Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
GVU 2.07 eingefangen

GVU 2.07 eingefangen


Plagegeister aller Art und deren Bekämpfung: GVU 2.07 eingefangen

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Seite 1 von 2 1 2
Alt 28.07.2012, 20:50   #1
pixiebanshee
 
GVU 2.07 eingefangen - Unglücklich

GVU 2.07 eingefangen


Hallo!
Hallo meine Eltern haben sich auch ihrem Laptop mit OS Vista 32bit Home Premium den GVU 2.07 Trojaner eingefangen.
Der Laptop hat 4 Benutzerkonten, 2 davon Administrator und 2 eingeschränkt. Nur bei einem der eigneschränkten wird der Trojaner ersichtlich (Benutzerkonto E****, Programme als Administrator H**** ausgeführt).

Der Trojaner ist wohl seit Donnerstag drauf, ich habe davon erst heute erfahren und bemerkt, dass avast nicht registriert und somit inaktiv war. Das ist mittlerweile behoben.

Ich hab dummerweise erst defogger und OTL ausgeführt (bei GMER kam eine Fehlermeldung und das ganze wurde abgebrochen) und erst dann den Malwarebytes-Scan. Soll ich das nochmal anders herum machen? (Die 3 infizierten Daten beim Malwarebytes-Scan wurden entfernt, hab leider nicht verstanden, wie ich das in Quarantäne hätte verschieben können)

Das ist das Ergebniss des Malwarebytes-Scan.
Code:
ATTFilter
Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.28.06

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
E**** :: ****-LAPTOP [limitiert]

28.07.2012 21:10:24
mbam-log-2012-07-28 (21-27-38).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 147685
Laufzeit: 9 Minute(n), 8 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 1
C:\Users\E****\AppData\Local\Temp\rty0_7z.exe (Spyware.Zbot.DG) -> Keine Aktion durchgeführt.

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Users\E****\AppData\Local\Temp\rty0_7z.exe (Spyware.Zbot.DG) -> Keine Aktion durchgeführt.
C:\Users\E****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk (Trojan.Ransom.Gen) -> Keine Aktion durchgeführt.

(Ende)
und hier von OTL
Code:
ATTFilter
OTL logfile created on: 28.07.2012 19:21:34 - Run 1
OTL by OldTimer - Version 3.2.55.0     Folder = C:\Users\E****\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,20 Gb Available Physical Memory | 59,89% Memory free
4,23 Gb Paging File | 3,28 Gb Available in Paging File | 77,64% Paging File free
Paging file location(s): c:\pagefile.sys 0 0 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 219,72 Gb Total Space | 93,34 Gb Free Space | 42,48% Space Free | Partition Type: NTFS
Drive D: | 1,26 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: *****-LAPTOP | User Name: H**** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.07.28 15:48:50 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Users\E****\Desktop\OTL.exe
PRC - [2012.07.03 18:21:30 | 004,273,976 | ---- | M] (AVAST Software) -- C:\Programme\Alwil Software\Avast5\AvastUI.exe
PRC - [2012.07.03 18:21:29 | 000,044,808 | ---- | M] (AVAST Software) -- C:\Programme\Alwil Software\Avast5\AvastSvc.exe
PRC - [2012.06.02 11:08:27 | 000,748,664 | ---- | M] (Microsoft Corporation) -- C:\Programme\Internet Explorer\iexplore.exe
PRC - [2012.03.19 13:38:47 | 002,666,880 | ---- | M] (TeamViewer GmbH) -- C:\Programme\TeamViewer\Version7\TeamViewer_Service.exe
PRC - [2009.04.11 08:28:03 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.01.19 09:38:38 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe
PRC - [2007.11.14 16:50:42 | 004,706,304 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2007.11.06 17:57:50 | 000,024,576 | ---- | M] () -- C:\Programme\AVEO\AveoCap\AveoSTI.exe
PRC - [2007.10.22 11:42:18 | 000,009,216 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe
PRC - [2007.10.15 10:15:08 | 001,410,344 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Nero\Lib\NMIndexStoreSvr.exe
PRC - [2007.10.15 10:14:48 | 000,202,024 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Nero\Lib\NMBgMonitor.exe
PRC - [2007.09.12 11:35:36 | 000,561,152 | ---- | M] (MSI) -- C:\Programme\System Control Manager\MGSysCtrl.exe
PRC - [2007.08.23 15:37:18 | 000,061,440 | ---- | M] () -- C:\Programme\System Control Manager\edd.exe
PRC - [2007.08.02 20:41:52 | 002,760,704 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
PRC - [2007.07.13 18:53:34 | 000,274,432 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe
PRC - [2007.06.26 12:21:40 | 002,170,880 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtProc.exe
PRC - [2007.06.14 17:57:08 | 000,282,624 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
PRC - [2007.06.06 00:04:42 | 000,021,504 | ---- | M] (UPEK Inc.) -- C:\Programme\Protector Suite QL\upeksvr.exe
PRC - [2007.06.05 23:46:52 | 000,053,776 | ---- | M] (UPEK Inc.) -- C:\Programme\Protector Suite QL\psqltray.exe
PRC - [2007.02.27 21:21:08 | 000,278,528 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
PRC - [2007.02.25 22:55:18 | 000,125,048 | ---- | M] (TOSHIBA CORPORATION) -- C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
PRC - [2007.01.30 18:47:46 | 000,307,200 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosOBEX.exe
PRC - [2006.11.02 21:40:12 | 000,174,656 | ---- | M] () -- C:\Windows\System32\PSIService.exe
PRC - [2006.01.24 00:14:10 | 000,069,632 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
PRC - [2005.09.23 23:05:26 | 000,029,696 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.07.26 14:32:02 | 000,262,056 | ---- | M] () -- C:\Users\E****\AppData\Local\Temp\rty0_7z.exe
MOD - [2012.06.16 13:12:24 | 011,820,032 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\508b444db523c5cf20ff12c7f440837b\System.Web.ni.dll
MOD - [2012.06.16 09:54:16 | 012,433,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\f2691cfa7671cdc58179e56ba9227591\System.Windows.Forms.ni.dll
MOD - [2012.06.16 09:54:05 | 001,592,320 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\18f9789aa214c657113e676b3a9015aa\System.Drawing.ni.dll
MOD - [2012.05.17 19:39:51 | 000,998,400 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\f3d4d5fe5ab848fbfcf91a49960dc8ae\System.Management.ni.dll
MOD - [2012.05.17 19:37:39 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\846b9cf2756fdd15f704c9bab9c70b6f\System.Runtime.Remoting.ni.dll
MOD - [2012.05.13 13:17:51 | 005,450,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d2630342a066a7cb9056d9eb6157687a\System.Xml.ni.dll
MOD - [2012.05.13 13:15:44 | 007,953,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\28d633338fc8d29f8af31935ef7d001b\System.ni.dll
MOD - [2012.05.13 13:15:27 | 011,492,352 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\af9c9e9d7e0523cd444f8b551baa9cbf\mscorlib.ni.dll
MOD - [2009.03.30 06:42:12 | 000,434,176 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll
MOD - [2009.03.30 06:42:11 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2007.12.18 15:11:18 | 001,675,264 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Wizard\2.0.2888.40496__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Wizard.dll
MOD - [2007.12.18 15:11:18 | 000,364,544 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Wizard\2.0.2888.40732__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Wizard.dll
MOD - [2007.12.18 15:11:18 | 000,249,856 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.2888.40448__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll
MOD - [2007.12.18 15:11:18 | 000,196,608 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.2888.40511__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll
MOD - [2007.12.18 15:11:18 | 000,077,824 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.2888.40722__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll
MOD - [2007.12.18 15:11:18 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.2888.40677__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll
MOD - [2007.12.18 15:11:18 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.2888.40486__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll
MOD - [2007.12.18 15:11:18 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.2888.40621__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll
MOD - [2007.12.18 15:11:18 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.2888.40470__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll
MOD - [2007.12.18 15:11:17 | 000,483,328 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.2888.40762__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.dll
MOD - [2007.12.18 15:11:16 | 000,352,256 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Dashboard\2.0.2888.40687__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll
MOD - [2007.12.18 15:11:16 | 000,192,512 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Grid.HydraVision.Dashboard\2.0.1.0__90ba9c70f846762e\CLI.Aspect.Grid.HydraVision.Dashboard.dll
MOD - [2007.12.18 15:11:16 | 000,139,264 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Dashboard\2.0.2888.40760__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Dashboard.dll
MOD - [2007.12.18 15:11:16 | 000,135,168 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.2888.40769__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.dll
MOD - [2007.12.18 15:11:16 | 000,090,112 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.2888.40695__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.dll
MOD - [2007.12.18 15:11:16 | 000,073,728 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.2888.40464__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.dll
MOD - [2007.12.18 15:11:16 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Runtime\2.0.2888.40686__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Runtime.dll
MOD - [2007.12.18 15:11:16 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime\2.0.2888.40759__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime.dll
MOD - [2007.12.18 15:11:16 | 000,012,288 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.HydraVision.Runtime\2.0.2888.40799__90ba9c70f846762e\CLI.Caste.HydraVision.Runtime.dll
MOD - [2007.12.18 15:11:16 | 000,008,704 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.HydraVision.Shared\2.0.2888.40798__90ba9c70f846762e\CLI.Caste.HydraVision.Shared.dll
MOD - [2007.12.18 15:11:16 | 000,007,680 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.HydraVision.Dashboard\2.0.2888.40799__90ba9c70f846762e\CLI.Caste.HydraVision.Dashboard.dll
MOD - [2007.12.18 15:11:15 | 000,794,624 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Dashboard\2.0.2888.40633__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Dashboard.dll
MOD - [2007.12.18 15:11:15 | 000,401,408 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Wizard\2.0.2888.40711__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Wizard.dll
MOD - [2007.12.18 15:11:15 | 000,069,632 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Runtime\2.0.2888.40631__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Runtime.dll
MOD - [2007.12.18 15:11:14 | 000,901,120 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Dashboard\2.0.2888.40724__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Dashboard.dll
MOD - [2007.12.18 15:11:14 | 000,585,728 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Dashboard\2.0.2888.40526__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll
MOD - [2007.12.18 15:11:14 | 000,479,232 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.2888.40624__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll
MOD - [2007.12.18 15:11:14 | 000,434,176 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Dashboard\2.0.2888.40472__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Dashboard.dll
MOD - [2007.12.18 15:11:14 | 000,401,408 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Dashboard\2.0.2888.40669__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Dashboard.dll
MOD - [2007.12.18 15:11:14 | 000,331,776 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Dashboard\2.0.2888.40616__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Dashboard.dll
MOD - [2007.12.18 15:11:14 | 000,307,200 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Wizard\2.0.2888.40533__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Wizard.dll
MOD - [2007.12.18 15:11:14 | 000,212,992 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.2888.40518__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll
MOD - [2007.12.18 15:11:14 | 000,118,784 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Dashboard\2.0.2888.40652__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll
MOD - [2007.12.18 15:11:14 | 000,057,344 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.2888.40622__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll
MOD - [2007.12.18 15:11:14 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Runtime\2.0.2888.40532__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll
MOD - [2007.12.18 15:11:14 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.2888.40631__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll
MOD - [2007.12.18 15:11:14 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Runtime\2.0.2888.40651__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll
MOD - [2007.12.18 15:11:14 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.2888.40667__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll
MOD - [2007.12.18 15:11:13 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation\2.0.2858.39381__90ba9c70f846762e\CLI.Foundation.dll
MOD - [2007.12.18 15:11:13 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll
MOD - [2007.12.18 15:11:13 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation\2.0.2858.39378__90ba9c70f846762e\LOG.Foundation.dll
MOD - [2007.12.18 15:11:13 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.2858.39490__90ba9c70f846762e\CLI.Foundation.XManifest.dll
MOD - [2007.12.18 15:11:13 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.2858.39384__90ba9c70f846762e\NEWAEM.Foundation.dll
MOD - [2007.12.18 15:11:13 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.OS.I0602\2.0.2858.39448__90ba9c70f846762e\DEM.OS.I0602.dll
MOD - [2007.12.18 15:11:13 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.2858.39397__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll
MOD - [2007.12.18 15:11:13 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.2858.39396__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll
MOD - [2007.12.18 15:11:13 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.2858.39386__90ba9c70f846762e\CLI.Component.Client.Shared.dll
MOD - [2007.12.18 15:11:13 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.2858.39392__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll
MOD - [2007.12.18 15:11:13 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.2858.39389__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll
MOD - [2007.12.18 15:11:13 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Foundation\2.0.2858.39411__90ba9c70f846762e\MOM.Foundation.dll
MOD - [2007.12.18 15:11:13 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.OS\2.0.2858.39449__90ba9c70f846762e\DEM.OS.dll
MOD - [2007.12.18 15:11:13 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0706\2.0.2743.23304__90ba9c70f846762e\DEM.Graphics.I0706.dll
MOD - [2007.12.18 15:11:13 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics\2.0.2858.39447__90ba9c70f846762e\DEM.Graphics.dll
MOD - [2007.12.18 15:11:13 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll
MOD - [2007.12.18 15:11:13 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.2858.39392__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll
MOD - [2007.12.18 15:11:13 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.2858.39450__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll
MOD - [2007.12.18 15:11:13 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.2858.39398__90ba9c70f846762e\AEM.Plugin.EEU.Shared.dll
MOD - [2007.12.18 15:11:13 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.2858.39451__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll
MOD - [2007.12.18 15:11:13 | 000,006,656 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll
MOD - [2007.12.18 15:11:12 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.2858.39457__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll
MOD - [2007.12.18 15:11:12 | 000,057,344 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.2858.39394__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll
MOD - [2007.12.18 15:11:12 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.2858.39421__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.dll
MOD - [2007.12.18 15:11:12 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.2858.39415__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.dll
MOD - [2007.12.18 15:11:12 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Shared\2.0.2868.26817__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Shared.dll
MOD - [2007.12.18 15:11:12 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.2858.39454__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.dll
MOD - [2007.12.18 15:11:12 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.2858.39414__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.dll
MOD - [2007.12.18 15:11:12 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.2858.39420__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll
MOD - [2007.12.18 15:11:12 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.2858.39399__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll
MOD - [2007.12.18 15:11:12 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Shared\2.0.2858.39423__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll
MOD - [2007.12.18 15:11:12 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.2858.39445__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.dll
MOD - [2007.12.18 15:11:12 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Shared\2.0.2858.39453__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Shared.dll
MOD - [2007.12.18 15:11:12 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Shared\2.0.2858.39418__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Shared.dll
MOD - [2007.12.18 15:11:12 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.2858.39412__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll
MOD - [2007.12.18 15:11:12 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.2858.39445__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll
MOD - [2007.12.18 15:11:12 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\APM.Foundation\2.0.2858.39410__90ba9c70f846762e\APM.Foundation.dll
MOD - [2007.12.18 15:11:12 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.2858.39425__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll
MOD - [2007.12.18 15:11:12 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.2858.39446__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.dll
MOD - [2007.12.18 15:11:11 | 000,102,400 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Implementation\2.0.2888.40750__90ba9c70f846762e\MOM.Implementation.dll
MOD - [2007.12.18 15:11:11 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.2888.40785__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll
MOD - [2007.12.18 15:11:11 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.2858.39389__90ba9c70f846762e\LOG.Foundation.Private.dll
MOD - [2007.12.18 15:11:11 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Foundation\2.0.2858.39379__90ba9c70f846762e\AEM.Foundation.dll
MOD - [2007.12.18 15:11:11 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2573.17685__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.dll
MOD - [2007.12.18 15:11:11 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOCALIZATION.Foundation.Private\2.0.2858.39384__90ba9c70f846762e\LOCALIZATION.Foundation.Private.dll
MOD - [2007.12.18 15:11:11 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Server.Shared\2.0.2858.39391__90ba9c70f846762e\AEM.Server.Shared.dll
MOD - [2007.12.18 15:11:11 | 000,011,264 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOCALIZATION.Foundation.Implementation\2.0.2888.40802__90ba9c70f846762e\LOCALIZATION.Foundation.Implementation.dll
MOD - [2007.12.18 15:11:11 | 000,006,656 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.2888.40435__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.dll
MOD - [2007.12.18 15:11:11 | 000,005,120 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Systemtray.resources\2.0.2888.40739_de_90ba9c70f846762e\CLI.Component.Systemtray.resources.dll
MOD - [2007.12.18 15:11:10 | 000,471,040 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.2888.40479__90ba9c70f846762e\CLI.Component.Wizard.dll
MOD - [2007.12.18 15:11:10 | 000,466,944 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.2888.40739__90ba9c70f846762e\CLI.Component.Systemtray.dll
MOD - [2007.12.18 15:11:10 | 000,073,728 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.2888.40438__90ba9c70f846762e\CLI.Component.Runtime.dll
MOD - [2007.12.18 15:11:10 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.2888.40746__90ba9c70f846762e\LOG.Foundation.Implementation.dll
MOD - [2007.12.18 15:11:10 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.2858.39387__90ba9c70f846762e\CLI.Foundation.Private.dll
MOD - [2007.12.18 15:11:10 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.2858.39400__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll
MOD - [2007.12.18 15:11:10 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.2858.39398__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll
MOD - [2007.12.18 15:11:10 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.2858.39411__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll
MOD - [2007.12.18 15:11:10 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.2858.39398__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll
MOD - [2007.12.18 15:11:09 | 001,507,328 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.2888.40457__90ba9c70f846762e\CLI.Component.Dashboard.dll
MOD - [2007.12.18 15:11:09 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ATIDEMOS\2.0.2888.40439__90ba9c70f846762e\ATIDEMOS.dll
MOD - [2007.12.18 15:11:09 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.2858.39393__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll
MOD - [2007.12.18 15:11:09 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CCC.Implementation\2.0.2888.40749__90ba9c70f846762e\CCC.Implementation.dll
MOD - [2007.12.18 15:11:09 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.2858.39426__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll
MOD - [2007.12.18 15:11:08 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\APM.Server\2.0.2888.40437__90ba9c70f846762e\APM.Server.dll
MOD - [2007.12.18 15:11:08 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Server\2.0.2888.40436__90ba9c70f846762e\AEM.Server.dll
MOD - [2007.12.18 15:11:08 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll
MOD - [2007.11.29 13:02:26 | 000,159,744 | ---- | M] () -- C:\Windows\System32\atitmmxx.dll
MOD - [2007.11.06 17:57:50 | 000,024,576 | ---- | M] () -- C:\Programme\AVEO\AveoCap\AveoSTI.exe
MOD - [2007.10.31 18:26:02 | 000,053,248 | ---- | M] () -- C:\Programme\System Control Manager\MGKBHook.dll
MOD - [2007.10.12 16:16:02 | 000,032,768 | ---- | M] () -- C:\Programme\AVEO\AveoCap\hodll.dll
MOD - [2007.09.07 16:52:08 | 000,110,592 | ---- | M] () -- C:\Windows\System32\MGHwCtrl.dll
MOD - [2007.05.22 10:59:22 | 000,128,512 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
MOD - [2005.07.22 22:30:18 | 000,065,536 | ---- | M] () -- C:\Windows\System32\TosCommAPI.dll
MOD - [2004.10.14 11:18:24 | 000,040,960 | ---- | M] () -- C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtAfh.dll
MOD - [2004.07.06 16:12:00 | 000,290,816 | ---- | M] () -- C:\Programme\System Control Manager\CmSuppX.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012.07.14 16:04:01 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.07.03 18:21:29 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Programme\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2012.06.15 00:17:46 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.03.19 13:38:47 | 002,666,880 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Programme\TeamViewer\Version7\TeamViewer_Service.exe -- (TeamViewer7)
SRV - [2008.01.19 09:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008.01.19 09:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2007.10.25 15:27:54 | 000,266,240 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Live\installer\WLSetupSvc.exe -- (WLSetupSvc)
SRV - [2007.10.22 11:42:18 | 000,009,216 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)
SRV - [2007.08.23 15:37:18 | 000,061,440 | ---- | M] () [Auto | Running] -- C:\Programme\System Control Manager\edd.exe -- (NishService)
SRV - [2007.02.25 22:55:18 | 000,125,048 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service)
SRV - [2006.11.02 21:40:12 | 000,174,656 | ---- | M] () [Auto | Running] -- C:\Windows\System32\PSIService.exe -- (ProtexisLicensing)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\ulisa.sys -- (ulisa)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2012.07.03 18:21:54 | 000,054,232 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2012.07.03 18:21:53 | 000,721,000 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2012.07.03 18:21:53 | 000,353,688 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2012.07.03 18:21:53 | 000,057,656 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2012.07.03 18:21:53 | 000,035,928 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2012.07.03 18:21:53 | 000,021,256 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010.06.23 09:21:32 | 000,259,176 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2009.01.13 10:45:00 | 000,954,368 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2008.05.02 21:27:48 | 000,646,392 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2007.12.06 12:41:38 | 000,327,296 | ---- | M] (AfaTech                  ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AF15BDA.sys -- (AF15BDA)
DRV - [2007.11.29 13:13:48 | 003,351,040 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2007.10.22 11:41:58 | 001,161,888 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2007.06.11 15:25:28 | 000,041,856 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tosrfusb.sys -- (Tosrfusb)
DRV - [2007.05.24 15:27:30 | 000,064,000 | ---- | M] (TOSHIBA Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\tosrfcom.sys -- (Tosrfcom)
DRV - [2007.05.14 11:10:02 | 000,135,400 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RtHDMIV.sys -- (RTHDMIAzAudService)
DRV - [2007.04.24 14:20:06 | 000,113,920 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tosrfbd.sys -- (tosrfbd)
DRV - [2007.03.21 23:02:04 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2007.03.01 17:53:10 | 000,073,728 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Tosrfhid.sys -- (Tosrfhid)
DRV - [2007.02.24 15:42:22 | 000,039,936 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2007.01.23 17:40:20 | 000,042,496 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2007.01.22 11:43:26 | 000,053,376 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TosRfSnd.sys -- (TosRfSnd)
DRV - [2006.12.22 06:21:52 | 000,019,456 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\MGHwCtrl.sys -- (MGHwCtrl)
DRV - [2006.11.20 18:55:16 | 000,036,480 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tosrfbnp.sys -- (tosrfbnp)
DRV - [2006.11.10 15:05:00 | 000,018,688 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\afc.sys -- (Afc)
DRV - [2006.11.02 09:30:56 | 000,429,056 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvm60x32.sys -- (NVENETFD)
DRV - [2006.10.31 00:23:12 | 000,007,680 | ---- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\AtiPcie.sys -- (AtiPcie)
DRV - [2006.10.10 20:33:00 | 000,041,600 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tosporte.sys -- (tosporte)
DRV - [2006.07.31 07:44:00 | 000,580,992 | ---- | M] (Omnivision Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ov550i.sys -- (APL531)
DRV - [2005.01.07 06:42:00 | 000,018,612 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tosrfnds.sys -- (tosrfnds)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=
IE - HKCU\..\SearchScopes\{BE9654C9-9D79-42ec-B55A-3CAEB12DBF58}: "URL" = hxxp://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/firefox?client=firefox-a&rls=org.mozilla:de:official"
FF - prefs.js..extensions.enabledItems: {e001c731-5e37-4538-a5cb-8168736a2360}:0.9.9.76
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.3
FF - prefs.js..extensions.enabledItems: twitternotifier@naan.net:1.9.7.3
FF - prefs.js..extensions.enabledItems: {37fa1426-b82d-11db-8314-0800200c9a66}:2.7.5
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q="
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_265.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.4.1: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.4.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.46: C:\Program Files\VistaCodecPack\rm\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.46: C:\Program Files\VistaCodecPack\rm\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\Alwil Software\Avast5\WebRep\FF [2012.07.14 15:56:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.07.14 20:43:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.07.28 18:43:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2009.09.17 20:27:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
 
[2008.08.13 23:20:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\H****\AppData\Roaming\mozilla\Extensions
[2012.06.16 12:15:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\H****\AppData\Roaming\mozilla\Firefox\Profiles\mc529m6q.default\extensions
[2010.07.31 12:17:59 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\H****\AppData\Roaming\mozilla\Firefox\Profiles\mc529m6q.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012.06.16 12:15:51 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\H****\AppData\Roaming\mozilla\Firefox\Profiles\mc529m6q.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012.06.16 12:15:53 | 000,000,000 | ---D | M] (Bitdefender QuickScan) -- C:\Users\H****\AppData\Roaming\mozilla\Firefox\Profiles\mc529m6q.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2012.06.16 12:15:34 | 000,000,000 | ---D | M] (Echofon) -- C:\Users\Heike\AppData\Roaming\mozilla\Firefox\Profiles\mc529m6q.default\extensions\twitternotifier@naan.net
[2012.07.14 15:19:40 | 000,000,950 | ---- | M] () -- C:\Users\H****\AppData\Roaming\Mozilla\Firefox\Profiles\mc529m6q.default\searchplugins\icqplugin-1.xml
[2008.02.19 18:16:46 | 000,000,951 | ---- | M] () -- C:\Users\H****\AppData\Roaming\Mozilla\Firefox\Profiles\mc529m6q.default\searchplugins\icqplugin.xml
[2008.04.20 13:49:09 | 000,001,504 | ---- | M] () -- C:\Users\H****\AppData\Roaming\Mozilla\Firefox\Profiles\mc529m6q.default\searchplugins\imdb.xml
[2012.07.14 20:43:42 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.06.16 12:15:44 | 000,193,912 | ---- | M] () (No name found) -- C:\USERS\H****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\MC529M6Q.DEFAULT\EXTENSIONS\{37FA1426-B82D-11DB-8314-0800200C9A66}.XPI
[2012.06.15 00:19:07 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.05.27 11:53:31 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012.06.15 00:46:57 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.15 00:46:56 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.06.15 00:46:57 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.15 00:46:57 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.15 00:46:57 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.15 00:46:56 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found.
O4 - HKLM..\Run: [AuditVista]   File not found
O4 - HKLM..\Run: [avast5] C:\Programme\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [AveoSTI.exe] C:\Programme\AVEO\AveoCap\AveoSTI.exe ()
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [MGSysCtrl] C:\Programme\System Control Manager\MGSysCtrl.exe (MSI)
O4 - HKLM..\Run: [PSQLLauncher] C:\Program Files\Protector Suite QL\launcher.exe (UPEK Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Öffnen mit WordPerfect - C:\Program Files\WordPerfect Office X3\Programs\WPLauncher.hta File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0B2BEAFC-3DD1-45CE-9E53-ACFAF1C56950}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (vrlogon.dll) - C:\Windows\System32\vrlogon.dll (UPEK Inc.)
O20 - Winlogon\Notify\psfus: DllName - (C:\Windows\system32\psqlpwd.dll) - C:\Windows\System32\psqlpwd.dll (UPEK Inc.)
O24 - Desktop WallPaper: C:\Users\H****\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\H****\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{45060a27-a908-11df-af24-001d924e6e13}\Shell\AutoRun\command - "" = E:\installer.exe
O33 - MountPoints2\{a39f6b06-a8ee-11dc-888a-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{a39f6b06-a8ee-11dc-888a-806e6f6e6963}\Shell\AutoRun\command - "" = D:\setup.exe
O33 - MountPoints2\{f70e5966-187d-11dd-8a2d-001d9219065d}\Shell - "" = AutoRun
O33 - MountPoints2\{f70e5966-187d-11dd-8a2d-001d9219065d}\Shell\AutoRun\command - "" = F:\Setup.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.07.28 19:05:20 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.4
[2012.07.28 19:03:49 | 000,000,000 | ---D | C] -- C:\Program Files\OpenOffice.org 3
[2012.07.28 19:00:02 | 000,000,000 | ---D | C] -- C:\Program Files\redist
[2012.07.28 19:00:02 | 000,000,000 | ---D | C] -- C:\Program Files\readmes
[2012.07.28 19:00:02 | 000,000,000 | ---D | C] -- C:\Program Files\licenses
[2012.07.14 16:01:21 | 000,000,000 | ---D | C] -- C:\Users\H****\AppData\Roaming\Dropbox
[2012.07.14 15:52:46 | 000,000,000 | ---D | C] -- C:\Users\H****\AppData\Local\Macromedia
 
========== Files - Modified Within 30 Days ==========
 
[2012.07.28 19:20:08 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.28 19:20:03 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.28 19:16:49 | 000,356,360 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.07.28 19:16:40 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.28 19:16:16 | 2146,820,096 | -HS- | M] () -- C:\hiberfil.sys
[2012.07.28 19:13:15 | 000,000,020 | ---- | M] () -- C:\Users\H****\defogger_reenable
[2012.07.28 19:05:21 | 000,001,037 | ---- | M] () -- C:\Users\Public\Desktop\OpenOffice.org 3.4.lnk
[2012.07.28 19:03:16 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.07.27 09:27:06 | 004,503,728 | ---- | M] () -- C:\ProgramData\z7_0ytr.pad
[2012.07.14 20:43:46 | 000,000,846 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.07.14 15:56:48 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2012.07.14 15:44:25 | 000,045,056 | ---- | M] () -- C:\Users\H****\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.07.03 18:21:54 | 000,054,232 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswTdi.sys
[2012.07.03 18:21:53 | 000,721,000 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys
[2012.07.03 18:21:53 | 000,353,688 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys
[2012.07.03 18:21:53 | 000,057,656 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys
[2012.07.03 18:21:53 | 000,035,928 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswRdr.sys
[2012.07.03 18:21:53 | 000,021,256 | ---- | M] (AVAST Software) -- C:\Windows\System32\drivers\aswFsBlk.sys
[2012.07.03 18:21:32 | 000,041,224 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr
[2012.07.03 18:21:28 | 000,227,648 | ---- | M] (AVAST Software) -- C:\Windows\System32\aswBoot.exe
 
========== Files Created - No Company Name ==========
 
[2012.07.28 19:12:45 | 000,000,020 | ---- | C] () -- C:\Users\H****\defogger_reenable
[2012.07.28 19:05:21 | 000,001,037 | ---- | C] () -- C:\Users\Public\Desktop\OpenOffice.org 3.4.lnk
[2012.07.26 14:32:05 | 004,503,728 | ---- | C] () -- C:\ProgramData\z7_0ytr.pad
[2012.07.14 20:43:46 | 000,000,846 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.04.19 09:08:46 | 141,590,843 | ---- | C] () -- C:\Program Files\openofficeorg1.cab
[2012.04.19 08:59:52 | 000,473,600 | ---- | C] () -- C:\Program Files\setup.exe
[2012.04.19 08:59:50 | 000,000,290 | ---- | C] () -- C:\Program Files\setup.ini
[2012.04.19 08:59:48 | 003,125,248 | ---- | C] () -- C:\Program Files\openofficeorg34.msi
[2010.08.29 11:02:54 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2009.08.22 10:54:41 | 000,000,000 | ---- | C] () -- C:\Users\H****\.gtk-bookmarks
[2009.08.22 10:51:44 | 000,728,158 | ---- | C] () -- C:\Users\H****\.fonts.cache-1
[2008.04.19 22:27:52 | 000,045,056 | ---- | C] () -- C:\Users\H****\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
 
========== LOP Check ==========
 
[2008.04.19 15:10:18 | 000,000,000 | ---D | M] -- C:\Users\H****\AppData\Roaming\BullGuard
[2010.09.18 18:44:58 | 000,000,000 | ---D | M] -- C:\Users\H****\AppData\Roaming\Canon
[2012.07.14 16:03:12 | 000,000,000 | ---D | M] -- C:\Users\H****\AppData\Roaming\Dropbox
[2008.04.20 13:03:44 | 000,000,000 | ---D | M] -- C:\Users\H****\AppData\Roaming\ICQ Toolbar
[2010.07.31 12:13:25 | 000,000,000 | ---D | M] -- C:\Users\H****\AppData\Roaming\QuickScan
[2012.06.16 12:24:53 | 000,000,000 | ---D | M] -- C:\Users\H****\AppData\Roaming\SmartSurfer
[2012.06.16 12:25:10 | 000,000,000 | ---D | M] -- C:\Users\H****\AppData\Roaming\WEBDE
[2012.07.28 19:14:39 | 000,032,510 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >
Wäre toll, wenn mir jemand helfen kann!

Alt 28.07.2012, 21:30   #2
t'john
/// Helfer-Team
 
GVU 2.07 eingefangen - Standard

GVU 2.07 eingefangen




Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

  • Ersetze die *** Sternchen wieder in den Benutzernamen zurück!
  • Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
  • Starte die OTL.exe.
    Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
  • Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:


Code:
ATTFilter
:OTL
MOD - [2012.07.26 14:32:02 | 000,262,056 | ---- | M] () -- C:\Users\E****\AppData\Local\Temp\rty0_7z.exe 

DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\ulisa.sys -- (ulisa) 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp) 
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive) 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} 
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC 
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz= 
IE - HKCU\..\SearchScopes\{BE9654C9-9D79-42ec-B55A-3CAEB12DBF58}: "URL" = http://www.icq.com/search/results.php?q={searchTerms}&ch_id=osd 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 
FF - prefs.js..browser.search.defaultengine: "Ask.com" 
FF - prefs.js..browser.search.defaultenginename: "Ask.com" 
FF - prefs.js..browser.search.order.1: "Ask.com" 
FF - prefs.js..browser.search.selectedEngine: "Ask.com" 
FF - prefs.js..browser.search.useDBForOrder: true 
FF - prefs.js..browser.startup.homepage: "http://www.google.de/firefox?client=firefox-a&rls=org.mozilla:de:official" 
FF - prefs.js..extensions.enabledItems: {e001c731-5e37-4538-a5cb-8168736a2360}:0.9.9.76 
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.3 
FF - prefs.js..extensions.enabledItems: twitternotifier@naan.net:1.9.7.3 
FF - prefs.js..extensions.enabledItems: {37fa1426-b82d-11db-8314-0800200c9a66}:2.7.5 
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 
FF - prefs.js..keyword.URL: "http://search.icq.com/search/afe_results.php?ch_id=afex&q=" 
FF - user.js - File not found 
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found 
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) 
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found. 
O4 - HKLM..\Run: [AuditVista] File not found 
O4 - HKLM..\Run: [AveoSTI.exe] C:\Programme\AVEO\AveoCap\AveoSTI.exe () 
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 File not found 
O8 - Extra context menu item: Öffnen mit WordPerfect - C:\Program Files\WordPerfect Office X3\Programs\WPLauncher.hta File not found 
O20 - HKLM Winlogon: GinaDLL - (vrlogon.dll) - C:\Windows\System32\vrlogon.dll (UPEK Inc.) 
O32 - HKLM CDRom: AutoRun - 1 
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] 
O33 - MountPoints2\{45060a27-a908-11df-af24-001d924e6e13}\Shell\AutoRun\command - "" = E:\installer.exe 
O33 - MountPoints2\{a39f6b06-a8ee-11dc-888a-806e6f6e6963}\Shell - "" = AutoRun 
O33 - MountPoints2\{a39f6b06-a8ee-11dc-888a-806e6f6e6963}\Shell\AutoRun\command - "" = D:\setup.exe 
O33 - MountPoints2\{f70e5966-187d-11dd-8a2d-001d9219065d}\Shell - "" = AutoRun 
O33 - MountPoints2\{f70e5966-187d-11dd-8a2d-001d9219065d}\Shell\AutoRun\command - "" = F:\Setup.exe 

[2012.07.27 09:27:06 | 004,503,728 | ---- | M] () -- C:\ProgramData\z7_0ytr.pad 
 

:Files

ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]
  • Schließe alle Programme.
  • Klicke auf den Fix Button.
  • Wenn OTL einen Neustart verlangt, bitte zulassen.
  • Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
    Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!
__________________

__________________
Alt 29.07.2012, 09:44   #3
pixiebanshee
 
GVU 2.07 eingefangen - Standard

GVU 2.07 eingefangen


wow, danke für die schnelle Antwort!

hier ist die logfile von OTL

Code:
ATTFilter
All processes killed
========== OTL ==========
Service ulisa stopped successfully!
Service ulisa deleted successfully!
File System32\Drivers\ulisa.sys not found.
Service NwlnkFwd stopped successfully!
Service NwlnkFwd deleted successfully!
File system32\DRIVERS\nwlnkfwd.sys not found.
Service NwlnkFlt stopped successfully!
Service NwlnkFlt deleted successfully!
File system32\DRIVERS\nwlnkflt.sys not found.
Service IpInIp stopped successfully!
Service IpInIp deleted successfully!
File system32\DRIVERS\ipinip.sys not found.
Service blbdrive stopped successfully!
Service blbdrive deleted successfully!
File C:\Windows\system32\drivers\blbdrive.sys not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BE9654C9-9D79-42ec-B55A-3CAEB12DBF58}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BE9654C9-9D79-42ec-B55A-3CAEB12DBF58}\ not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Prefs.js: "Ask.com" removed from browser.search.defaultengine
Prefs.js: "Ask.com" removed from browser.search.defaultenginename
Prefs.js: "Ask.com" removed from browser.search.order.1
Prefs.js: "Ask.com" removed from browser.search.selectedEngine
Prefs.js: true removed from browser.search.useDBForOrder
Prefs.js: "hxxp://www.google.de/firefox?client=firefox-a&rls=org.mozilla:de:official" removed from browser.startup.homepage
Prefs.js: {e001c731-5e37-4538-a5cb-8168736a2360}:0.9.9.76 removed from extensions.enabledItems
Prefs.js: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.3 removed from extensions.enabledItems
Prefs.js: twitternotifier@naan.net:1.9.7.3 removed from extensions.enabledItems
Prefs.js: {37fa1426-b82d-11db-8314-0800200c9a66}:2.7.5 removed from extensions.enabledItems
Prefs.js: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 removed from extensions.enabledItems
Prefs.js: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=" removed from keyword.URL
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\ deleted successfully.
File move failed. C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll scheduled to be moved on reboot.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{855F3B16-6D32-4FE6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\AuditVista deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\AveoSTI.exe deleted successfully.
C:\Programme\AVEO\AveoCap\AveoSTI.exe moved successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft &Excel exportieren\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Öffnen mit WordPerfect\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\GinaDLL:vrlogon.dll deleted successfully.
C:\Windows\System32\vrlogon.dll moved successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{45060a27-a908-11df-af24-001d924e6e13}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{45060a27-a908-11df-af24-001d924e6e13}\ not found.
File E:\installer.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a39f6b06-a8ee-11dc-888a-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a39f6b06-a8ee-11dc-888a-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a39f6b06-a8ee-11dc-888a-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a39f6b06-a8ee-11dc-888a-806e6f6e6963}\ not found.
File D:\setup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f70e5966-187d-11dd-8a2d-001d9219065d}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f70e5966-187d-11dd-8a2d-001d9219065d}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f70e5966-187d-11dd-8a2d-001d9219065d}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f70e5966-187d-11dd-8a2d-001d9219065d}\ not found.
File F:\Setup.exe not found.
C:\ProgramData\z7_0ytr.pad moved successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\E****\Desktop\cmd.bat deleted successfully.
C:\Users\E****\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: E****
->Temp folder emptied: 122051074 bytes
->Temporary Internet Files folder emptied: 146974558 bytes
->Java cache emptied: 3434175 bytes
->FireFox cache emptied: 59784629 bytes
->Google Chrome cache emptied: 35127737 bytes
->Flash cache emptied: 43963 bytes
 
User: H****
->Temp folder emptied: 683115931 bytes
->Temporary Internet Files folder emptied: 38718424 bytes
->Java cache emptied: 79047 bytes
->FireFox cache emptied: 223420478 bytes
->Flash cache emptied: 7779 bytes
 
User: J****
->Temp folder emptied: 127670446 bytes
->Temporary Internet Files folder emptied: 48735182 bytes
->Java cache emptied: 703492 bytes
->FireFox cache emptied: 710915867 bytes
->Google Chrome cache emptied: 379227823 bytes
->Flash cache emptied: 73535 bytes
 
User: K****
->Temp folder emptied: 17701305 bytes
->Temporary Internet Files folder emptied: 179953 bytes
->Java cache emptied: 2601682 bytes
->FireFox cache emptied: 111392662 bytes
->Flash cache emptied: 1309 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 463090296 bytes
RecycleBin emptied: 8104450112 bytes
 
Total Files Cleaned = 10.757,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
 
User: Default User
 
User: E****
->Flash cache emptied: 0 bytes
 
User: H****
->Flash cache emptied: 0 bytes
 
User: J****
->Flash cache emptied: 0 bytes
 
User: K****
->Flash cache emptied: 0 bytes
 
User: Public
 
Total Flash Files Cleaned = 0,00 mb
 
 
OTL by OldTimer - Version 3.2.55.0 log created on 07292012_101428
Was mus ich denn jetzt noch beachten? Ist der Trojaner weg?

lg
__________________
Alt 29.07.2012, 12:16   #4
t'john
/// Helfer-Team
 
GVU 2.07 eingefangen - Standard

GVU 2.07 eingefangen


Sehr gut!

Wie laeuft der Rechner?

1. Schritt
Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".
danach:

2. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Search.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.
__________________
Mfg, t'john
Das TB unterstützen

Alt 29.07.2012, 14:43   #5
pixiebanshee
 
GVU 2.07 eingefangen - Standard

GVU 2.07 eingefangen


Der Laptop läuft schonmal besser!
Der Trojaner war jetzt nicht mehr ersichtlich und nach dem ersten Anmeden auf dem befallenen Konto nach dem 1. Mal OTL durchlaufen lassen, kam eine Fehlermeldung, das eine .exe (davor irgendwelche Buchstaben ohne erkenntlichen Sinn) nicht ausgeführt werden kann.

Ergebnisse vom erneuten OTL hier (ich konnte die Virsudefinitionen NICHT updaten, der Button war ausgegraut. Habe es allerdings erst gestern abend insalliert, hoffe also, dass es noch aktuell genug ist):
Code:
ATTFilter
Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Datenbank Version: v2012.07.28.06

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
E**** :: ****-LAPTOP [limitiert]

29.07.2012 13:20:42
mbam-log-2012-07-29 (13-20-42).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 308613
Laufzeit: 1 Stunde(n), 59 Minute(n), 31 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Setups\DAEMON Tools Setup\SetupDTSB.exe (Adware.WhenU) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
und die Ergebnisse vom AdwCleaner:
Code:
ATTFilter
# AdwCleaner v1.703 - Logfile created 07/29/2012 at 15:36:34
# Updated 20/07/2012 by Xplode
# Operating system : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# User : H**** - ****-LAPTOP
# Running from : C:\Users\E****\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

Folder Found : C:\Users\J****\AppData\LocalLow\AskToolbar
Folder Found : C:\Users\E****\AppData\LocalLow\AskToolbar
Folder Found : C:\Users\H****\AppData\LocalLow\AskToolbar
Folder Found : C:\ProgramData\Ask
File Found : C:\Users\K****\AppData\Roaming\Mozilla\Firefox\Profiles\o4v0clz9.default\searchplugins\Askcom.xml

***** [Registry] *****


***** [Registre - GUID] *****


***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Mozilla Firefox v13.0.1 (de)

Profile name : default 
File : C:\Users\J****\AppData\Roaming\Mozilla\Firefox\Profiles\asxhgjik.default\prefs.js

Found : user_pref("browser.search.defaultengine", "Ask.com");
Found : user_pref("browser.search.defaultenginename", "Ask.com");
Found : user_pref("browser.search.order.1", "Ask.com");
Found : user_pref("extensions.asktb.ff-original-keyword-url", "");

Profile name : default 
File : C:\Users\E****\AppData\Roaming\Mozilla\Firefox\Profiles\9owqejfe.default\prefs.js

Found : user_pref("browser.search.defaultengine", "Ask.com");
Found : user_pref("browser.search.defaultenginename", "Ask.com");
Found : user_pref("browser.search.order.1", "Ask.com");
Found : user_pref("extensions.asktb.ff-original-keyword-url", "");

Profile name : default 
File : C:\Users\K****\AppData\Roaming\Mozilla\Firefox\Profiles\o4v0clz9.default\prefs.js

Found : user_pref("browser.search.defaultengine", "Ask.com");
Found : user_pref("browser.search.defaultenginename", "Ask.com");
Found : user_pref("browser.search.order.1", "Ask.com");
Found : user_pref("extensions.asktb.ff-original-keyword-url", "");

Profile name : default 
File : C:\Users\H****\AppData\Roaming\Mozilla\Firefox\Profiles\mc529m6q.default\prefs.js

Found : user_pref("extensions.twitternotifier.configuration", "{\"config\":{\"short_url_length\":20,\"charac[...]

*************************

AdwCleaner[R1].txt - [2265 octets] - [29/07/2012 15:36:34]

########## EOF - \AdwCleaner[R1].txt - [2393 octets] ##########


Alt 29.07.2012, 15:03   #6
t'john
/// Helfer-Team
 
GVU 2.07 eingefangen - Standard

GVU 2.07 eingefangen


Sehr gut!


  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Delete.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.




danach:


Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html
__________________
--> GVU 2.07 eingefangen

Alt 29.07.2012, 15:47   #7
pixiebanshee
 
GVU 2.07 eingefangen - Standard

GVU 2.07 eingefangen


so, hier noch einmal logfile des AdwCleaners
Code:
ATTFilter
# AdwCleaner v1.703 - Logfile created 07/29/2012 at 16:31:20
# Updated 20/07/2012 by Xplode
# Operating system : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# User : H**** - ****-LAPTOP
# Running from : C:\Users\E****\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Folder Deleted : C:\Users\J****\AppData\LocalLow\AskToolbar
Folder Deleted : C:\Users\E****\AppData\LocalLow\AskToolbar
Folder Deleted : C:\Users\H****\AppData\LocalLow\AskToolbar
Folder Deleted : C:\ProgramData\Ask
File Deleted : C:\Users\K****\AppData\Roaming\Mozilla\Firefox\Profiles\o4v0clz9.default\searchplugins\Askcom.xml

***** [Registry] *****


***** [Registre - GUID] *****


***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Mozilla Firefox v13.0.1 (de)

Profile name : default 
File : C:\Users\J****\AppData\Roaming\Mozilla\Firefox\Profiles\asxhgjik.default\prefs.js

Deleted : user_pref("browser.search.defaultengine", "Ask.com");
Deleted : user_pref("browser.search.defaultenginename", "Ask.com");
Deleted : user_pref("browser.search.order.1", "Ask.com");
Deleted : user_pref("extensions.asktb.ff-original-keyword-url", "");

Profile name : default 
File : C:\Users\E****\AppData\Roaming\Mozilla\Firefox\Profiles\9owqejfe.default\prefs.js

Deleted : user_pref("browser.search.defaultengine", "Ask.com");
Deleted : user_pref("browser.search.defaultenginename", "Ask.com");
Deleted : user_pref("browser.search.order.1", "Ask.com");
Deleted : user_pref("extensions.asktb.ff-original-keyword-url", "");

Profile name : default 
File : C:\Users\K****\AppData\Roaming\Mozilla\Firefox\Profiles\o4v0clz9.default\prefs.js

Deleted : user_pref("browser.search.defaultengine", "Ask.com");
Deleted : user_pref("browser.search.defaultenginename", "Ask.com");
Deleted : user_pref("browser.search.order.1", "Ask.com");
Deleted : user_pref("extensions.asktb.ff-original-keyword-url", "");

Profile name : default 
File : C:\Users\H****\AppData\Roaming\Mozilla\Firefox\Profiles\mc529m6q.default\prefs.js

Deleted : user_pref("extensions.twitternotifier.configuration", "{\"config\":{\"short_url_length\":20,\"charac[...]

*************************

AdwCleaner[S1].txt - [2301 octets] - [29/07/2012 16:31:20]
AdwCleaner[R1].txt - [2392 octets] - [29/07/2012 15:36:34]

########## EOF - \AdwCleaner[S1].txt - [2489 octets] ##########
Emisoft Anti-Malware wurde anscheinend schon einmal von jemandem auf dem Laptop benutzt und geht somit ohne License Key nicht mehr. Gibt's ein anderes Programm dafür?

Alt 29.07.2012, 18:32   #8
t'john
/// Helfer-Team
 
GVU 2.07 eingefangen - Standard

GVU 2.07 eingefangen


Versuche den kosenlosen Scan.
__________________
Mfg, t'john
Das TB unterstützen

Alt 29.07.2012, 18:37   #9
pixiebanshee
 
GVU 2.07 eingefangen - Standard

GVU 2.07 eingefangen


okay, Fehler entdeckt. Habe auf 'weiter' geklickt anstatt auf 'Freeware Modus'. Sorry. Poste das Ergebnis gleich.

Alt 29.07.2012, 19:01   #10
t'john
/// Helfer-Team
 
GVU 2.07 eingefangen - Standard

GVU 2.07 eingefangen


Alles klar
__________________
Mfg, t'john
Das TB unterstützen

Alt 29.07.2012, 21:17   #11
pixiebanshee
 
GVU 2.07 eingefangen - Standard

GVU 2.07 eingefangen


so, und hier nun auch die Ergebnisse von Emisoft Anti-Malware
Code:
ATTFilter
Emsisoft Anti-Malware - Version 6.6
Letztes Update: 29.07.2012 19:42:58

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\
Archiv Scan: An
ADS Scan: An

Scan Beginn:	29.07.2012 19:43:29

c:\program files\aveo 	gefunden: Trace.File.helpexpress!E1
Value: hkey_current_user\software\xttb00001\toolbar --> alertmsg 	gefunden: Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> autocomplete 	gefunden: Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> closeallwindowsforupdate 	gefunden: Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> connectionerror 	gefunden: Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> contextmenuitemname 	gefunden: Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> autosearch 	gefunden: Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> corruptedmsg 	gefunden: Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> descriptivetext 	gefunden: Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> contextsearch 	gefunden: Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> firsttime 	gefunden: Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> firsturl 	gefunden: Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> errormsg 	gefunden: Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> lastversionmsg 	gefunden: Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> opennew 	gefunden: Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> popstop 	gefunden: Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> runsearchautomatically 	gefunden: Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> autowild 	gefunden: Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> keephistory 	gefunden: Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> showfindbuttons 	gefunden: Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> runsearchdragautomatically 	gefunden: Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> serverpath 	gefunden: Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> toolbar_version 	gefunden: Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> uninstallmsg 	gefunden: Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> tbshow 	gefunden: Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> updatemsg 	gefunden: Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> showhighlightbutton 	gefunden: Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> urlafteruninstall 	gefunden: Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> urlafterupdate 	gefunden: Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> versionerror 	gefunden: Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> updateautomatically 	gefunden: Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> autoupdatemsg 	gefunden: Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> updateurl 	gefunden: Trace.Registry.eqiso toolbar!E1
Key: hkey_local_machine\software\aveo 	gefunden: Trace.Registry.suspicious!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\divx codec --> displayname 	gefunden: Trace.Registry.divx 5.0.3 pro bundle!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\divx codec --> uninstallstring 	gefunden: Trace.Registry.divx 5.0.3 pro bundle!E1
C:\Setups\DAEMON Tools Setup\daemon406-x86.exe 	gefunden: Riskware.WebToolbar.Win32.WhenU.AMN!E1

Gescannt	656835
Gefunden	37

Scan Ende:	29.07.2012 22:01:11
Scan Zeit:	2:17:42

C:\Setups\DAEMON Tools Setup\daemon406-x86.exe	Quarantäne Riskware.WebToolbar.Win32.WhenU.AMN!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\divx codec --> displayname	Quarantäne Trace.Registry.divx 5.0.3 pro bundle!E1
Value: hkey_local_machine\software\microsoft\windows\currentversion\uninstall\divx codec --> uninstallstring	Quarantäne Trace.Registry.divx 5.0.3 pro bundle!E1
Key: hkey_local_machine\software\aveo	Quarantäne Trace.Registry.suspicious!E1
Value: hkey_current_user\software\xttb00001\toolbar --> alertmsg	Quarantäne Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> autocomplete	Quarantäne Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> closeallwindowsforupdate	Quarantäne Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> connectionerror	Quarantäne Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> contextmenuitemname	Quarantäne Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> autosearch	Quarantäne Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> corruptedmsg	Quarantäne Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> descriptivetext	Quarantäne Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> contextsearch	Quarantäne Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> firsttime	Quarantäne Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> firsturl	Quarantäne Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> errormsg	Quarantäne Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> lastversionmsg	Quarantäne Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> opennew	Quarantäne Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> popstop	Quarantäne Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> runsearchautomatically	Quarantäne Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> autowild	Quarantäne Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> keephistory	Quarantäne Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> showfindbuttons	Quarantäne Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> runsearchdragautomatically	Quarantäne Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> serverpath	Quarantäne Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> toolbar_version	Quarantäne Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> uninstallmsg	Quarantäne Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> tbshow	Quarantäne Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> updatemsg	Quarantäne Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> showhighlightbutton	Quarantäne Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> urlafteruninstall	Quarantäne Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> urlafterupdate	Quarantäne Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> versionerror	Quarantäne Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> updateautomatically	Quarantäne Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> autoupdatemsg	Quarantäne Trace.Registry.eqiso toolbar!E1
Value: hkey_current_user\software\xttb00001\toolbar --> updateurl	Quarantäne Trace.Registry.eqiso toolbar!E1
c:\program files\aveo	Quarantäne Trace.File.helpexpress!E1

Quarantäne	37

Alt 29.07.2012, 21:17   #12
t'john
/// Helfer-Team
 
GVU 2.07 eingefangen - Standard

GVU 2.07 eingefangen


Sehr gut!


Deinstalliere:
Emsisoft Anti-Malware


ESET Online Scanner

Vorbereitung

  • Schließe evtl. vorhandene externe Festplatten und/oder sonstigen Wechselmedien (z. B. evtl. vorhandene USB-Sticks) an den Rechner an.
  • Bitte während des Online-Scans Anti-Virus-Programm und Firewall deaktivieren.
  • Vista/Win7-User: Bitte den Browser unbedingt als Administrator starten.
Los geht's

  • Lade und starte Eset Smartinstaller
  • Haken setzen bei YES, I accept the Terms of Use.
  • Klick auf Start.
  • Haken setzen bei Remove found threads und Scan archives.
  • Klick auf Start.
  • Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Finish drücken.
  • Browser schließen.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (manchmal auch C:\Programme\Eset\log.txt) suchen und mit Deinem Editor öffnen.
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset
__________________
Mfg, t'john
Das TB unterstützen

Alt 30.07.2012, 18:20   #13
pixiebanshee
 
GVU 2.07 eingefangen - Standard

GVU 2.07 eingefangen


Jetzt auch endlich das logfile von ESET

Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=f5b9e6ce5facef47bc8c7aea61bf885f
# end=stopped
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-07-29 09:50:11
# local_time=2012-07-29 11:50:11 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=768 16777215 100 0 63021776 63021776 0 0
# compatibility_mode=5892 16776573 100 100 44377 181126348 0 0
# compatibility_mode=8192 67108863 100 0 189 189 0 0
# scanned=52558
# found=0
# cleaned=0
# scan_time=4992
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=53251
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=f5b9e6ce5facef47bc8c7aea61bf885f
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-07-30 11:27:14
# local_time=2012-07-30 01:27:14 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=768 16777215 100 0 63059203 63059203 0 0
# compatibility_mode=5892 16776573 100 100 81804 181163775 0 0
# compatibility_mode=8192 67108863 100 0 37616 37616 0 0
# scanned=161255
# found=0
# cleaned=0
# scan_time=16587

Alt 30.07.2012, 18:27   #14
t'john
/// Helfer-Team
 
GVU 2.07 eingefangen - Standard

GVU 2.07 eingefangen


Java aktualisieren

Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
  • Downloade dir bitte die neueste Java-Version von hier
  • Speichere die jxpiinstall.exe
  • Schließe alle laufenden Programme. Speziell deinen Browser.
  • Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 5 ) herunter laden.
  • Wenn die Installation beendet wurde
    Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
  • Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.
Nach dem Neustart
  • Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
  • Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
  • Klicke auf Dateien löschen....
  • Gehe sicher das überall ein Hacken gesetzt ist und klicke OK.
  • Klicke erneut OK.


Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html
__________________
Mfg, t'john
Das TB unterstützen

Alt 30.07.2012, 18:32   #15
pixiebanshee
 
GVU 2.07 eingefangen - Standard

GVU 2.07 eingefangen


ok, wird gemacht.

Ist der Laptop denn jetzt sauber?

Antwort
Seite 1 von 2 1 2

Themen zu GVU 2.07 eingefangen
administrator, adobe, antivirus, autorun, avast, bonjour, ctfmon.lnk, defender, excel, explorer, fehlermeldung, firefox, flash player, format, home, infizierte, logfile, mozilla, nvidia, pdf, plug-in, realtek, registry, rty0_7z.exe, searchscopes, software, temp, trojaner, vista, vista 32bit


« Fund TR/Malob.HG.3 und immer wieder Suspicious.MH690 | GVU-Trojaner und mehr? ... XP Home »


Ähnliche Themen: GVU 2.07 eingefangen


  1. Was hab ich mir da eingefangen?
    Plagegeister aller Art und deren Bekämpfung - 08.07.2013 (3)
  2. GVU eingefangen
    Plagegeister aller Art und deren Bekämpfung - 05.09.2012 (44)
  3. GVU 2.07 eingefangen
    Plagegeister aller Art und deren Bekämpfung - 20.08.2012 (16)
  4. Hab ich mir da was eingefangen?
    Log-Analyse und Auswertung - 07.03.2011 (26)
  5. Was hab ich mir da eingefangen?
    Mülltonne - 07.02.2009 (0)
  6. hab ich mir was eingefangen?
    Log-Analyse und Auswertung - 23.11.2008 (5)
  7. Hab ich mir was eingefangen?
    Mülltonne - 13.11.2008 (0)
  8. Hab mir was eingefangen!!!
    Mülltonne - 21.08.2008 (0)
  9. Hab mir was eingefangen...
    Plagegeister aller Art und deren Bekämpfung - 25.07.2008 (16)
  10. Hab ich mir was eingefangen?
    Log-Analyse und Auswertung - 20.07.2008 (6)
  11. Hab ich mir was eingefangen ??
    Log-Analyse und Auswertung - 28.12.2007 (0)
  12. Ich hab mir was eingefangen!?
    Log-Analyse und Auswertung - 26.01.2006 (1)
  13. Hab mir was eingefangen!!!
    Log-Analyse und Auswertung - 29.12.2005 (3)
  14. Was eingefangen??
    Log-Analyse und Auswertung - 16.09.2005 (6)
  15. Hab ich mir was eingefangen?
    Log-Analyse und Auswertung - 16.08.2005 (3)
  16. chj/cws eingefangen...
    Log-Analyse und Auswertung - 10.02.2005 (11)
  17. Hab mir was eingefangen...
    Log-Analyse und Auswertung - 08.09.2004 (5)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema GVU 2.07 eingefangen - Hallo! Hallo meine Eltern haben sich auch ihrem Laptop mit OS Vista 32bit Home Premium den GVU 2.07 Trojaner eingefangen. Der Laptop hat 4 Benutzerkonten, 2 davon Administrator und 2 - GVU 2.07 eingefangen...
Archiv
Du betrachtest: GVU 2.07 eingefangen auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129