| |
| |||||||
Log-Analyse und Auswertung: Verschlüsselungs-Trojaner, auch das noch...Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
01.06.2012, 15:42
| #1 |
| |  Verschlüsselungs-Trojaner, auch das noch... Hallo, ich habe mir gestern einen Verschlüsselungs-Trojaner eingefangen. Ich hatte eine email von einem mir unbekannten, der von einem Arcor-Account schrieb, im Postfach. Eine Seite, bei der ich mich vor Jahren einmal angemeldet hatte, stelle mir jetzt die von mir genutzten Services in Rechnung. Natürlich wollte ich wissen, wie sich das legitimiert, zumal ich dort nie irgendetwas abgeschlossen hatte, nicht mal eine kostenpflichtige Mitgliedschaft. Also wollte ich im Anhang (Vertrag.zip) nachschauen und schon war es passiert. Alle Dateien, außer denen vom Betriebssystem (WinXP SP3) sind umbenannt und, den Beiträgen, die ich hier im Forum dazu gelesen habe nach, auch verschlüsselt (Bsp.Name: "DjnJvGxlDjAggUdTao"). Ich habe dann zunächst die Registrierungsdateien von einer anderen Systempartition aus editieren und so wenigstens den Trojaner am Starten hindern können. Dann bin ich der oben angebenen Anleitung gefolgt, um ihn wieder loszuwerden. Das System läuft, aber die Dateien sind weiterhin verschlüsselt, obwohl ich alle der oben genannten Entschlüsselungs-Tools probiert habe. Es wäre nett, wenn ihr mal schauen könntet, ob man da noch was retten kann :-) Hier die logfiles mbam: Code:
ATTFilter Malwarebytes Anti-Malware 1.61.0.1400 www.malwarebytes.org Datenbank Version: v2012.05.31.02 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 WirZweiBeide :: ALEX [Administrator] 31.05.2012 14:17:42 mbam-log-2012-05-31 (14-17-42).txt Art des Suchlaufs: Vollständiger Suchlauf Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 302106 Laufzeit: 59 Minute(n), 33 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 2 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe (Security.Hijack) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe (Security.Hijack) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 2 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableRegedit (Hijack.Regedit) -> Daten: 0 -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableRegedit (Hijack.Regedit) -> Daten: 0 -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 2 D:\Dokumente und Einstellungen\WirZweiBeide\Anwendungsdaten\Xgldk_BAK\B89B6CF5C8D08A765BDE.exe (Packer.ModifiedUPX) -> Erfolgreich gelöscht und in Quarantäne gestellt. D:\WINDOWS\system32\6250EFD7C8D08A76E28E.exe (Packer.ModifiedUPX) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) (defogger gab keine Fehlermeldung aus) OTL: Code:
ATTFilter OTL logfile created on: 31.05.2012 20:52:22 - Run 1 OTL by OldTimer - Version 3.2.44.0 Folder = D:\Dokumente und Einstellungen\WirZweiBeide\Desktop\Decrypt Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1022,48 Mb Total Physical Memory | 707,07 Mb Available Physical Memory | 69,15% Memory free 2,40 Gb Paging File | 2,06 Gb Available in Paging File | 85,74% Paging File free Paging file location(s): D:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = D: | %SystemRoot% = D:\WINDOWS | %ProgramFiles% = D:\Programme Drive C: | 9,45 Gb Total Space | 2,09 Gb Free Space | 22,15% Space Free | Partition Type: NTFS Drive D: | 19,53 Gb Total Space | 12,76 Gb Free Space | 65,34% Space Free | Partition Type: NTFS Drive E: | 88,22 Gb Total Space | 77,85 Gb Free Space | 88,24% Space Free | Partition Type: NTFS Drive F: | 78,13 Gb Total Space | 76,59 Gb Free Space | 98,03% Space Free | Partition Type: NTFS Drive G: | 39,07 Gb Total Space | 33,75 Gb Free Space | 86,39% Space Free | Partition Type: NTFS Drive H: | 18,02 Gb Total Space | 17,09 Gb Free Space | 94,84% Space Free | Partition Type: NTFS Drive I: | 48,83 Gb Total Space | 46,06 Gb Free Space | 94,33% Space Free | Partition Type: NTFS Drive J: | 48,83 Gb Total Space | 48,16 Gb Free Space | 98,64% Space Free | Partition Type: NTFS Drive K: | 72,73 Gb Total Space | 66,05 Gb Free Space | 90,82% Space Free | Partition Type: NTFS Drive M: | 1,92 Gb Total Space | 1,25 Gb Free Space | 65,14% Space Free | Partition Type: FAT Computer Name: *** | User Name: WirZweiBeide | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.05.31 20:51:42 | 000,595,968 | ---- | M] (OldTimer Tools) -- D:\Dokumente und Einstellungen\WirZweiBeide\Desktop\Decrypt\OTL.exe PRC - [2012.05.08 19:05:11 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- D:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2012.05.08 19:05:10 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- D:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2012.05.08 19:05:10 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- D:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2012.05.08 19:05:10 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- D:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2012.03.01 01:58:00 | 002,348,352 | ---- | M] (NVIDIA Corporation) -- D:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe PRC - [2012.01.18 14:02:04 | 000,254,696 | ---- | M] (Sun Microsystems, Inc.) -- D:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe PRC - [2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- D:\WINDOWS\explorer.exe PRC - [2007.01.11 20:57:20 | 000,291,760 | ---- | M] () -- D:\Programme\Lexmark 3400 Series\lxcymon.exe PRC - [2006.11.29 18:57:20 | 000,537,520 | ---- | M] ( ) -- D:\WINDOWS\system32\lxcycoms.exe PRC - [2006.11.29 18:57:10 | 000,082,864 | ---- | M] (Lexmark International Inc.) -- D:\Programme\Lexmark 3400 Series\ezprint.exe PRC - [2006.11.17 05:42:52 | 000,577,536 | R--- | M] (Realtek Semiconductor Corp.) -- D:\WINDOWS\soundman.exe ========== Modules (No Company Name) ========== MOD - [2012.05.08 19:05:11 | 000,398,288 | ---- | M] () -- D:\Programme\Avira\AntiVir Desktop\sqlite3.dll MOD - [2007.01.11 20:57:20 | 000,291,760 | ---- | M] () -- D:\Programme\Lexmark 3400 Series\lxcymon.exe MOD - [2006.11.27 09:51:14 | 000,115,200 | ---- | M] () -- D:\WINDOWS\system32\spool\drivers\w32x86\3\lxcyui5c.dll MOD - [2006.11.27 09:50:22 | 000,117,760 | ---- | M] () -- D:\WINDOWS\system32\spool\prtprocs\w32x86\lxcypp5c.dll MOD - [2006.11.27 09:49:56 | 000,161,792 | ---- | M] () -- D:\WINDOWS\system32\spool\drivers\w32x86\3\lxcydr5c.dll MOD - [2006.11.22 16:05:12 | 000,012,288 | ---- | M] () -- D:\Programme\Lexmark Fax Solutions\fxctrstr.dll MOD - [2006.11.22 15:51:26 | 000,045,056 | ---- | M] () -- D:\WINDOWS\system32\LXPRMON.DLL MOD - [2006.11.22 15:49:18 | 000,032,768 | ---- | M] () -- D:\Programme\Lexmark Fax Solutions\ipcmt.dll MOD - [2006.08.08 21:54:18 | 000,278,528 | ---- | M] () -- D:\Programme\Lexmark 3400 Series\lxcyscw.dll MOD - [2006.05.25 22:20:44 | 000,241,664 | ---- | M] () -- D:\Programme\Lexmark 3400 Series\iptk.dll MOD - [2006.02.13 15:04:20 | 000,143,360 | ---- | M] () -- D:\Programme\Lexmark 3400 Series\lxcydrec.dll ========== Win32 Services (SafeList) ========== SRV - [2012.05.23 18:51:25 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- D:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.05.08 19:05:11 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- D:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012.05.08 19:05:10 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- D:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2012.03.01 01:58:00 | 002,348,352 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- D:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService) SRV - [2008.04.14 07:53:04 | 000,075,264 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- D:\WINDOWS\system32\tlntsvr.exe -- (TlntSvr) SRV - [2008.04.14 07:52:56 | 000,114,176 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- D:\WINDOWS\system32\netdde.exe -- (NetDDEdsdm) SRV - [2008.04.14 07:52:56 | 000,114,176 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- D:\WINDOWS\system32\netdde.exe -- (NetDDE) SRV - [2008.04.14 07:52:40 | 000,033,280 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- D:\WINDOWS\system32\clipsrv.exe -- (ClipSrv) SRV - [2008.04.14 07:52:18 | 000,033,792 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- D:\WINDOWS\system32\msgsvc.dll -- (Messenger) SRV - [2008.04.14 07:52:16 | 000,053,248 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- D:\WINDOWS\system32\mprdim.dll -- (RemoteAccess) SRV - [2008.04.14 07:52:08 | 000,017,408 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- D:\WINDOWS\system32\alrsvc.dll -- (Alerter) SRV - [2006.11.29 18:57:20 | 000,537,520 | ---- | M] ( ) [Auto | Running] -- D:\WINDOWS\system32\lxcycoms.exe -- (lxcy_device) SRV - [2003.07.28 12:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- D:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP) DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump) DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc) DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt) DRV - File not found [Kernel | System | Stopped] -- -- (Changer) DRV - [2012.05.08 19:05:11 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- D:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb) DRV - [2012.05.08 19:05:11 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- D:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt) DRV - [2012.04.24 18:28:06 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- D:\WINDOWS\system32\drivers\sptd.sys -- (sptd) DRV - [2011.09.16 16:08:07 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- D:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr) DRV - [2009.10.08 16:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- D:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2008.04.14 07:32:18 | 000,120,576 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- D:\WINDOWS\System32\drivers\pcmcia.sys -- (Pcmcia) DRV - [2008.04.14 07:28:14 | 000,800,384 | ---- | M] (Microsoft Corp., Veritas Software) [Kernel | Disabled | Stopped] -- D:\WINDOWS\system32\drivers\dmboot.sys -- (dmboot) DRV - [2008.04.14 00:02:38 | 000,066,048 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- D:\WINDOWS\System32\drivers\udfs.sys -- (Udfs) DRV - [2008.04.07 16:06:48 | 000,105,088 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- D:\WINDOWS\system32\drivers\Rtnicxp.sys -- (RTL8023xp) DRV - [2007.03.08 14:34:46 | 004,027,840 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- D:\WINDOWS\system32\drivers\alcxwdm.sys -- (ALCXWDM) Service for Realtek AC97 Audio (WDM) DRV - [2006.10.18 17:39:58 | 000,017,920 | R--- | M] (VIA Technologies,Inc) [Kernel | Boot | Running] -- D:\WINDOWS\system32\drivers\xfilt.sys -- (xfilt) DRV - [2006.10.17 20:22:26 | 000,009,216 | R--- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- D:\WINDOWS\system32\drivers\videX32.sys -- (videX32) DRV - [2001.08.18 14:00:00 | 000,013,952 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- D:\WINDOWS\System32\drivers\cbidf2k.sys -- (cbidf2k) DRV - [2001.08.18 14:00:00 | 000,012,160 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- D:\WINDOWS\System32\drivers\acpiec.sys -- (ACPIEC) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\..\SearchScopes,DefaultScope = {2EDF4EFE-442D-4FA9-9347-A6A30DD21183} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC IE - HKCU\..\SearchScopes\{2EDF4EFE-442D-4FA9-9347-A6A30DD21183}: "URL" = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: D:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: D:\Programme\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: D:\Programme\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.46: D:\Programme\VistaCodecPack\rm\browser\plugins\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.46: D:\Programme\VistaCodecPack\rm\browser\plugins\nprpjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found O1 HOSTS File: ([2001.08.18 14:00:00 | 000,000,820 | ---- | M]) - D:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - D:\Programme\Lexmark Toolbar\toolband.dll () O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O3 - HKLM\..\Toolbar: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - D:\Programme\Lexmark Toolbar\toolband.dll () O4 - HKLM..\Run: [avgnt] D:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [EzPrint] D:\Programme\Lexmark 3400 Series\ezprint.exe (Lexmark International Inc.) O4 - HKLM..\Run: [FaxCenterServer] D:\Programme\Lexmark Fax Solutions\fm3032.exe () O4 - HKLM..\Run: [LXCYCATS] D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCYtime.DLL (Lexmark International Inc.) O4 - HKLM..\Run: [lxcymon.exe] D:\Programme\Lexmark 3400 Series\lxcymon.exe () O4 - HKLM..\Run: [NvCplDaemon] D:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] D:\WINDOWS\System32\nvmctray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] D:\Programme\NVIDIA Corporation\nview\nwiz.exe () O4 - HKLM..\Run: [SoundMan] D:\WINDOWS\soundman.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SunJavaUpdateSched] D:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: E&xport to Microsoft Excel - I:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - I:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7217F00C-BFF6-4612-BDFD-FE9E20AE9447}: NameServer = 192.168.1.1 O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - D:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - D:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - D:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - D:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - D:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (D:\WINDOWS\system32\userinit.exe) - D:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O27 - HKLM IFEO\taskmgr.exe: Debugger - P9KDMF.EXE File not found O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2010.06.18 17:21:35 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2012.05.31 19:29:33 | 000,000,000 | ---D | C] -- D:\Dokumente und Einstellungen\All Users\Startmenü\Programme\7-Zip [2012.05.31 19:29:32 | 000,000,000 | ---D | C] -- D:\Programme\7-Zip [2012.05.31 18:58:12 | 000,000,000 | ---D | C] -- D:\Dokumente und Einstellungen\WirZweiBeide\Lokale Einstellungen\Anwendungsdaten\Identities [2012.05.31 16:12:29 | 000,000,000 | ---D | C] -- D:\WINDOWS\pss [2012.05.31 16:10:41 | 000,000,000 | ---D | C] -- D:\Dokumente und Einstellungen\WirZweiBeide\Desktop\Decrypt [2012.05.31 14:10:22 | 000,000,000 | ---D | C] -- D:\Dokumente und Einstellungen\WirZweiBeide\Anwendungsdaten\Malwarebytes [2012.05.31 14:10:17 | 000,000,000 | ---D | C] -- D:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware [2012.05.31 14:10:16 | 000,000,000 | ---D | C] -- D:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes [2012.05.31 14:10:15 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- D:\WINDOWS\System32\drivers\mbam.sys [2012.05.31 14:10:15 | 000,000,000 | ---D | C] -- D:\Programme\Malwarebytes' Anti-Malware [2012.05.31 14:01:19 | 000,000,000 | ---D | C] -- D:\Programme\Trend Micro [2012.05.31 14:01:19 | 000,000,000 | ---D | C] -- D:\Dokumente und Einstellungen\WirZweiBeide\Startmenü\Programme\HiJackThis [2012.05.31 13:58:34 | 000,000,000 | ---D | C] -- D:\WINDOWS\System32\NtmsData [2012.05.31 10:49:02 | 000,000,000 | ---D | C] -- D:\Dokumente und Einstellungen\WirZweiBeide\Anwendungsdaten\Xgldk_BAK [2012.05.30 23:19:17 | 000,000,000 | RH-D | C] -- D:\Dokumente und Einstellungen\WirZweiBeide\Recent [4 D:\WINDOWS\*.tmp files -> D:\WINDOWS\*.tmp -> ] [1 D:\WINDOWS\System32\*.tmp files -> D:\WINDOWS\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.05.31 20:55:00 | 000,000,432 | -H-- | M] () -- D:\WINDOWS\tasks\User_Feed_Synchronization-{7A74CB18-2750-4B00-A1FB-0070954B7C56}.job [2012.05.31 20:52:00 | 000,000,884 | ---- | M] () -- D:\WINDOWS\tasks\Adobe Flash Player Updater.job [2012.05.31 20:47:42 | 000,002,048 | --S- | M] () -- D:\WINDOWS\bootstat.dat [2012.05.31 20:45:51 | 000,000,020 | ---- | M] () -- D:\Dokumente und Einstellungen\WirZweiBeide\defogger_reenable [2012.05.31 14:10:17 | 000,000,762 | ---- | M] () -- D:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk [2012.05.31 14:07:07 | 000,000,771 | ---- | M] () -- D:\Dokumente und Einstellungen\WirZweiBeide\Desktop\Praxisbericht.lnk [2012.05.31 14:01:31 | 000,002,445 | ---- | M] () -- D:\Dokumente und Einstellungen\WirZweiBeide\Desktop\HiJackThis.lnk [2012.05.29 16:14:52 | 000,002,206 | ---- | M] () -- D:\WINDOWS\System32\wpa.dbl [2012.05.26 22:35:38 | 000,003,584 | ---- | M] () -- D:\Dokumente und Einstellungen\WirZweiBeide\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.05.25 22:51:12 | 000,000,507 | ---- | M] () -- D:\Dokumente und Einstellungen\WirZweiBeide\Desktop\Verknüpfung mit CCleaner.exe.lnk [2012.05.23 18:51:25 | 000,419,488 | ---- | M] (Adobe Systems Incorporated) -- D:\WINDOWS\System32\FlashPlayerApp.exe [2012.05.23 18:51:25 | 000,070,304 | ---- | M] (Adobe Systems Incorporated) -- D:\WINDOWS\System32\FlashPlayerCPLApp.cpl [2012.05.13 13:25:48 | 000,208,896 | ---- | M] () -- D:\WINDOWS\System32\FNTCACHE.DAT [2012.05.11 21:50:50 | 000,481,078 | ---- | M] () -- D:\WINDOWS\System32\winsh323 [2012.05.11 21:50:40 | 000,481,078 | ---- | M] () -- D:\WINDOWS\System32\winsh322 [2012.05.11 21:50:32 | 000,481,078 | ---- | M] () -- D:\WINDOWS\System32\winsh321 [2012.05.11 21:50:22 | 000,481,078 | ---- | M] () -- D:\WINDOWS\System32\winsh320 [2012.05.08 19:05:11 | 000,137,928 | ---- | M] (Avira GmbH) -- D:\WINDOWS\System32\drivers\avipbb.sys [2012.05.08 19:05:11 | 000,083,392 | ---- | M] (Avira GmbH) -- D:\WINDOWS\System32\drivers\avgntflt.sys [2012.05.07 17:36:59 | 000,002,369 | ---- | M] () -- D:\Dokumente und Einstellungen\WirZweiBeide\Desktop\Microsoft Office Excel 2003.lnk [2012.05.02 19:58:24 | 000,000,576 | ---- | M] () -- D:\Dokumente und Einstellungen\WirZweiBeide\Desktop\Verknüpfung mit Frozen Throne.exe.lnk [4 D:\WINDOWS\*.tmp files -> D:\WINDOWS\*.tmp -> ] [1 D:\WINDOWS\System32\*.tmp files -> D:\WINDOWS\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.05.31 20:45:36 | 000,000,020 | ---- | C] () -- D:\Dokumente und Einstellungen\WirZweiBeide\defogger_reenable [2012.05.31 14:10:17 | 000,000,762 | ---- | C] () -- D:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk [2012.05.31 14:01:20 | 000,002,445 | ---- | C] () -- D:\Dokumente und Einstellungen\WirZweiBeide\Desktop\HiJackThis.lnk [2012.05.31 10:49:46 | 000,481,078 | ---- | C] () -- D:\WINDOWS\System32\winsh325 [2012.05.31 10:49:46 | 000,481,078 | ---- | C] () -- D:\WINDOWS\System32\winsh324 [2012.05.31 10:49:46 | 000,481,078 | ---- | C] () -- D:\WINDOWS\System32\winsh323 [2012.05.31 10:49:46 | 000,481,078 | ---- | C] () -- D:\WINDOWS\System32\winsh322 [2012.05.31 10:49:46 | 000,481,078 | ---- | C] () -- D:\WINDOWS\System32\winsh321 [2012.05.31 10:49:46 | 000,481,078 | ---- | C] () -- D:\WINDOWS\System32\winsh320 [2012.05.29 16:41:02 | 000,000,771 | ---- | C] () -- D:\Dokumente und Einstellungen\WirZweiBeide\Desktop\Praxisbericht.lnk [2012.05.26 22:35:38 | 000,003,584 | ---- | C] () -- D:\Dokumente und Einstellungen\WirZweiBeide\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.05.25 22:51:12 | 000,000,507 | ---- | C] () -- D:\Dokumente und Einstellungen\WirZweiBeide\Desktop\Verknüpfung mit CCleaner.exe.lnk [2012.05.03 18:22:59 | 000,002,367 | ---- | C] () -- D:\Dokumente und Einstellungen\WirZweiBeide\Desktop\Microsoft Office Word 2003.lnk [2012.05.03 18:22:51 | 000,002,369 | ---- | C] () -- D:\Dokumente und Einstellungen\WirZweiBeide\Desktop\Microsoft Office Excel 2003.lnk [2012.05.02 19:58:24 | 000,000,576 | ---- | C] () -- D:\Dokumente und Einstellungen\WirZweiBeide\Desktop\Verknüpfung mit Frozen Throne.exe.lnk [2012.04.29 13:18:51 | 000,040,960 | ---- | C] () -- D:\WINDOWS\System32\lxcyvs.dll [2012.04.29 13:18:49 | 000,344,064 | ---- | C] () -- D:\WINDOWS\System32\lxcycoin.dll [2012.04.29 13:18:34 | 000,692,224 | ---- | C] () -- D:\WINDOWS\System32\lxcydrs.dll [2012.04.29 13:18:34 | 000,065,536 | ---- | C] () -- D:\WINDOWS\System32\lxcycaps.dll [2012.04.29 13:18:33 | 000,061,440 | ---- | C] () -- D:\WINDOWS\System32\lxcycnv4.dll [2012.04.29 13:18:17 | 000,045,056 | ---- | C] () -- D:\WINDOWS\System32\LXPRMON.DLL [2012.04.29 13:18:17 | 000,032,768 | ---- | C] () -- D:\WINDOWS\System32\LXPMONUI.DLL [2012.04.29 13:16:49 | 000,323,584 | ---- | C] ( ) -- D:\WINDOWS\System32\lxcyhcp.dll [2012.04.29 13:16:49 | 000,274,432 | ---- | C] () -- D:\WINDOWS\System32\lxcyinst.dll [2012.04.29 13:16:48 | 001,224,704 | ---- | C] ( ) -- D:\WINDOWS\System32\lxcyserv.dll [2012.04.29 13:16:48 | 000,991,232 | ---- | C] ( ) -- D:\WINDOWS\System32\lxcyusb1.dll [2012.04.29 13:16:48 | 000,413,696 | ---- | C] ( ) -- D:\WINDOWS\System32\lxcyinpa.dll [2012.04.29 13:16:48 | 000,397,312 | ---- | C] ( ) -- D:\WINDOWS\System32\lxcyiesc.dll [2012.04.29 13:16:47 | 000,643,072 | ---- | C] ( ) -- D:\WINDOWS\System32\lxcypmui.dll [2012.04.29 13:16:47 | 000,585,728 | ---- | C] ( ) -- D:\WINDOWS\System32\lxcylmpm.dll [2012.04.29 13:16:47 | 000,163,840 | ---- | C] ( ) -- D:\WINDOWS\System32\lxcyprox.dll [2012.04.29 13:16:47 | 000,094,208 | ---- | C] ( ) -- D:\WINDOWS\System32\lxcypplc.dll [2012.04.29 13:16:45 | 000,696,320 | ---- | C] ( ) -- D:\WINDOWS\System32\lxcyhbn3.dll [2012.04.29 13:16:45 | 000,537,520 | ---- | C] ( ) -- D:\WINDOWS\System32\lxcycoms.exe [2012.04.29 13:16:45 | 000,385,968 | ---- | C] ( ) -- D:\WINDOWS\System32\lxcyih.exe [2012.04.29 13:16:44 | 000,684,032 | ---- | C] ( ) -- D:\WINDOWS\System32\lxcycomc.dll [2012.04.29 13:16:44 | 000,421,888 | ---- | C] ( ) -- D:\WINDOWS\System32\lxcycomm.dll [2012.04.29 13:16:44 | 000,381,872 | ---- | C] ( ) -- D:\WINDOWS\System32\lxcycfg.exe [2012.04.26 18:48:21 | 000,003,072 | ---- | C] () -- D:\WINDOWS\System32\iacenc.dll [2012.04.24 19:38:12 | 000,000,376 | ---- | C] () -- D:\WINDOWS\ODBC.INI [2012.04.24 19:08:19 | 000,293,992 | ---- | C] () -- D:\WINDOWS\System32\nvdrsdb1.bin [2012.04.24 19:08:19 | 000,293,992 | ---- | C] () -- D:\WINDOWS\System32\nvdrsdb0.bin [2012.04.24 19:08:19 | 000,000,001 | ---- | C] () -- D:\WINDOWS\System32\nvdrssel.bin [2012.04.24 19:07:52 | 002,784,050 | ---- | C] () -- D:\WINDOWS\System32\nvdata.data [2012.04.24 18:22:47 | 000,000,664 | ---- | C] () -- D:\WINDOWS\System32\d3d9caps.dat [2012.04.24 16:58:37 | 000,049,152 | R--- | C] () -- D:\WINDOWS\System32\ChCfg.exe [2012.04.24 16:58:17 | 000,147,456 | R--- | C] () -- D:\WINDOWS\System32\RtlCPAPI.dll [2012.04.24 16:58:11 | 000,000,164 | R--- | C] () -- D:\WINDOWS\avrack.ini [2012.04.24 16:20:59 | 000,004,161 | ---- | C] () -- D:\WINDOWS\ODBCINST.INI [2012.04.24 16:19:57 | 000,208,896 | ---- | C] () -- D:\WINDOWS\System32\FNTCACHE.DAT [2012.04.24 15:32:44 | 000,002,048 | --S- | C] () -- D:\WINDOWS\bootstat.dat [2012.04.24 15:28:10 | 000,021,740 | ---- | C] () -- D:\WINDOWS\System32\emptyregdb.dat < End of report > Code:
ATTFilter OTL Extras logfile created on: 31.05.2012 20:52:22 - Run 1
OTL by OldTimer - Version 3.2.44.0 Folder = D:\Dokumente und Einstellungen\WirZweiBeide\Desktop\Decrypt
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1022,48 Mb Total Physical Memory | 707,07 Mb Available Physical Memory | 69,15% Memory free
2,40 Gb Paging File | 2,06 Gb Available in Paging File | 85,74% Paging File free
Paging file location(s): D:\pagefile.sys 1536 3072 [binary data]
%SystemDrive% = D: | %SystemRoot% = D:\WINDOWS | %ProgramFiles% = D:\Programme
Drive C: | 9,45 Gb Total Space | 2,09 Gb Free Space | 22,15% Space Free | Partition Type: NTFS
Drive D: | 19,53 Gb Total Space | 12,76 Gb Free Space | 65,34% Space Free | Partition Type: NTFS
Drive E: | 88,22 Gb Total Space | 77,85 Gb Free Space | 88,24% Space Free | Partition Type: NTFS
Drive F: | 78,13 Gb Total Space | 76,59 Gb Free Space | 98,03% Space Free | Partition Type: NTFS
Drive G: | 39,07 Gb Total Space | 33,75 Gb Free Space | 86,39% Space Free | Partition Type: NTFS
Drive H: | 18,02 Gb Total Space | 17,09 Gb Free Space | 94,84% Space Free | Partition Type: NTFS
Drive I: | 48,83 Gb Total Space | 46,06 Gb Free Space | 94,33% Space Free | Partition Type: NTFS
Drive J: | 48,83 Gb Total Space | 48,16 Gb Free Space | 98,64% Space Free | Partition Type: NTFS
Drive K: | 72,73 Gb Total Space | 66,05 Gb Free Space | 90,82% Space Free | Partition Type: NTFS
Drive M: | 1,92 Gb Total Space | 1,25 Gb Free Space | 65,14% Space Free | Partition Type: FAT
Computer Name: *** | User Name: WirZweiBeide | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- "I:\Programme\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "I:\Programme\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"D:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe" = D:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe:*:Enabled:Daemonu.exe -- (NVIDIA Corporation)
"D:\WINDOWS\system32\lxcycoms.exe" = D:\WINDOWS\system32\lxcycoms.exe:*:Enabled:3400 Series Server -- ( )
"I:\Games\Warcraft III\Warcraft III.exe" = I:\Games\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0819E89D-6214-4B6F-A18D-4633CB4E0E4A}" = Softwareupdate für Webordner
"{1017A80C-6F09-4548-A84D-EDD6AC9525F0}" = Lexmark Symbolleiste
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{AC76BA86-7AD7-1031-7B44-A00000000001}" = Adobe Reader 6.0.1 - Deutsch
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 296.10
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 296.10
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView" = NVIDIA nView 136.18
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.7.11
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F9FD80CE-0448-4D4F-8BCD-77FC514C3F99}" = Vista Codec Package
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"7-Zip" = 7-Zip 9.20
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Avira AntiVir Desktop" = Avira Free Antivirus
"ie8" = Windows Internet Explorer 8
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager
"Lexmark 3400 Series" = Lexmark 3400 Series
"Lexmark Fax Solutions" = Lexmark Fax-Lsungen
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400
"Warcraft III" = Warcraft III
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR Archivierer
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 29.04.2012 09:03:49 | Computer Name = *** | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office Professional Edition 2003 -- Error 1706.
Setup cannot find the required files. Check your connection to the network, or
CD-ROM drive. For other potential solutions to this problem, see I:\Programme\Microsoft
Office\OFFICE11\1033\SETUP.CHM.
Error - 29.04.2012 10:08:15 | Computer Name = *** | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office Professional Edition 2003 -- Error 1706.
Setup cannot find the required files. Check your connection to the network, or
CD-ROM drive. For other potential solutions to this problem, see I:\Programme\Microsoft
Office\OFFICE11\1033\SETUP.CHM.
Error - 29.04.2012 10:08:25 | Computer Name = *** | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office Professional Edition 2003 -- Error 1706.
Setup cannot find the required files. Check your connection to the network, or
CD-ROM drive. For other potential solutions to this problem, see I:\Programme\Microsoft
Office\OFFICE11\1033\SETUP.CHM.
Error - 29.04.2012 10:09:10 | Computer Name = *** | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office Professional Edition 2003 -- Error 1706.
Setup cannot find the required files. Check your connection to the network, or
CD-ROM drive. For other potential solutions to this problem, see I:\Programme\Microsoft
Office\OFFICE11\1033\SETUP.CHM.
Error - 31.05.2012 09:52:55 | Computer Name = *** | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office Professional Edition 2003 -- Error 1706.
Setup cannot find the required files. Check your connection to the network, or
CD-ROM drive. For other potential solutions to this problem, see I:\Programme\Microsoft
Office\OFFICE11\1033\SETUP.CHM.
Error - 31.05.2012 09:53:35 | Computer Name = *** | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office Professional Edition 2003 -- Error 1706.
Setup cannot find the required files. Check your connection to the network, or
CD-ROM drive. For other potential solutions to this problem, see I:\Programme\Microsoft
Office\OFFICE11\1033\SETUP.CHM.
Error - 31.05.2012 09:54:54 | Computer Name = *** | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office Professional Edition 2003 -- Error 1706.
Setup cannot find the required files. Check your connection to the network, or
CD-ROM drive. For other potential solutions to this problem, see I:\Programme\Microsoft
Office\OFFICE11\1033\SETUP.CHM.
Error - 31.05.2012 10:34:39 | Computer Name = *** | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office Professional Edition 2003 -- Error 1706.
Setup cannot find the required files. Check your connection to the network, or
CD-ROM drive. For other potential solutions to this problem, see I:\Programme\Microsoft
Office\OFFICE11\1033\SETUP.CHM.
Error - 31.05.2012 11:13:08 | Computer Name = *** | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office Professional Edition 2003 -- Error 1706.
Setup cannot find the required files. Check your connection to the network, or
CD-ROM drive. For other potential solutions to this problem, see I:\Programme\Microsoft
Office\OFFICE11\1033\SETUP.CHM.
Error - 31.05.2012 14:22:00 | Computer Name = *** | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office Professional Edition 2003 -- Error 1706.
Setup cannot find the required files. Check your connection to the network, or
CD-ROM drive. For other potential solutions to this problem, see I:\Programme\Microsoft
Office\OFFICE11\1033\SETUP.CHM.
[ Application Events ]
Error - 29.04.2012 09:03:49 | Computer Name = *** | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office Professional Edition 2003 -- Error 1706.
Setup cannot find the required files. Check your connection to the network, or
CD-ROM drive. For other potential solutions to this problem, see I:\Programme\Microsoft
Office\OFFICE11\1033\SETUP.CHM.
Error - 29.04.2012 10:08:15 | Computer Name = *** | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office Professional Edition 2003 -- Error 1706.
Setup cannot find the required files. Check your connection to the network, or
CD-ROM drive. For other potential solutions to this problem, see I:\Programme\Microsoft
Office\OFFICE11\1033\SETUP.CHM.
Error - 29.04.2012 10:08:25 | Computer Name = *** | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office Professional Edition 2003 -- Error 1706.
Setup cannot find the required files. Check your connection to the network, or
CD-ROM drive. For other potential solutions to this problem, see I:\Programme\Microsoft
Office\OFFICE11\1033\SETUP.CHM.
Error - 29.04.2012 10:09:10 | Computer Name = *** | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office Professional Edition 2003 -- Error 1706.
Setup cannot find the required files. Check your connection to the network, or
CD-ROM drive. For other potential solutions to this problem, see I:\Programme\Microsoft
Office\OFFICE11\1033\SETUP.CHM.
Error - 31.05.2012 09:52:55 | Computer Name = *** | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office Professional Edition 2003 -- Error 1706.
Setup cannot find the required files. Check your connection to the network, or
CD-ROM drive. For other potential solutions to this problem, see I:\Programme\Microsoft
Office\OFFICE11\1033\SETUP.CHM.
Error - 31.05.2012 09:53:35 | Computer Name = *** | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office Professional Edition 2003 -- Error 1706.
Setup cannot find the required files. Check your connection to the network, or
CD-ROM drive. For other potential solutions to this problem, see I:\Programme\Microsoft
Office\OFFICE11\1033\SETUP.CHM.
Error - 31.05.2012 09:54:54 | Computer Name = *** | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office Professional Edition 2003 -- Error 1706.
Setup cannot find the required files. Check your connection to the network, or
CD-ROM drive. For other potential solutions to this problem, see I:\Programme\Microsoft
Office\OFFICE11\1033\SETUP.CHM.
Error - 31.05.2012 10:34:39 | Computer Name = *** | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office Professional Edition 2003 -- Error 1706.
Setup cannot find the required files. Check your connection to the network, or
CD-ROM drive. For other potential solutions to this problem, see I:\Programme\Microsoft
Office\OFFICE11\1033\SETUP.CHM.
Error - 31.05.2012 11:13:08 | Computer Name = *** | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office Professional Edition 2003 -- Error 1706.
Setup cannot find the required files. Check your connection to the network, or
CD-ROM drive. For other potential solutions to this problem, see I:\Programme\Microsoft
Office\OFFICE11\1033\SETUP.CHM.
Error - 31.05.2012 14:22:00 | Computer Name = *** | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office Professional Edition 2003 -- Error 1706.
Setup cannot find the required files. Check your connection to the network, or
CD-ROM drive. For other potential solutions to this problem, see I:\Programme\Microsoft
Office\OFFICE11\1033\SETUP.CHM.
[ System Events ]
Error - 31.05.2012 09:29:09 | Computer Name = *** | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
PCIIde ViaIde viamraid
Error - 31.05.2012 09:29:15 | Computer Name = *** | Source = sr | ID = 1
Description = Beim Verarbeiten der Datei "" auf Volume "HarddiskVolume6" ist im
Wiederherstellungsfilter der unerwartete Fehler "0xC0000001" aufgetreten. Die Volumeüberwachung
wurde angehalten.
Error - 31.05.2012 09:30:49 | Computer Name = *** | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk2\D.
Error - 31.05.2012 09:30:58 | Computer Name = *** | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk2\D.
< End of report >
Code:
ATTFilter GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-05-31 21:33:13
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 SAMSUNG_SP2504C rev.VT100-41
Running: 5wop5xg5.exe; Driver: D:\DOKUME~1\WIRZWE~1\LOKALE~1\Temp\pgtdrpog.sys
---- System - GMER 1.0.15 ----
SSDT F7D0B7A4 ZwClose
SSDT F7D0B75E ZwCreateKey
SSDT F7D0B7AE ZwCreateSection
SSDT F7D0B754 ZwCreateThread
SSDT F7D0B763 ZwDeleteKey
SSDT F7D0B76D ZwDeleteValueKey
SSDT F7D0B79F ZwDuplicateObject
SSDT F7D0B772 ZwLoadKey
SSDT F7D0B740 ZwOpenProcess
SSDT F7D0B745 ZwOpenThread
SSDT F7D0B7C7 ZwQueryValueKey
SSDT F7D0B77C ZwReplaceKey
SSDT F7D0B7B8 ZwRequestWaitReplyPort
SSDT F7D0B777 ZwRestoreKey
SSDT F7D0B7B3 ZwSetContextThread
SSDT F7D0B7BD ZwSetSecurityObject
SSDT F7D0B768 ZwSetValueKey
SSDT F7D0B7C2 ZwSystemDebugControl
SSDT F7D0B74F ZwTerminateProcess
---- Kernel code sections - GMER 1.0.15 ----
.text D:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xF65DF3C0, 0x95B7EA, 0xE8000020]
? D:\DOKUME~1\WIRZWE~1\LOKALE~1\Temp\pgtdrpod.sys Das System kann die angegebene Datei nicht finden. !
---- Devices - GMER 1.0.15 ----
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 D:\Programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x81 0x64 0xD7 0xBA ...
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xFB 0xC7 0x26 0x9D ...
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x49 0x83 0xFD 0xDE ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 D:\Programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x81 0x64 0xD7 0xBA ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xFB 0xC7 0x26 0x9D ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x49 0x83 0xFD 0xDE ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 D:\Programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x81 0x64 0xD7 0xBA ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xFB 0xC7 0x26 0x9D ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x49 0x83 0xFD 0xDE ...
---- EOF - GMER 1.0.15 ----
lg Alex |
|
01.06.2012, 15:56
| #2 |
| /// Malware-holic   | Verschlüsselungs-Trojaner, auch das noch... hi
__________________dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user. wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts. • Starte bitte die OTL.exe • Kopiere nun das Folgende in die Textbox. Code:
ATTFilter :OTL
O27 - HKLM IFEO\taskmgr.exe: Debugger - P9KDMF.EXE File not found
:Files
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]
• Schliesse bitte nun alle Programme. • Klicke nun bitte auf den Fix Button. • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen. • Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren. 2. die infektions quelle: an solchen mails mit rechnung, mahnung und sonstigen anhängen, von unbekannten absendern bin ich interessiert. wenn du ein mail programm nutzt, dann mail markieren, rechtsklick, speichern unter, typ: .eml einstellen. dann bitte lesen: markusg - trojaner-board.de und mir die soeben erstellte datei zukommen lassen. wenn du deine mails über den browser abrufst, sag mir mal welchen anbieter du nutzt, dann geht das ein bisschen anders. bitte warne freunde, bekannte, verwante etc vor dieser masche, und lasse ihnen ruhig diese mail adresse zukommen. sie können dann dorthin solche verdächtigen mails senden. diese helfen uns dann, angemessen auf neue bedrohungen zu reagieren, da diese schadsoftware auch updates erhält ist das wichtig.
__________________ |
|
01.06.2012, 16:18
| #3 |
| | Verschlüsselungs-Trojaner, auch das noch... hallo markusg,
__________________vielen dank für die schnelle hilfe  hier das OTL logfile: Code:
ATTFilter All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\ deleted successfully.
========== COMMANDS ==========
[EMPTYFLASH]
User: All Users
User: Default User
User: LocalService
User: NetworkService
User: UpdatusUser
User: WirZweiBeide
->Flash cache emptied: 1180 bytes
Total Flash Files Cleaned = 0,00 mb
[EMPTYTEMP]
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33237 bytes
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: WirZweiBeide
->Temp folder emptied: 1324657 bytes
->Temporary Internet Files folder emptied: 46681436 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2134333 bytes
%systemroot%\System32 .tmp files removed: 2951 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 49152 bytes
RecycleBin emptied: 9444 bytes
Total Files Cleaned = 48,00 mb
OTL by OldTimer - Version 3.2.44.0 log created on 06012012_170438
Files\Folders moved on Reboot...
Registry entries deleted on Reboot...
gruß Alex |
|
06.06.2012, 18:33
| #4 |
| /// Malware-holic | Verschlüsselungs-Trojaner, auch das noch... noch verschlüsselte dateien? im moment gibts leider keine passende lösung :-(
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
| Themen zu Verschlüsselungs-Trojaner, auch das noch... |
| 0xc0000001, administrator, adobe, antivir, avg, avira, bho, browser, dateisystem, desktop, email, error, excel, explorer, fehlermeldung, firefox, flash player, format, heuristiks/extra, heuristiks/shuriken, homepage, microsoft office word, msiinstaller, nvidia, nvidia update, plug-in, problem, realtek, registry, required, rundll, scan, searchscopes, software, starten, version=1.0, windows internet |
Linear-Darstellung
