| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Netzbetreiber sagt ich verschicke Schadware/SpamWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
25.06.2012, 16:09
| #1 |
| |  Netzbetreiber sagt ich verschicke Schadware/Spam Guten Tag, als ich heute nach hause kam war mein Internet gesperrt. Ich kam nur auf eine Seite meines Providers wo drauf stand, dass mein Internet aufgrund von Viren usw. gesperrt wurde. Dort wurden ein paar Programme angeboten. Da es aber noch probleme mit dem ausgeschalteten Internet und dem runterladen von AntiVit Programmen gab installierte ich nur ZoneAlarm. Benutzte die AntiVit software, stellte die Sicherheit auf hoch ein und Aktivierte das Internet wieder. Dann bekam ich einen Anruf von meinem Provider der mich darauf hinwies, dass weiter Schadware/Spams von meinem Internet Anschluss aus gesendet wurden und es desshalb sein könnte, dass es wieder gesperrt wird. Gut das er anrief, ich ging erst von einem Fehlalarm aus. Was genau gesendet wurde konnte man mir nicht sagen, da die Provider aufgrund von privatsphäre nicht in die Datenpakete reingucken können. Was kann ich jetzt tun? Hab schon Malware Antibytes Scan gemacht. Dieser fand 2 PUB.Adware.Agents in meinen temp Ordnern. (Local/Temp & Temp. Internet Files). Sind natürlich in Quarantäne verschoben worden. Kann es sein, dass trotzdem noch was böses versendet wird? Weil ich hab mal gelesen, wenn einmal ein Wurm im System ist kriegt man ihn nichtmehr raus ist das so? defogger Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 16:47 on 25/06/2012 (kinglouie)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter OTL logfile created on: 25.06.2012 16:47:46 - Run 2 OTL by OldTimer - Version 3.2.33.2 Folder = C:\Users\kinglouie\Downloads 64bit- Enterprise Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 8.0.7601.17514) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,97 Gb Total Physical Memory | 2,40 Gb Available Physical Memory | 60,48% Memory free 7,93 Gb Paging File | 5,93 Gb Available in Paging File | 74,70% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 119,24 Gb Total Space | 60,22 Gb Free Space | 50,51% Space Free | Partition Type: NTFS Drive D: | 135,13 Gb Total Space | 32,94 Gb Free Space | 24,38% Space Free | Partition Type: NTFS Computer Name: KINGLOUIE-PC | User Name: kinglouie | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\kinglouie\Downloads\Defogger.exe () PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) PRC - C:\Users\kinglouie\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\VideoLAN\VLC\vlc.exe () PRC - C:\Windows\SysWOW64\PnkBstrA.exe () PRC - C:\Windows\SysWOW64\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD) PRC - C:\Program Files (x86)\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD) ========== Modules (No Company Name) ========== MOD - C:\Users\kinglouie\Downloads\Defogger.exe () MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\libvlc.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\vlc.exe () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\mmx\libi420_rgb_mmx_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_output\libwaveout_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_output\libaout_directx_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\mmx\libi420_yuy2_mmx_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\mmx\libi422_yuy2_mmx_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\mmxext\libmemcpymmxext_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libplaylist_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libavi_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libsubtitle_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libvobsub_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libdemux_stl_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\gui\libqt4_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libdemux_cdg_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libavcodec_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libzvbi_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libtheora_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\lua\liblua_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libflac_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libfluidsynth_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libpng_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libspeex_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libaraw_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libcvdsub_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libcdg_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\liblibass_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libfaad_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libdvbsub_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\liblpcm_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libdts_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libmpeg_audio_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libaes3_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libvorbis_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libschroedinger_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\text_renderer\libfreetype_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\access\liblibbluray_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libdshow_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\liblibmpeg2_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libaccess_bd_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libzip_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libaccess_vdr_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libsubsdec_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libfilesystem_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libspudec_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\liba52_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libsvcdsub_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\access\libstream_filter_rar_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libscale_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libyuvp_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\meta_engine\libtaglib_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libswscale_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\stream_filter\libstream_filter_dash_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\stream_filter\libstream_filter_httplive_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\video_output\libdirectx_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\video_output\libdirect3d_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\control\libhotkeys_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\control\libglobalhotkeys_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\stream_filter\libstream_filter_record_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\misc\libxml_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libyuy2_i420_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libyuy2_i422_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libi422_i420_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libgrey_yuv_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\sse2\libi420_rgb_sse2_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\sse2\libi420_yuy2_sse2_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\sse2\libi422_yuy2_sse2_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_mixer\libfloat32_mixer_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libsamplerate_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libdtstofloat32_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libmpgatofixed32_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\liba52tofloat32_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libspeex_resampler_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libaudio_format_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libscaletempo_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libsimple_channel_mixer_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libdtstospdif_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libconverter_fixed_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libtrivial_channel_mixer_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libdolby_surround_decoder_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libugly_resampler_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\liba52tospdif_plugin.dll () MOD - C:\Program Files (x86)\VideoLAN\VLC\libvlccore.dll () ========== Win32 Services (SafeList) ========== SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD) SRV:64bit: - (AMD FUEL Service) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices, Inc.) SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (NIHardwareService) -- C:\Programme\Common Files\Native Instruments\Hardware\NIHardwareService.exe (Native Instruments GmbH) SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.) SRV - (NAUpdate) -- C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG) SRV - (SearchAnonymizer) -- C:\Users\kinglouie\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe () SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe () SRV - (ThreatFire) -- C:\Program Files (x86)\ThreatFire\TFService.exe (PC Tools) SRV - (WinHttpAutoProxySvc) -- winhttp.dll (Microsoft Corporation) SRV - (vsmon) -- C:\Windows\SysWOW64\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation) DRV:64bit: - (ssudserd) SAMSUNG Mobile USB Diagnostic Serial Port(DEVGURU Ver.) -- C:\Windows\SysNative\drivers\ssudserd.sys (DEVGURU Co., LTD.(www.devguru.co.kr)) DRV:64bit: - (ssudmdm) SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr)) DRV:64bit: - (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr)) DRV:64bit: - (sscemdm) -- C:\Windows\SysNative\drivers\sscemdm.sys (MCCI Corporation) DRV:64bit: - (sscebus) SAMSUNG USB Composite Device V2 driver (WDM) -- C:\Windows\SysNative\drivers\sscebus.sys (MCCI Corporation) DRV:64bit: - (sscemdfl) -- C:\Windows\SysNative\drivers\sscemdfl.sys (MCCI Corporation) DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.) DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.) DRV:64bit: - (NBVol) -- C:\Windows\SysNative\drivers\NBVol.sys (Nero AG) DRV:64bit: - (NBVolUp) -- C:\Windows\SysNative\drivers\NBVolUp.sys (Nero AG) DRV:64bit: - (SCDEmu) -- C:\Windows\SysNative\drivers\scdemu.sys (PowerISO Computing, Inc.) DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices) DRV:64bit: - (TfSysMon) -- C:\Windows\SysNative\drivers\TfSysMon.sys (PC Tools) DRV:64bit: - (TfNetMon) -- C:\Windows\SysNative\drivers\TfNetMon.sys (PC Tools) DRV:64bit: - (TfFsMon) -- C:\Windows\SysNative\drivers\TfFsMon.sys (PC Tools) DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation) DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (tsusbhub) -- C:\Windows\SysNative\drivers\tsusbhub.sys (Microsoft Corporation) DRV:64bit: - (Synth3dVsc) -- C:\Windows\SysNative\drivers\Synth3dVsc.sys (Microsoft Corporation) DRV:64bit: - (dmvsc) -- C:\Windows\SysNative\drivers\dmvsc.sys (Microsoft Corporation) DRV:64bit: - (terminpt) -- C:\Windows\SysNative\drivers\terminpt.sys (Microsoft Corporation) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation) DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (Renesas Electronics Corporation) DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (Renesas Electronics Corporation) DRV:64bit: - (Vsdatant) -- C:\Windows\SysNative\drivers\vsdatant.sys (Check Point Software Technologies LTD) DRV:64bit: - (RzSynapse) -- C:\Windows\SysNative\drivers\RzSynapse.sys (Razer USA Ltd) DRV:64bit: - (amdiox64) -- C:\Windows\SysNative\drivers\amdiox64.sys (Advanced Micro Devices) DRV:64bit: - (KLIF) -- C:\Windows\SysNative\drivers\klif.sys (Kaspersky Lab) DRV:64bit: - (kl1) -- C:\Windows\SysNative\drivers\kl1.sys (Kaspersky Lab) DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek ) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (irda) -- C:\Windows\SysNative\drivers\irda.sys (Microsoft Corporation) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (AtiPcie) AMD PCI Express (3GIO) -- C:\Windows\SysNative\drivers\AtiPcie.sys (Advanced Micro Devices Inc.) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (irsir) -- C:\Windows\SysNative\drivers\irsir.sys (Microsoft Corporation) DRV:64bit: - (athrusb) -- C:\Windows\SysNative\drivers\athrxusb.sys (Atheros Communications, Inc.) DRV:64bit: - (CBPSp50a64) -- C:\Windows\SysNative\drivers\CBPSp50a64.sys (Printing Communications Assoc., Inc. (PCAUSA)) DRV - (AODDriver4.01) -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys (Advanced Micro Devices) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.facemoods.com/?a=ddrnw IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = DE 32 AD 80 9E 63 CC 01 [binary data] IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Google" FF - prefs.js..browser.startup.homepage: "google.de" FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_262.dll File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@Nero.com/KM: C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.0: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.06.17 02:59:32 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.04.13 21:22:33 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\firejump@firejump.net: C:\Users\kinglouie\AppData\Roaming\Mozilla\Firefox\Profiles\6cs9p47b.default\extensions\firejump@firejump.net [2011.08.26 03:35:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\kinglouie\AppData\Roaming\mozilla\Extensions [2012.05.02 23:17:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\kinglouie\AppData\Roaming\mozilla\Firefox\Profiles\6cs9p47b.default\extensions [2012.04.27 20:11:15 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\kinglouie\AppData\Roaming\mozilla\Firefox\Profiles\6cs9p47b.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2012.04.03 00:14:01 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\kinglouie\AppData\Roaming\mozilla\Firefox\Profiles\6cs9p47b.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2012.03.16 01:26:53 | 000,000,000 | ---D | M] (Ghostery) -- C:\Users\kinglouie\AppData\Roaming\mozilla\Firefox\Profiles\6cs9p47b.default\extensions\firefox@ghostery.com [2011.08.26 21:46:23 | 000,002,182 | ---- | M] () -- C:\Users\kinglouie\AppData\Roaming\Mozilla\Firefox\Profiles\6cs9p47b.default\searchplugins\{29103BB3-80A2-408A-845A-07789B24AE9C}.xml [2011.08.26 21:46:22 | 000,001,864 | ---- | M] () -- C:\Users\kinglouie\AppData\Roaming\Mozilla\Firefox\Profiles\6cs9p47b.default\searchplugins\{B0B4A79E-6E56-4EE5-9744-1D5044D4ED2B}.xml [2011.08.26 21:46:22 | 000,002,071 | ---- | M] () -- C:\Users\kinglouie\AppData\Roaming\Mozilla\Firefox\Profiles\6cs9p47b.default\searchplugins\{F3421BE6-FA73-46FE-891F-14954660F07D}.xml [2012.03.20 05:00:02 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions () (No name found) -- C:\USERS\KINGLOUIE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\6CS9P47B.DEFAULT\EXTENSIONS\GROOVESHARKUNLOCKER@OVERLORD1337.XPI [2012.06.17 02:59:32 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2012.03.07 04:18:57 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2011.07.11 23:48:12 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll [2012.01.29 16:02:49 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.01.29 15:50:55 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012.01.29 16:02:49 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2011.09.26 21:34:40 | 000,002,048 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrch.xml [2012.01.29 16:02:49 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012.01.29 16:02:49 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012.01.29 16:02:49 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2011.10.14 02:51:55 | 000,002,639 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 29 more lines... O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O4:64bit: - HKLM..\Run: [Ocs_SM] C:\Users\kinglouie\AppData\Roaming\OCS\SM\SearchAnonymizer.exe (OCS) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Programme\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4:64bit: - HKLM..\Run: [Skytel] C:\Programme\Realtek\Audio\HDA\SkyTel.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files (x86)\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD) O4 - HKCU..\Run: [ASRockOCTuner] File not found O4 - HKCU..\Run: [zASRockInstantBoot] File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1 O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\kinglouie\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\kinglouie\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files (x86)\ICQLite\ICQLite.exe (ICQ Ltd.) O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files (x86)\ICQLite\ICQLite.exe (ICQ Ltd.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F0E40644-EFCC-42B2-A7B1-BE598ED5DFEF}: DhcpNameServer = 192.168.0.1 O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18:64bit: - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O18:64bit: - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O18:64bit: - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - Explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O29:64bit: - HKLM SecurityProviders - (credssp.dll) - credssp.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (credssp.dll) - credssp.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{8d5116ec-cf62-11e0-ac30-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{8d5116ec-cf62-11e0-ac30-806e6f6e6963}\Shell\AutoRun\command - "" = E:\AutoRunCD.exe O33 - MountPoints2\G\Shell - "" = AutoRun O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\autorun.exe O33 - MountPoints2\H\Shell - "" = AutoRun O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\noautorun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2012.06.25 13:31:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky SDK [2012.06.25 13:29:04 | 000,000,000 | ---D | C] -- C:\Users\kinglouie\AppData\Roaming\MailFrontier [2012.06.25 13:26:02 | 000,033,280 | ---- | C] (Zone Labs Inc.) -- C:\Windows\zllsputility_loc0407.dll [2012.06.25 13:26:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZoneAlarm [2012.06.25 13:26:01 | 000,157,712 | ---- | C] (Kaspersky Lab) -- C:\Windows\SysNative\drivers\kl1.sys [2012.06.25 13:25:59 | 000,351,248 | ---- | C] (Kaspersky Lab) -- C:\Windows\SysNative\drivers\klif.sys [2012.06.25 13:25:39 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\ZoneLabs [2012.06.25 13:25:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Zone Labs [2012.06.25 13:22:54 | 000,000,000 | ---D | C] -- C:\Windows\Internet Logs [2012.06.21 06:00:53 | 000,000,000 | ---D | C] -- C:\Users\kinglouie\AppData\Local\Macromedia [2012.06.15 15:56:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\eRightSoft [2012.06.14 15:48:59 | 000,000,000 | ---D | C] -- C:\Users\kinglouie\AppData\Local\{E7B34268-1316-49D2-8759-4E0D0525F08C} [2012.06.14 15:48:49 | 000,000,000 | ---D | C] -- C:\Users\kinglouie\AppData\Local\{8EB05AA0-709E-48F6-A604-871E8F708BC6} [2012.06.14 15:45:31 | 000,000,000 | ---D | C] -- C:\Windows\de [2012.06.14 15:41:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft SQL Server Compact Edition [2012.06.14 15:38:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Windows Live [2012.06.14 15:38:31 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH [2012.06.14 15:37:02 | 000,000,000 | ---D | C] -- C:\Users\kinglouie\AppData\Local\Windows Live [2012.06.14 15:37:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Windows Live [2012.06.14 14:29:24 | 000,000,000 | ---D | C] -- C:\Users\kinglouie\Desktop\Neuer Ordner (4) [2012.06.03 17:12:27 | 000,000,000 | ---D | C] -- C:\Users\kinglouie\Desktop\Neuer Ordner (2) [2012.06.03 15:45:02 | 000,000,000 | ---D | C] -- C:\Users\kinglouie\Desktop\bilder [2012.05.29 23:36:19 | 000,000,000 | ---D | C] -- C:\Users\kinglouie\AppData\Roaming\LolClient2 [2 C:\Windows\SysNative\drivers\*.tmp files -> C:\Windows\SysNative\drivers\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.06.25 16:47:04 | 000,000,000 | ---- | M] () -- C:\Users\kinglouie\defogger_reenable [2012.06.25 16:06:15 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.06.25 16:02:51 | 000,022,672 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.06.25 16:02:50 | 000,022,672 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.06.25 16:01:53 | 001,527,504 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.06.25 16:01:53 | 000,664,396 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.06.25 16:01:53 | 000,624,578 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.06.25 16:01:53 | 000,134,564 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.06.25 16:01:53 | 000,110,216 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.06.25 15:55:35 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.06.25 15:55:28 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.06.25 15:20:07 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.06.25 13:26:14 | 000,421,394 | ---- | M] () -- C:\Windows\SysNative\drivers\vsconfig.xml [2012.06.25 13:26:02 | 000,005,977 | ---- | M] () -- C:\Windows\SysWow64\vsconfig.xml [2012.06.24 03:06:55 | 000,010,291 | ---- | M] () -- C:\Users\kinglouie\Desktop\smart.ods [2012.06.21 06:28:49 | 024,209,790 | ---- | M] () -- C:\Users\kinglouie\Desktop\VBT 2011 Weekend 4tel HR gegen Dr. Lucs.wav [2012.06.15 16:00:30 | 187,607,681 | ---- | M] () -- C:\Users\kinglouie\Desktop\Duzoe vs. Weekend HR2 [Halbfinale] VBT Splash_-Edition.mp4 [2012.06.14 15:41:22 | 000,000,020 | ---- | M] () -- C:\Windows\0÷Ð [2012.06.04 22:15:33 | 013,149,077 | ---- | M] () -- C:\Users\kinglouie\HD4.psd [2012.06.04 17:24:16 | 005,951,497 | ---- | M] () -- C:\Users\kinglouie\HD4.jpg [2012.06.04 14:54:10 | 183,175,371 | ---- | M] () -- C:\Users\kinglouie\Desktop\Laden Detektiv.mp4 [2 C:\Windows\SysNative\drivers\*.tmp files -> C:\Windows\SysNative\drivers\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.06.25 16:47:04 | 000,000,000 | ---- | C] () -- C:\Users\kinglouie\defogger_reenable [2012.06.25 15:20:07 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.06.25 13:26:02 | 000,011,264 | ---- | C] () -- C:\Windows\SysWow64\imsinstall_loc0407.dll [2012.06.25 13:26:02 | 000,007,168 | ---- | C] () -- C:\Windows\SysWow64\imslsp_install_loc0407.dll [2012.06.25 13:26:02 | 000,005,977 | ---- | C] () -- C:\Windows\SysWow64\vsconfig.xml [2012.06.25 13:25:38 | 000,421,394 | ---- | C] () -- C:\Windows\SysNative\drivers\vsconfig.xml [2012.06.21 06:28:45 | 024,209,790 | ---- | C] () -- C:\Users\kinglouie\Desktop\VBT 2011 Weekend 4tel HR gegen Dr. Lucs.wav [2012.06.15 15:57:10 | 187,607,681 | ---- | C] () -- C:\Users\kinglouie\Desktop\Duzoe vs. Weekend HR2 [Halbfinale] VBT Splash_-Edition.mp4 [2012.06.14 15:44:08 | 000,001,305 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Movie Maker.lnk [2012.06.14 15:42:37 | 000,001,374 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Photo Gallery.lnk [2012.06.14 15:41:21 | 000,000,020 | ---- | C] () -- C:\Windows\0÷Ð [2012.06.04 19:00:23 | 183,175,371 | ---- | C] () -- C:\Users\kinglouie\Desktop\Laden Detektiv.mp4 [2012.06.04 17:24:08 | 005,951,497 | ---- | C] () -- C:\Users\kinglouie\HD4.jpg [2012.06.04 17:12:34 | 013,149,077 | ---- | C] () -- C:\Users\kinglouie\HD4.psd [2012.05.29 17:08:34 | 000,010,291 | ---- | C] () -- C:\Users\kinglouie\Desktop\smart.ods [2012.05.14 19:44:41 | 000,007,668 | ---- | C] () -- C:\Users\kinglouie\AppData\Local\Resmon.ResmonCfg [2012.04.21 17:23:04 | 000,000,847 | ---- | C] () -- C:\Windows\eReg.dat [2012.03.03 18:25:06 | 000,101,416 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat [2012.01.10 18:01:34 | 000,000,193 | ---- | C] () -- C:\Windows\WORDPAD.INI [2011.12.23 21:58:28 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe [2011.12.23 21:58:24 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll [2011.12.23 21:58:24 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll [2011.12.23 21:58:24 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll [2011.12.23 21:58:24 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll [2011.08.26 01:35:16 | 000,000,097 | ---- | C] () -- C:\Users\kinglouie\AppData\Local\fusioncache.dat [2011.08.26 01:33:32 | 001,526,730 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2011.08.26 01:32:45 | 000,669,184 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe [2011.08.26 01:32:45 | 000,103,736 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2011.08.26 01:32:45 | 000,066,872 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe [2011.08.26 00:10:27 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2011.08.25 23:51:09 | 000,146,432 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL [2011.08.25 23:51:09 | 000,072,704 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL [2011.07.17 23:54:02 | 000,059,904 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll [2011.03.17 19:51:44 | 000,003,929 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat ========== LOP Check ========== [2012.06.21 06:32:22 | 000,000,000 | ---D | M] -- C:\Users\kinglouie\AppData\Roaming\Audacity [2011.09.24 14:53:02 | 000,000,000 | ---D | M] -- C:\Users\kinglouie\AppData\Roaming\Canneverbe Limited [2011.11.16 03:18:53 | 000,000,000 | ---D | M] -- C:\Users\kinglouie\AppData\Roaming\CD-LabelPrint [2011.12.04 05:33:42 | 000,000,000 | ---D | M] -- C:\Users\kinglouie\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 [2011.08.26 21:46:22 | 000,000,000 | ---D | M] -- C:\Users\kinglouie\AppData\Roaming\DesktopIconForAmazon [2012.05.14 19:57:47 | 000,000,000 | ---D | M] -- C:\Users\kinglouie\AppData\Roaming\digipen [2012.04.27 20:11:28 | 000,000,000 | ---D | M] -- C:\Users\kinglouie\AppData\Roaming\DVDVideoSoft [2011.12.22 06:28:31 | 000,000,000 | ---D | M] -- C:\Users\kinglouie\AppData\Roaming\DVDVideoSoftIEHelpers [2012.05.22 17:43:48 | 000,000,000 | ---D | M] -- C:\Users\kinglouie\AppData\Roaming\FileZilla [2012.04.23 21:22:11 | 000,000,000 | ---D | M] -- C:\Users\kinglouie\AppData\Roaming\HLSW [2011.08.26 21:49:00 | 000,000,000 | ---D | M] -- C:\Users\kinglouie\AppData\Roaming\ICQLite [2011.12.22 02:34:09 | 000,000,000 | ---D | M] -- C:\Users\kinglouie\AppData\Roaming\LolClient [2012.05.29 23:36:19 | 000,000,000 | ---D | M] -- C:\Users\kinglouie\AppData\Roaming\LolClient2 [2012.06.25 13:29:04 | 000,000,000 | ---D | M] -- C:\Users\kinglouie\AppData\Roaming\MailFrontier [2012.05.18 00:28:50 | 000,000,000 | ---D | M] -- C:\Users\kinglouie\AppData\Roaming\Natural Selection 2 [2011.08.26 21:46:21 | 000,000,000 | ---D | M] -- C:\Users\kinglouie\AppData\Roaming\OCS [2011.08.26 05:57:01 | 000,000,000 | ---D | M] -- C:\Users\kinglouie\AppData\Roaming\OpenOffice.org [2011.08.26 21:46:23 | 000,000,000 | ---D | M] -- C:\Users\kinglouie\AppData\Roaming\Opera [2012.03.07 03:49:41 | 000,000,000 | ---D | M] -- C:\Users\kinglouie\AppData\Roaming\ROUTE 66 Sync [2012.01.30 00:41:24 | 000,000,000 | ---D | M] -- C:\Users\kinglouie\AppData\Roaming\Samsung [2012.04.21 04:34:32 | 000,000,000 | ---D | M] -- C:\Users\kinglouie\AppData\Roaming\Temp [2012.03.15 01:06:29 | 000,000,000 | ---D | M] -- C:\Users\kinglouie\AppData\Roaming\TS3Client [2012.05.12 12:23:10 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > Vielen Dank schonmal im Vorraus! So mir sind nun selber 2 Programme aufgefallen: nsBAC0.tmp nsBE57.tmp Sie standen im Protokoll von ZA unter OSFirewall. Herkunft Local/Temp/nsBDe9.tmp & Local/Temp/nsfD82C.tmp Werden Asugeführt. Maßnahmen : keine Zugewiesenes Programm war für beide conhost.exe Nachdem ich im Internet nichts weiter dazu fand, hab ich es nicht mehr beachtet. Dann tauchten diese beiden teile aber plötzlich in meiner Programmübersucht von Zonealarm auf. Hab beide jetzt blockiert. Könnte das was gewesen sein oder eher nicht? lg kinglouie |
|
28.06.2012, 11:36
| #2 | ||
| /// Winkelfunktion /// TB-Süch-Tiger™   | Netzbetreiber sagt ich verschicke Schadware/SpamZitat:
 ZoneAlarm ist kontraproduktiver Müll, bitte umgehend deinstallieren und die Windows-Firewall einschalten! Zitat:
 Alles von Malwarebytes (und evtl. anderen Scannern) muss hier gepostet werden. Bitte alles nach Möglichkeit hier in CODE-Tags posten. Wird so gemacht: [code] hier steht das Log [/code] Und das ganze sieht dann so aus: Code:
ATTFilter hier steht das Log
__________________ |
|
28.06.2012, 14:41
| #3 |
| | Netzbetreiber sagt ich verschicke Schadware/Spam schreibe vom Handy, internet wurde wieder gesperrt.
__________________Kann es sein, dass von einem email acc etwas verschickt wird wenn ich gerade eingeloggt bin? Die techniker hotline erreiche ich noch nicht. Anbei die malware logfiles. wie meinst du das mit den codes, hab ich doch gemacht? lg kinglouie |
|
28.06.2012, 15:55
| #4 |
| | Netzbetreiber sagt ich verschicke Schadware/Spam //mir wurde jetzt noch gesagt, dass es spammails sind und die letzten 2tage keine verschickt worden. |
|
29.06.2012, 10:53
| #5 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Netzbetreiber sagt ich verschicke Schadware/SpamCode:
ATTFilter C:\Program Files (x86)\Adobe\Adobe PhotoShop CS4 Middle Eastern\Stubs\5068548333b0398df95670b7295c5e386a12530\FNPLicensingService.exe (Trojan.Backdoor)
Aus welcher Quelle stammt dein CS4?
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
29.06.2012, 13:35
| #6 |
| | Netzbetreiber sagt ich verschicke Schadware/Spam Hi, habe das schon lange auf dem rechner. Gerade kam von Malwarebytes die meldung, dass ein bösartiger prozess von cs4 gestartet wurde. Jede minute hat er es erneut probiert. dieser FNPlicencingservice. Gerade hat sich cs4 einfach gestartet. Wodurch die datei wieder da war. Ich bin mir jetzt sehr sicher, dass das der übeltäter ist. Komisch nur, dass Malwarebytes diese zugriffe erst jetzt erkannt hat. Wollte das system neu aufspielen, wäre das sicher? Oder könnten andere Dateien infiziert sein? lg kinglouie |
|
29.06.2012, 13:48
| #7 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Netzbetreiber sagt ich verschicke Schadware/SpamZitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Netzbetreiber sagt ich verschicke Schadware/Spam |
| aufgehangen, device driver, explorer, fehlalarm, firefox, firefox 13.0.1, flash player, format, google, google earth, internet, kaspersky, langs, locker, logfile, malware, mozilla, mp3, plug-in, port, poweriso, realtek, registry, scan, sekunden, sicherheit, software, system, temp, usb, viren, viren usw., windows, wurm |
Linear-Darstellung
