-12-14 02:57:18 1127424 ----a-w- C:\Windows\SysWow64\wininet.dll
2011-12-14 02:56:58 1427456 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2011-12-14 02:50:04 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb
.
============= FINISH: 14:54:21,05 ===============
Code:
ATTFilter . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-08-26.01) . Microsoft Windows 7 Ultimate Boot Device: \Device\HarddiskVolume1 Install Date: 29.04.2011 21:23:52 System Uptime: 23.02.2012 12:21:35 (2 hours ago) . Motherboard: Wistron | | 3616 Processor: Intel(R) Core(TM)2 Duo CPU T5800 @ 2.00GHz | CPU | 2000/800mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 51 GiB total, 20,093 GiB free. E: is CDROM () F: is Removable . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP222: 23.02.2012 11:32:44 - Windows Update . ==== Installed Programs ====================== . Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Reader X (10.1.1) - Deutsch Apple Application Support Apple Software Update Aquamarin Haushaltsbuch 2.9.2 b Ashampoo Photo Commander 9 v.9.2.1 Avira AntiVir Personal - Free Antivirus Bing Bar CloneDVD2 Compatibility Pack für 2007 Office System Conduit Engine D3DX10 DivX-Setup High-Definition Video Playback 10 Java Auto Updater Java(TM) 6 Update 24 Junk Mail filter update LG PC Suite III LG USB Modem Drivers LightScribe System Software Malwarebytes Anti-Malware Version 1.60.1.1000 Mesh Runtime Messenger Companion Microsoft Office Outlook Connector Microsoft Office Professional Edition 2003 Microsoft Primary Interoperability Assemblies 2005 Microsoft Silverlight Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Mozilla Firefox 10.0.2 (x86 de) MSVCRT MSVCRT_amd64 MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MyAshampoo Toolbar Nero 10 Menu TemplatePack Basic Nero 10 Movie ThemePack Basic Nero Burning ROM 10 Nero BurnRights 10 Nero Control Center 10 Nero Core Components 10 Nero Dolby Files 10 Nero Express 10 Nero Multimedia Suite 10 Nero StartSmart 10 NVIDIA 3D Vision Controller Driver NVIDIA PhysX Picasa 3 QuickTime RocketDock 1.3.5 Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Skype™ 5.8 Spybot - Search & Destroy System Requirements Lab Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) VC80CRTRedist - 8.0.50727.4053 Windows Live Communications Platform Windows Live Essentials Windows Live Fotogalerie Windows Live Installer Windows Live Mail Windows Live Mesh Windows Live Mesh ActiveX control for remote connections Windows Live Messenger Windows Live Messenger Companion Core Windows Live Movie Maker Windows Live Photo Common Windows Live Photo Gallery Windows Live PIMT Platform Windows Live SOXE Windows Live SOXE Definitions Windows Live UX Platform Windows Live UX Platform Language Pack Windows Live Writer Windows Live Writer Resources WinRAR Archivierer . ==== End Of File =========================== |
|
23.02.2012, 15:10
| #7 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Bundeskriminalamttrojaner auf dem Rechner - EXP/java.dldr.A Führ bitte auch ESET aus, danach sehen wir weiter: ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten |
|
23.02.2012, 16:41
| #8 |
| | Bundeskriminalamttrojaner auf dem Rechner - EXP/java.dldr.ACode:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=51bba6138040bb499f83642ec3835182
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-02-23 03:29:27
# local_time=2012-02-23 04:29:27 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1797 16775165 100 94 972702 66538832 1017765 0
# compatibility_mode=5893 16776573 100 94 17341 81636819 0 0
# compatibility_mode=8192 67108863 100 0 3775 3775 0 0
# scanned=122734
# found=1
# cleaned=0
# scan_time=4019
C:\Users\Melly Schulz\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0\127a4c40-2cc265b0 Java/TrojanDownloader.Agent.AD trojan (unable to clean) 00000000000000000000000000000000 I
|
|
23.02.2012, 17:38
| #9 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Bundeskriminalamttrojaner auf dem Rechner - EXP/java.dldr.A Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten. Wird so gemacht: [code] hier steht das Log [/code] Und das ganze sieht dann so aus: Code:
ATTFilter hier steht das Log
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
__________________ Logfiles bitte immer in CODE-Tags posten |
|
23.02.2012, 19:49
| #10 |
| | Bundeskriminalamttrojaner auf dem Rechner - EXP/java.dldr.A OTL Logfile: Code:
ATTFilter OTL logfile created on: 23.02.2012 19:33:33 - Run 1 OTL by OldTimer - Version 3.2.33.2 Folder = C:\Users\Melly Schulz\Desktop 64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 1,73 Gb Available Physical Memory | 57,75% Memory free 5,99 Gb Paging File | 4,57 Gb Available in Paging File | 76,29% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 50,68 Gb Total Space | 19,94 Gb Free Space | 39,34% Space Free | Partition Type: NTFS Computer Name: MELLYSCHULZ-PC | User Name: Melly Schulz | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.02.23 19:28:46 | 000,583,680 | ---- | M] (OldTimer Tools) -- C:\Users\Melly Schulz\Desktop\OTL.exe PRC - [2012.01.13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2012.01.13 14:53:18 | 000,460,872 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2011.07.02 12:32:33 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe PRC - [2011.06.06 11:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2011.04.21 06:52:51 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe PRC - [2011.04.21 06:52:36 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe PRC - [2011.04.08 06:14:00 | 002,218,600 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe PRC - [2011.03.28 11:21:16 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE PRC - [2011.03.21 19:56:16 | 001,230,704 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe PRC - [2009.03.05 15:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe PRC - [2009.01.26 14:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe PRC - [2007.09.02 12:58:52 | 000,495,616 | ---- | M] () -- C:\Program Files (x86)\RocketDock\RocketDock.exe ========== Modules (No Company Name) ========== MOD - [2011.09.27 07:23:00 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2011.09.27 07:22:40 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll MOD - [2011.03.21 19:57:34 | 000,096,112 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll MOD - [2011.03.21 19:56:16 | 001,230,704 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe MOD - [2009.06.17 10:40:16 | 007,745,536 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll MOD - [2009.06.17 10:40:16 | 002,121,728 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll MOD - [2009.06.17 10:40:16 | 000,135,168 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll MOD - [2007.09.02 12:58:52 | 000,495,616 | ---- | M] () -- C:\Program Files (x86)\RocketDock\RocketDock.exe MOD - [2007.09.02 12:57:36 | 000,069,632 | ---- | M] () -- C:\Program Files (x86)\RocketDock\RocketDock.dll ========== Win32 Services (SafeList) ========== SRV:64bit: - [2010.09.22 18:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc) SRV:64bit: - [2009.07.14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2012.01.31 15:09:34 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.01.13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2011.07.02 12:32:33 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.06.06 11:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011.04.21 06:52:51 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011.04.08 06:14:00 | 002,218,600 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService) SRV - [2011.04.01 11:14:30 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE -- (BBSvc) SRV - [2011.03.28 11:21:16 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE -- (SeaPort) SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009.04.29 02:21:18 | 000,436,736 | ---- | M] (Conexant Systems, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\XAudio64.dll -- (HsfXAudioService) SRV - [2009.01.26 14:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService) ========== Driver Services (SafeList) ========== DRV:64bit: - [2011.12.10 15:24:08 | 000,023,152 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector) DRV:64bit: - [2011.08.02 17:38:56 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64) DRV:64bit: - [2011.07.02 12:32:34 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2011.07.02 12:32:34 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2011.05.13 15:37:54 | 000,048,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr) DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2011.03.03 16:59:18 | 000,174,184 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA) DRV:64bit: - [2010.12.16 23:58:14 | 000,040,816 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO) DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.11.20 12:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV:64bit: - [2009.10.09 01:41:02 | 001,394,176 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr) DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.10 22:01:11 | 001,485,312 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTDPV6.SYS -- (SrvHsfV92) DRV:64bit: - [2009.06.10 22:01:11 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTCNXT6.SYS -- (SrvHsfWinac) DRV:64bit: - [2009.06.10 22:01:11 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VSTAZL6.SYS -- (SrvHsfHDA) DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.05.18 12:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:64bit: - [2009.04.29 02:21:08 | 000,010,240 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\XAudio64.sys -- (XAudio) DRV:64bit: - [2009.03.01 22:05:32 | 000,187,392 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:64bit: - [2009.02.12 13:24:56 | 001,485,824 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAX_DPV.sys -- (HSF_DPV) DRV:64bit: - [2009.02.12 13:20:56 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAXHWAZL.sys -- (CAXHWAZL) DRV:64bit: - [2009.02.12 13:19:34 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CAX_CNXT.sys -- (winachsf) DRV:64bit: - [2008.10.03 02:40:12 | 000,264,704 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService) DRV:64bit: - [2008.03.28 01:06:00 | 000,324,656 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP) DRV:64bit: - [2006.06.17 21:27:24 | 000,017,024 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\mdmxsdk.sys -- (mdmxsdk) DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\URLSearchHook: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files (x86)\MyAshampoo\prxtbMyAs.dll (Conduit Ltd.) IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1224103868-3582190197-2854413230-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/ IE - HKU\S-1-5-21-1224103868-3582190197-2854413230-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKU\S-1-5-21-1224103868-3582190197-2854413230-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKU\S-1-5-21-1224103868-3582190197-2854413230-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B0 8D DD 60 21 16 CC 01 [binary data] IE - HKU\S-1-5-21-1224103868-3582190197-2854413230-1001\..\URLSearchHook: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files (x86)\MyAshampoo\prxtbMyAs.dll (Conduit Ltd.) IE - HKU\S-1-5-21-1224103868-3582190197-2854413230-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1224103868-3582190197-2854413230-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultthis.engineName: "MyAshampoo Customized Web Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2475029&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.startup.homepage: "google.de" FF - prefs.js..extensions.enabledItems: linkfilter@kaspersky.ru:11.0.2.556 FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94 FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Picasa2\npPicasa3.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video [2011.04.29 21:04:33 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa [2011.04.29 21:04:33 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.02.17 15:58:12 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.11.02 21:48:51 | 000,000,000 | ---D | M] [2011.04.29 20:51:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Melly Schulz\AppData\Roaming\mozilla\Extensions [2012.02.15 07:33:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions [2012.02.15 07:33:00 | 000,000,000 | ---D | M] (MyAshampoo Community Toolbar) -- C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} [2011.05.22 18:59:09 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\engine@conduit.com [2011.03.24 12:03:00 | 000,000,923 | ---- | M] () -- C:\Users\Melly Schulz\AppData\Roaming\Mozilla\Firefox\Profiles\9mpf25v8.default\searchplugins\conduit.xml [2011.11.10 18:53:22 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012.02.17 15:58:12 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2011.02.02 20:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2012.01.12 19:49:29 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.01.12 19:49:29 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012.01.12 19:49:29 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2012.01.12 19:49:29 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012.01.12 19:49:29 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012.01.12 19:49:29 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2011.04.29 21:16:57 | 000,433,294 | R--- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 127.0.0.1 1-2005-search.com O1 - Hosts: 127.0.0.1 123fporn.info O1 - Hosts: 14910 more lines... O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.) O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited) O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) O2 - BHO: (MyAshampoo Toolbar) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files (x86)\MyAshampoo\prxtbMyAs.dll (Conduit Ltd.) O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) O3 - HKLM\..\Toolbar: (MyAshampoo Toolbar) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files (x86)\MyAshampoo\prxtbMyAs.dll (Conduit Ltd.) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-1224103868-3582190197-2854413230-1001..\Run: [RocketDock] C:\Program Files (x86)\RocketDock\RocketDock.exe () O4 - HKU\S-1-5-21-1224103868-3582190197-2854413230-1001..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.) O4 - HKU\S-1-5-21-1224103868-3582190197-2854413230-1004..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-21-1224103868-3582190197-2854413230-1004..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found O8:64bit: - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.) O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 File not found O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class) O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab (NVIDIA Smart Scan) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EF38288C-2FC6-47E6-B2E6-9D57D17D1AE2}: DhcpNameServer = 192.168.2.1 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\mso-offdap - No CLSID value found O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18:64bit: - Protocol\Filter\text/xml - No CLSID value found O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) SafeBootMin:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) SafeBootMin:64bit: Base - Driver Group SafeBootMin:64bit: Boot Bus Extender - Driver Group SafeBootMin:64bit: Boot file system - Driver Group SafeBootMin:64bit: File system - Driver Group SafeBootMin:64bit: Filter - Driver Group SafeBootMin:64bit: HelpSvc - Service SafeBootMin:64bit: PCI Configuration - Driver Group SafeBootMin:64bit: PNP Filter - Driver Group SafeBootMin:64bit: Primary disk - Driver Group SafeBootMin:64bit: sacsvr - Service SafeBootMin:64bit: SCSI Class - Driver Group SafeBootMin:64bit: System Bus Extender - Driver Group SafeBootMin:64bit: vmms - Service SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: vmms - Service SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) SafeBootNet:64bit: Base - Driver Group SafeBootNet:64bit: Boot Bus Extender - Driver Group SafeBootNet:64bit: Boot file system - Driver Group SafeBootNet:64bit: File system - Driver Group SafeBootNet:64bit: Filter - Driver Group SafeBootNet:64bit: HelpSvc - Service SafeBootNet:64bit: Messenger - Service SafeBootNet:64bit: NDIS Wrapper - Driver Group SafeBootNet:64bit: NetBIOSGroup - Driver Group SafeBootNet:64bit: NetDDEGroup - Driver Group SafeBootNet:64bit: Network - Driver Group SafeBootNet:64bit: NetworkProvider - Driver Group SafeBootNet:64bit: PCI Configuration - Driver Group SafeBootNet:64bit: PNP Filter - Driver Group SafeBootNet:64bit: PNP_TDI - Driver Group SafeBootNet:64bit: Primary disk - Driver Group SafeBootNet:64bit: rdsessmgr - Service SafeBootNet:64bit: sacsvr - Service SafeBootNet:64bit: SCSI Class - Driver Group SafeBootNet:64bit: Streams Drivers - Driver Group SafeBootNet:64bit: System Bus Extender - Driver Group SafeBootNet:64bit: TDI - Driver Group SafeBootNet:64bit: vmms - Service SafeBootNet:64bit: WudfUsbccidDriver - Driver SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: Messenger - Service SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: vmms - Service SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe" ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.) Drivers32: vidc.DIVX - C:\Windows\SysWow64\DivX.dll (DivX, Inc.) Drivers32: vidc.yv12 - C:\Windows\SysWow64\DivX.dll (DivX, Inc.) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2012.02.23 19:28:43 | 000,583,680 | ---- | C] (OldTimer Tools) -- C:\Users\Melly Schulz\Desktop\OTL.exe [2012.02.23 19:26:36 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{81D7CCD8-90FE-4670-9724-E4322C7136D7} [2012.02.23 19:26:10 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{C8808FBD-5326-4E09-AEA9-3627D194B8CE} [2012.02.23 15:19:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET [2012.02.23 11:36:16 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Roaming\Malwarebytes [2012.02.23 11:36:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.02.23 11:36:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.02.23 11:35:59 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.02.23 11:35:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2012.02.23 10:44:45 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Roaming\Avira [2012.02.23 10:42:30 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{E0A4CE82-644C-4E7A-B91A-4E74169BBCDA} [2012.02.21 15:24:40 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0 [2012.02.21 06:57:23 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{67B841EA-AFDE-471B-9D4B-E8F59BBDA3E5} [2012.02.21 06:57:01 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{09C31F26-E6D9-40D7-83B9-179BF91462D9} [2012.02.20 18:56:35 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{9C370476-74A7-4A6D-A20F-970400747BE5} [2012.02.20 18:56:22 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{40ECD04A-60C1-4005-8A04-88DAC0293BD0} [2012.02.20 06:41:56 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{75752E13-01F8-457D-85C1-7EF82DE3BA64} [2012.02.20 06:41:39 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{9CCCD3A0-1C7D-4E81-8A0A-EABCA3AFB565} [2012.02.19 08:14:33 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{331651DF-FE89-44E7-865D-482C209EFCAB} [2012.02.19 08:14:20 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{03C78A8C-AE78-4A4B-BFE2-B2BD1C5FE4A0} [2012.02.18 20:13:48 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{F2B64C9D-403B-43CF-8DB4-0976AF655FE2} [2012.02.18 20:13:26 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{F1BB877F-F635-4648-818A-2CDFB26DD108} [2012.02.18 08:12:58 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{877FD7CC-1AD9-41C3-8B18-7BC27E6087C2} [2012.02.18 08:12:33 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{A3A389B4-1F07-42F6-B454-C352344C4057} [2012.02.17 20:11:49 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{25019F1A-5007-47E0-A53D-958544D1FBFA} [2012.02.17 20:11:29 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{A97ECA4C-014C-43D3-8124-CD5E820E015D} [2012.02.17 07:21:15 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{50509A4F-48DE-4A8C-A7BD-965BED94E35B} [2012.02.17 07:20:52 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{56255C04-A495-475B-87D4-FCE8614EBF93} [2012.02.16 19:19:14 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{D99F1BC7-F923-409F-B42C-0C6C53CA4C9D} [2012.02.16 19:19:01 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{03D26D72-C77A-4348-8063-520083468433} [2012.02.16 06:23:15 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{13D7989B-9C91-4433-ACF2-13092C4AB26C} [2012.02.16 06:23:02 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{17605753-059F-4225-9F95-B3B73E98D12C} [2012.02.15 08:32:52 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{363914B3-7DDA-4E97-B5BC-552F2E5432CA} [2012.02.15 08:32:30 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{22B8FB6C-D250-410D-BA1A-4E4CBBCF5D09} [2012.02.14 20:00:39 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{E6BD3058-EBC7-4104-B293-FA6896CE269F} [2012.02.14 20:00:11 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{7B800ABF-A15C-45FC-A3F7-177DBDBD09AC} [2012.02.14 06:18:28 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{11780F96-0A24-453A-849E-235C909543EB} [2012.02.14 06:18:05 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{E7A5F5DF-12C0-4306-931C-F9F5CD3D088E} [2012.02.13 14:17:57 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\Documents\Meine empfangenen Dateien [2012.02.13 13:01:50 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{1B7ADD8F-E7F9-4592-8E7E-B8CCB2AA15D5} [2012.02.13 13:01:38 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{02D75284-EC5B-4DAD-BA8C-0AC23EEB4AB2} [2012.02.12 22:13:48 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{CEC131C4-0199-4E3A-9543-4415764F297D} [2012.02.12 22:13:25 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{36F2B80D-0102-45A2-846E-393D0CB9A9F5} [2012.02.12 10:12:45 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{63D7F300-EBA7-49AE-8B92-4423F99038CE} [2012.02.12 10:12:32 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{D9004609-E035-4F3E-B902-D1F5D177FC8D} [2012.02.11 19:33:31 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{E3ADEB0F-F338-4007-B9D3-191B1F8345DD} [2012.02.11 19:33:19 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{AFA6AF86-509F-473F-9AA0-F4C710440251} [2012.02.11 19:33:19 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{8594F631-EA07-4688-BD1B-30B55A353B11} [2012.02.10 19:03:57 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{FD8225DA-1000-483A-BA69-DB5F5F12347A} [2012.02.10 19:03:35 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{5E1E3BA7-6B46-44BA-B0E8-6F04AB7E8938} [2012.02.10 07:03:05 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{DD29878F-E03E-440A-AC3C-EDFFDF1BBBC5} [2012.02.10 07:02:53 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{ED452105-AC03-4F02-8AAA-13A56FEFD2E2} [2012.02.09 10:00:09 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{6C413819-65B6-44C7-BE6D-061F29B71409} [2012.02.09 09:59:58 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{6FC044B4-9029-4AE4-8E4A-E5DCB8C09742} [2012.02.08 22:15:19 | 000,000,000 | -HSD | C] -- C:\Windows\SysWow64\%APPDATA% [2012.02.08 21:59:29 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{B24FF372-F436-479F-A973-43677CF67CD5} [2012.02.08 21:59:07 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{88828542-E43B-4F89-8321-6892C8B3D063} [2012.02.08 12:29:06 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Roaming\Skype [2012.02.08 12:28:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype [2012.02.08 12:28:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype [2012.02.08 12:28:54 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype [2012.02.08 12:28:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype [2012.02.08 09:58:10 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{03BD65C4-134A-4DD4-B3C4-12C78F79EC70} [2012.02.08 09:57:58 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{5460F2D1-A8EA-46F7-BE42-871B7629E091} [2012.02.08 09:51:52 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{69290E09-F639-4479-AE7F-FCADE042F96F} [2012.02.08 08:49:24 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\{D9078D90-D873-4854-8A6C-8875F75FDC87} [2012.02.07 21:53:28 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\Tracing [2012.02.07 21:41:51 | 000,000,000 | ---D | C] -- C:\Windows\de [2012.02.07 21:36:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft SQL Server Compact Edition [2012.02.07 21:33:21 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live [2012.02.07 21:33:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Windows Live [2012.02.07 21:32:39 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live [2012.02.07 21:31:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft [2012.02.07 21:30:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight [2012.02.07 21:30:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight [2012.02.07 21:29:45 | 000,000,000 | ---D | C] -- C:\Users\Melly Schulz\AppData\Local\Windows Live [2012.02.07 21:29:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Windows Live ========== Files - Modified Within 30 Days ========== [2012.02.23 19:29:56 | 000,014,192 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.02.23 19:29:56 | 000,014,192 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.02.23 19:28:46 | 000,583,680 | ---- | M] (OldTimer Tools) -- C:\Users\Melly Schulz\Desktop\OTL.exe [2012.02.23 19:24:38 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.02.23 19:24:37 | 2413,711,360 | -HS- | M] () -- C:\hiberfil.sys [2012.02.23 14:36:52 | 001,524,620 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.02.23 14:36:52 | 000,664,700 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.02.23 14:36:52 | 000,625,060 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.02.23 14:36:52 | 000,133,852 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.02.23 14:36:52 | 000,109,442 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.02.23 11:36:05 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.02.21 13:19:48 | 257,540,096 | ---- | M] () -- C:\Users\Melly Schulz\Desktop\kav_rescue_10.iso [2012.02.15 19:54:23 | 000,415,640 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.02.08 12:28:56 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk ========== Files Created - No Company Name ========== [2012.02.23 11:36:05 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.02.23 10:48:17 | 257,540,096 | ---- | C] () -- C:\Users\Melly Schulz\Desktop\kav_rescue_10.iso [2012.02.08 12:28:56 | 000,002,517 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk [2012.02.07 21:38:13 | 000,001,305 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Movie Maker.lnk [2012.02.07 21:37:37 | 000,001,374 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Photo Gallery.lnk [2012.02.07 21:36:14 | 000,001,458 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk [2012.02.07 21:35:34 | 000,002,486 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk [2011.11.06 22:08:24 | 000,000,085 | -HS- | C] () -- C:\ProgramData\.zreglib [2011.05.28 19:23:21 | 000,037,053 | ---- | C] () -- C:\Users\Melly Schulz\AppData\Roaming\Kommagetrennte Werte (DOS).ADR [2011.05.28 19:09:51 | 000,037,057 | ---- | C] () -- C:\Users\Melly Schulz\AppData\Roaming\Kommagetrennte Werte (Windows).ADR [2011.05.10 19:14:16 | 000,004,096 | -H-- | C] () -- C:\Users\Melly Schulz\AppData\Local\keyfile3.drm [2011.04.30 16:48:49 | 000,003,584 | ---- | C] () -- C:\Users\Melly Schulz\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.04.29 21:42:45 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI ========== LOP Check ========== [2012.01.12 21:09:07 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\Aquamarin Haushaltsbuch [2011.05.22 18:59:16 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\Ashampoo [2011.05.28 09:47:55 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\LG Electronics [2012.01.07 09:34:49 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2011.05.06 19:47:02 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\Adobe [2011.05.27 20:31:56 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\Apple Computer [2012.01.12 21:09:07 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\Aquamarin Haushaltsbuch [2011.05.22 18:59:16 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\Ashampoo [2012.02.23 10:44:45 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\Avira [2011.04.29 21:04:18 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\DivX [2011.04.29 20:33:50 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\Identities [2011.05.28 09:40:05 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\InstallShield [2011.05.28 09:47:55 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\LG Electronics [2011.04.30 08:21:14 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\Macromedia [2012.02.23 11:36:16 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\Malwarebytes [2009.07.14 19:18:19 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\Media Center Programs [2012.02.07 21:44:51 | 000,000,000 | --SD | M] -- C:\Users\Melly Schulz\AppData\Roaming\Microsoft [2011.04.29 20:51:40 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\Mozilla [2011.04.29 22:01:35 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\Nero [2012.02.23 19:33:10 | 000,000,000 | ---D | M] -- C:\Users\Melly Schulz\AppData\Roaming\Skype < %APPDATA%\*.exe /s > < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys [2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys [2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys [2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys < MD5 for: ATAPI.SYS > [2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys [2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys [2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys [2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys < MD5 for: CNGAUDIT.DLL > [2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll [2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll [2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll [2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll < MD5 for: IASTORV.SYS > [2010.11.20 14:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys [2010.11.20 14:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys [2011.03.11 07:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys [2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys [2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys [2011.03.11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys [2011.03.11 07:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys [2011.03.11 07:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys [2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys < MD5 for: NETLOGON.DLL > [2009.07.14 02:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll [2010.11.20 14:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll [2010.11.20 14:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll [2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll [2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll [2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll < MD5 for: NVSTOR.SYS > [2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys [2011.03.11 07:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys [2011.03.11 07:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys [2011.03.11 07:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys [2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys [2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys [2011.03.11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys [2010.11.20 14:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys [2010.11.20 14:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys < MD5 for: SCECLI.DLL > [2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll [2009.07.14 02:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll [2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll [2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll [2010.11.20 14:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll [2010.11.20 14:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll < MD5 for: USER32.DLL > [2010.11.20 13:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll [2010.11.20 13:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll [2009.07.14 02:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll [2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll [2010.11.20 14:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll [2010.11.20 14:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll < MD5 for: USERINIT.EXE > [2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe [2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe [2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe [2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe [2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe [2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe < MD5 for: WININIT.EXE > [2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe [2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe [2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe [2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe < MD5 for: WINLOGON.EXE > [2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe [2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe [2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe [2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe [2009.10.28 08:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe [2009.10.28 07:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe < MD5 for: WS2IFSL.SYS > [2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys [2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [2011.12.14 04:10:13 | 009,705,472 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\ieframe.dll [2010.11.20 13:19:56 | 001,236,992 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\msxml3.dll < > < End of report > |
|
23.02.2012, 21:12
| #11 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Bundeskriminalamttrojaner auf dem Rechner - EXP/java.dldr.AZitat:
Wenn ja: in Zukunft Finger weg, diese illegalen Portale verbreiten Malware und wenn du in Zukunft malwarefrei sein wilst, musst du auf legale Alternativen ausweichen und auf solche riskanten Streamingseiten verzichten!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
23.02.2012, 22:00
| #12 |
| | Bundeskriminalamttrojaner auf dem Rechner - EXP/java.dldr.A Naja, ab und an mal OnlineStream zwecks Sky Bundesliga... aber nun haben wir Sky und das ist eigentlich erledigt. Uhrsprünglich wollte ich mir für mein LG nen Update ziehen und diverse Programme...! Aber nix was jetzt Illegal erschien oder der gleichen...! Doch wie kannst du mir jetzt helfen? Is das ding nun weg, kann mir der Trojaner noch gefährlich werden? |
|
24.02.2012, 09:02
| #13 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Bundeskriminalamttrojaner auf dem Rechner - EXP/java.dldr.A Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!) Code:
ATTFilter :OTL
IE - HKLM\..\URLSearchHook: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files (x86)\MyAshampoo\prxtbMyAs.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-1224103868-3582190197-2854413230-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-1224103868-3582190197-2854413230-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-1224103868-3582190197-2854413230-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B0 8D DD 60 21 16 CC 01 [binary data]
IE - HKU\S-1-5-21-1224103868-3582190197-2854413230-1001\..\URLSearchHook: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files (x86)\MyAshampoo\prxtbMyAs.dll (Conduit Ltd.)
FF - prefs.js..browser.search.defaultthis.engineName: "MyAshampoo Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2475029&SearchSource=3&q={searchTerms}"
[2012.02.15 07:33:00 | 000,000,000 | ---D | M] (MyAshampoo Community Toolbar) -- C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}
[2011.05.22 18:59:09 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\engine@conduit.com
[2011.03.24 12:03:00 | 000,000,923 | ---- | M] () -- C:\Users\Melly Schulz\AppData\Roaming\Mozilla\Firefox\Profiles\9mpf25v8.default\searchplugins\conduit.xml
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (MyAshampoo Toolbar) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files (x86)\MyAshampoo\prxtbMyAs.dll (Conduit Ltd.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (MyAshampoo Toolbar) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files (x86)\MyAshampoo\prxtbMyAs.dll (Conduit Ltd.)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-21-1224103868-3582190197-2854413230-1004..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
:Files
C:\Users\Melly Schulz\AppData\Local\{*
:Commands
[emptytemp]
[resethosts]
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet. Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt. Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
24.02.2012, 09:50
| #14 |
| | Bundeskriminalamttrojaner auf dem Rechner - EXP/java.dldr.A Das wäre dann auch erledigt! Was ist nun zu tun? Nochmal alles Scans mit AntiVir und Malewarebyts durchlaufen lassen? Code:
ATTFilter All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\ deleted successfully.
C:\Program Files (x86)\MyAshampoo\prxtbMyAs.dll moved successfully.
HKU\S-1-5-21-1224103868-3582190197-2854413230-1001\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache| /E : value set successfully!
HKU\S-1-5-21-1224103868-3582190197-2854413230-1001\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache AcceptLangs| /E : value set successfully!
HKU\S-1-5-21-1224103868-3582190197-2854413230-1001\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache_TIMESTAMP| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-1224103868-3582190197-2854413230-1001\Software\Microsoft\Internet Explorer\URLSearchHooks\\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\ not found.
File C:\Program Files (x86)\MyAshampoo\prxtbMyAs.dll not found.
Prefs.js: "MyAshampoo Customized Web Search" removed from browser.search.defaultthis.engineName
Prefs.js: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2475029&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl
C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\searchplugin folder moved successfully.
C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\modules folder moved successfully.
C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\META-INF folder moved successfully.
C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\defaults folder moved successfully.
C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\components folder moved successfully.
C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\chrome folder moved successfully.
C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} folder moved successfully.
C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\engine@conduit.com\searchplugin folder moved successfully.
C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\engine@conduit.com\META-INF folder moved successfully.
C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\engine@conduit.com\lib folder moved successfully.
C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\engine@conduit.com\DualPackage folder moved successfully.
C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\engine@conduit.com\defaults folder moved successfully.
C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\engine@conduit.com\components folder moved successfully.
C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\engine@conduit.com\chrome folder moved successfully.
C:\Users\Melly Schulz\AppData\Roaming\mozilla\Firefox\Profiles\9mpf25v8.default\extensions\engine@conduit.com folder moved successfully.
C:\Users\Melly Schulz\AppData\Roaming\Mozilla\Firefox\Profiles\9mpf25v8.default\searchplugins\conduit.xml moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully.
C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\ not found.
File C:\Program Files (x86)\MyAshampoo\prxtbMyAs.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}\ deleted successfully.
C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{30F9B915-B755-4826-820B-08FBA6BD249D} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ not found.
File C:\Program Files (x86)\ConduitEngine\prxConduitEngine.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{8dcb7100-df86-4384-8842-8fa844297b3f} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8dcb7100-df86-4384-8842-8fa844297b3f}\ deleted successfully.
File C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\ not found.
File C:\Program Files (x86)\MyAshampoo\prxtbMyAs.dll not found.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1224103868-3582190197-2854413230-1004\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
========== FILES ==========
C:\Users\Melly Schulz\AppData\Local\{02D75284-EC5B-4DAD-BA8C-0AC23EEB4AB2} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{03BD65C4-134A-4DD4-B3C4-12C78F79EC70} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{03C78A8C-AE78-4A4B-BFE2-B2BD1C5FE4A0} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{03D26D72-C77A-4348-8063-520083468433} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{09C31F26-E6D9-40D7-83B9-179BF91462D9} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{11780F96-0A24-453A-849E-235C909543EB} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{13D7989B-9C91-4433-ACF2-13092C4AB26C} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{17605753-059F-4225-9F95-B3B73E98D12C} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{1814472D-94CE-47AA-AC3D-4B154BFEC8AA} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{1B7ADD8F-E7F9-4592-8E7E-B8CCB2AA15D5} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{22B8FB6C-D250-410D-BA1A-4E4CBBCF5D09} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{25019F1A-5007-47E0-A53D-958544D1FBFA} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{331651DF-FE89-44E7-865D-482C209EFCAB} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{363914B3-7DDA-4E97-B5BC-552F2E5432CA} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{36F2B80D-0102-45A2-846E-393D0CB9A9F5} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{40ECD04A-60C1-4005-8A04-88DAC0293BD0} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{50509A4F-48DE-4A8C-A7BD-965BED94E35B} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{5460F2D1-A8EA-46F7-BE42-871B7629E091} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{56255C04-A495-475B-87D4-FCE8614EBF93} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{5E1E3BA7-6B46-44BA-B0E8-6F04AB7E8938} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{63D7F300-EBA7-49AE-8B92-4423F99038CE} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{67B841EA-AFDE-471B-9D4B-E8F59BBDA3E5} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{69290E09-F639-4479-AE7F-FCADE042F96F} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{6C413819-65B6-44C7-BE6D-061F29B71409} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{6FC044B4-9029-4AE4-8E4A-E5DCB8C09742} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{75752E13-01F8-457D-85C1-7EF82DE3BA64} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{7B800ABF-A15C-45FC-A3F7-177DBDBD09AC} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{81D7CCD8-90FE-4670-9724-E4322C7136D7} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{8594F631-EA07-4688-BD1B-30B55A353B11} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{877FD7CC-1AD9-41C3-8B18-7BC27E6087C2} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{88828542-E43B-4F89-8321-6892C8B3D063} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{9C370476-74A7-4A6D-A20F-970400747BE5} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{9CCCD3A0-1C7D-4E81-8A0A-EABCA3AFB565} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{A3A389B4-1F07-42F6-B454-C352344C4057} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{A97ECA4C-014C-43D3-8124-CD5E820E015D} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{AFA6AF86-509F-473F-9AA0-F4C710440251} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{B24FF372-F436-479F-A973-43677CF67CD5} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{B4547B03-288B-4011-A5C9-DBC662FC3A7B} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{C8808FBD-5326-4E09-AEA9-3627D194B8CE} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{CEC131C4-0199-4E3A-9543-4415764F297D} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{D9004609-E035-4F3E-B902-D1F5D177FC8D} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{D9078D90-D873-4854-8A6C-8875F75FDC87} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{D99F1BC7-F923-409F-B42C-0C6C53CA4C9D} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{DD29878F-E03E-440A-AC3C-EDFFDF1BBBC5} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{E0A4CE82-644C-4E7A-B91A-4E74169BBCDA} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{E3ADEB0F-F338-4007-B9D3-191B1F8345DD} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{E6BD3058-EBC7-4104-B293-FA6896CE269F} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{E7A5F5DF-12C0-4306-931C-F9F5CD3D088E} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{ED452105-AC03-4F02-8AAA-13A56FEFD2E2} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{F1BB877F-F635-4648-818A-2CDFB26DD108} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{F2B64C9D-403B-43CF-8DB4-0976AF655FE2} folder moved successfully.
C:\Users\Melly Schulz\AppData\Local\{FD8225DA-1000-483A-BA69-DB5F5F12347A} folder moved successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Melly Schulz
->Temp folder emptied: 56788277 bytes
->Temporary Internet Files folder emptied: 222220476 bytes
->Java cache emptied: 2692016 bytes
->FireFox cache emptied: 63494316 bytes
->Flash cache emptied: 101482 bytes
User: Public
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 6701158 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67832 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 336,00 mb
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
OTL by OldTimer - Version 3.2.33.2 log created on 02242012_094311
Files\Folders moved on Reboot...
C:\Users\Melly Schulz\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
Registry entries deleted on Reboot...
|
|
24.02.2012, 11:00
| #15 |
| | Bundeskriminalamttrojaner auf dem Rechner - EXP/java.dldr.A So, habe Antivir nochmal laufen lassen. Code:
ATTFilter
Avira AntiVir Personal
Erstellungsdatum der Reportdatei: Freitag, 24. Februar 2012 10:03
Es wird nach 3497262 Virenstämmen gesucht.
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : Avira AntiVir Personal - Free Antivirus
Seriennummer : 0000149996-ADJIE-0000001
Plattform : Windows 7 x64
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : Melly Schulz
Computername : MELLYSCHULZ-PC
Versionsinformationen:
BUILD.DAT : 10.2.0.707 36070 Bytes 25.01.2012 12:53:00
AVSCAN.EXE : 10.3.0.7 484008 Bytes 02.07.2011 11:32:33
AVSCAN.DLL : 10.0.5.0 57192 Bytes 02.07.2011 11:32:33
LUKE.DLL : 10.3.0.5 45416 Bytes 02.07.2011 11:32:34
LUKERES.DLL : 10.0.0.0 13672 Bytes 14.01.2010 12:22:40
AVSCPLR.DLL : 10.3.0.7 119656 Bytes 02.07.2011 11:32:34
AVREG.DLL : 10.3.0.9 88833 Bytes 02.08.2011 04:58:17
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 10:49:21
VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 05:52:59
VBASE002.VDF : 7.11.19.170 14374912 Bytes 20.12.2011 19:26:04
VBASE003.VDF : 7.11.21.238 4472832 Bytes 01.02.2012 17:34:47
VBASE004.VDF : 7.11.21.239 2048 Bytes 01.02.2012 17:35:29
VBASE005.VDF : 7.11.21.240 2048 Bytes 01.02.2012 17:35:29
VBASE006.VDF : 7.11.21.241 2048 Bytes 01.02.2012 17:35:30
VBASE007.VDF : 7.11.21.242 2048 Bytes 01.02.2012 17:35:30
VBASE008.VDF : 7.11.21.243 2048 Bytes 01.02.2012 17:35:30
VBASE009.VDF : 7.11.21.244 2048 Bytes 01.02.2012 17:35:30
VBASE010.VDF : 7.11.21.245 2048 Bytes 01.02.2012 17:35:30
VBASE011.VDF : 7.11.21.246 2048 Bytes 01.02.2012 17:35:30
VBASE012.VDF : 7.11.21.247 2048 Bytes 01.02.2012 17:35:31
VBASE013.VDF : 7.11.22.33 1486848 Bytes 03.02.2012 18:35:19
VBASE014.VDF : 7.11.22.56 687616 Bytes 03.02.2012 18:35:57
VBASE015.VDF : 7.11.22.92 178176 Bytes 06.02.2012 18:36:02
VBASE016.VDF : 7.11.22.154 144896 Bytes 08.02.2012 18:36:06
VBASE017.VDF : 7.11.22.220 183296 Bytes 13.02.2012 08:58:38
VBASE018.VDF : 7.11.23.34 202752 Bytes 15.02.2012 08:58:45
VBASE019.VDF : 7.11.23.98 126464 Bytes 17.02.2012 08:58:47
VBASE020.VDF : 7.11.23.150 148480 Bytes 20.02.2012 08:58:50
VBASE021.VDF : 7.11.23.224 172544 Bytes 23.02.2012 08:58:56
VBASE022.VDF : 7.11.23.225 2048 Bytes 23.02.2012 08:58:56
VBASE023.VDF : 7.11.23.226 2048 Bytes 23.02.2012 08:58:56
VBASE024.VDF : 7.11.23.227 2048 Bytes 23.02.2012 08:58:56
VBASE025.VDF : 7.11.23.228 2048 Bytes 23.02.2012 08:58:56
VBASE026.VDF : 7.11.23.229 2048 Bytes 23.02.2012 08:58:57
VBASE027.VDF : 7.11.23.230 2048 Bytes 23.02.2012 08:58:57
VBASE028.VDF : 7.11.23.231 2048 Bytes 23.02.2012 08:58:57
VBASE029.VDF : 7.11.23.232 2048 Bytes 23.02.2012 08:58:57
VBASE030.VDF : 7.11.23.233 2048 Bytes 23.02.2012 08:58:57
VBASE031.VDF : 7.11.23.240 50176 Bytes 23.02.2012 08:58:58
Engineversion : 8.2.10.8
AEVDF.DLL : 8.1.2.2 106868 Bytes 06.11.2011 17:51:09
AESCRIPT.DLL : 8.1.4.7 442746 Bytes 24.02.2012 08:59:43
AESCN.DLL : 8.1.8.2 131444 Bytes 02.02.2012 17:37:14
AESBX.DLL : 8.2.4.5 434549 Bytes 28.12.2011 19:28:39
AERDL.DLL : 8.1.9.15 639348 Bytes 03.10.2011 07:12:19
AEPACK.DLL : 8.2.16.3 799094 Bytes 11.02.2012 18:39:25
AEOFFICE.DLL : 8.1.2.25 201084 Bytes 22.01.2012 18:29:18
AEHEUR.DLL : 8.1.4.0 4436342 Bytes 24.02.2012 08:59:40
AEHELP.DLL : 8.1.19.0 254327 Bytes 22.01.2012 18:29:15
AEGEN.DLL : 8.1.5.21 409971 Bytes 11.02.2012 18:36:22
AEEXP.DLL : 8.1.0.23 70005 Bytes 24.02.2012 08:59:43
AEEMU.DLL : 8.1.3.0 393589 Bytes 21.04.2011 05:52:17
AECORE.DLL : 8.1.25.4 201079 Bytes 24.02.2012 08:59:04
AEBB.DLL : 8.1.1.0 53618 Bytes 21.04.2011 05:52:16
AVWINLL.DLL : 10.0.0.0 19304 Bytes 21.04.2011 05:52:39
AVPREF.DLL : 10.0.3.2 44904 Bytes 02.07.2011 11:32:33
AVREP.DLL : 10.0.0.10 174120 Bytes 02.07.2011 11:32:34
AVARKT.DLL : 10.0.26.1 255336 Bytes 02.07.2011 11:32:33
AVEVTLOG.DLL : 10.0.0.9 203112 Bytes 02.07.2011 11:32:33
SQLITE3.DLL : 3.6.19.0 355688 Bytes 28.01.2010 11:59:50
AVSMTP.DLL : 10.0.0.17 63848 Bytes 21.04.2011 05:52:38
NETNT.DLL : 10.0.0.0 11624 Bytes 21.04.2011 05:52:50
RCIMAGE.DLL : 10.0.0.35 2589544 Bytes 02.07.2011 11:32:33
RCTEXT.DLL : 10.0.64.0 98664 Bytes 02.07.2011 11:32:33
Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Lokale Laufwerke
Konfigurationsdatei...................: C:\Program Files (x86)\Avira\AntiVir Desktop\alldrives.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:, F:, E:,
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: aus
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Intelligente Dateiauswahl
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert
Beginn des Suchlaufs: Freitag, 24. Februar 2012 10:03
Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'avscan.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'daemonu.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamservice.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamgui.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'iTunesHelper.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'AdobeARM.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'DivXUpdate.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Skype.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'msnmsgr.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'RocketDock.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'LightScribeControlPanel.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'TeaTimer.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'SDWinSec.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'SeaPort.EXE' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'MDM.EXE' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'LSSrvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceService.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '1' Modul(e) wurden durchsucht
Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
[INFO] Es wurde kein Virus gefunden!
Masterbootsektor HD1
[INFO] Es wurde kein Virus gefunden!
Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
[INFO] Es wurde kein Virus gefunden!
Bootsektor 'D:\'
[INFO] Es wurde kein Virus gefunden!
Bootsektor 'F:\'
[INFO] Im Laufwerk 'F:\' ist kein Datenträger eingelegt!
Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '185' Dateien ).
Der Suchlauf über die ausgewählten Dateien wird begonnen:
Beginne mit der Suche in 'C:\'
Beginne mit der Suche in 'D:\'
Der zu durchsuchende Pfad D:\ konnte nicht geöffnet werden!
Systemfehler [1005]: Auf dem Datenträger befindet sich kein erkanntes Dateisystem.
Beginne mit der Suche in 'F:\'
Der zu durchsuchende Pfad F:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.
Beginne mit der Suche in 'E:\'
Der zu durchsuchende Pfad E:\ konnte nicht geöffnet werden!
Systemfehler [21]: Das Gerät ist nicht bereit.
Ende des Suchlaufs: Freitag, 24. Februar 2012 10:39
Benötigte Zeit: 35:59 Minute(n)
Der Suchlauf wurde vollständig durchgeführt.
26602 Verzeichnisse wurden überprüft
332706 Dateien wurden geprüft
0 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
0 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
332706 Dateien ohne Befall
1495 Archive wurden durchsucht
0 Warnungen
0 Hinweise
Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.60.1.1000 www.malwarebytes.org Datenbank Version: v2012.02.23.02 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Melly Schulz :: MELLYSCHULZ-PC [Administrator] Schutz: Aktiviert 24.02.2012 09:53:45 mbam-log-2012-02-24 (09-53-45).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 199027 Laufzeit: 3 Minute(n), 10 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) |
|
| Themen zu Bundeskriminalamttrojaner auf dem Rechner - EXP/java.dldr.A |
| .dll, administratorrechte, antivir, avg, daten retten, desktop, exe, explorer, geliefert, heuristiks/extra, heuristiks/shuriken, internet, löschen, maleware, malwarebytes, microsoft, modul, namen, neustart, nt.dll, problem, programm, prozesse, registry, sekunden, starten, task-manager, thomas, trojaner, verweise, virus, windows |
Textbox von OTL - wenn OTL auf deutsch ist wird sie mit 
beschriftet
.
Linear-Darstellung
