| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Verschlüsselungstrojaner vorhandenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
04.08.2012, 12:53
| #1 | ||
| |  Verschlüsselungstrojaner vorhanden Hi, Seit gestern hat sich der Ach so beliebte Verschlüsselungstrojaner auf den Laptop meiner frau eingenistet. Allerdings tritt der nur bei ihmre Profil auf. Ich habe über den abgesicherten Modus ein 2. Administratorprofil eröffnet und von dort aus sämtliche Scans durchlaufen lassen. Hier die logs: OTL OTL Logfile: Code:
ATTFilter OTL logfile created on: 04.08.2012 11:43:09 - Run 1 OTL by OldTimer - Version 3.2.43.0 Folder = C:\Users\Timeforce\Downloads Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,97 Gb Total Physical Memory | 1,02 Gb Available Physical Memory | 52,05% Memory free 4,16 Gb Paging File | 2,99 Gb Available in Paging File | 71,91% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 99,61 Gb Total Space | 49,83 Gb Free Space | 50,03% Space Free | Partition Type: NTFS Drive D: | 100,00 Mb Total Space | 53,07 Mb Free Space | 53,07% Space Free | Partition Type: NTFS Drive E: | 133,18 Gb Total Space | 114,74 Gb Free Space | 86,15% Space Free | Partition Type: NTFS Computer Name: SIMONE-PC | User Name: Timeforce | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.08.04 11:37:00 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Users\Timeforce\Downloads\OTL.exe PRC - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2012.07.03 13:46:44 | 000,462,920 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2012.05.25 17:13:56 | 000,151,912 | ---- | M] (McAfee, Inc.) -- C:\Windows\System32\mfevtps.exe PRC - [2012.03.28 01:14:06 | 000,138,232 | R--- | M] (Symantec Corporation) -- C:\Programme\Norton Internet Security\Engine\19.7.1.5\ccsvchst.exe PRC - [2012.03.22 20:06:35 | 003,054,136 | ---- | M] (ASUS) -- C:\Windows\AsScrPro.exe PRC - [2012.01.12 15:52:57 | 000,296,232 | ---- | M] (CyberLink) -- E:\Program Files (x86)\Cyberlink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe PRC - [2012.01.12 15:52:55 | 000,087,336 | ---- | M] (CyberLink Corp.) -- E:\Program Files (x86)\Cyberlink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe PRC - [2012.01.12 15:52:55 | 000,075,048 | ---- | M] (CyberLink) -- E:\Program Files (x86)\Cyberlink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2009.04.11 08:28:03 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2009.04.11 08:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe PRC - [2009.04.11 08:27:20 | 000,088,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\audiodg.exe PRC - [2009.03.23 08:52:14 | 017,149,952 | R--- | M] (VIA) -- C:\Programme\VIA\VIAudioi\VDeck\VDECK.EXE PRC - [2009.03.20 21:37:18 | 000,174,648 | ---- | M] (ASUS) -- C:\Programme\ASUS\ATK Hotkey\HControl.exe PRC - [2009.03.18 16:54:58 | 000,154,168 | ---- | M] (ASUS) -- C:\Programme\ASUS\ASUS CopyProtect\ASPG.exe PRC - [2009.03.06 13:44:50 | 000,424,352 | ---- | M] (ELAN Microelectronic Corp.) -- C:\Programme\Elantech\ETDCtrl.exe PRC - [2009.03.04 11:26:24 | 008,392,704 | ---- | M] (ASUS) -- C:\Programme\ASUS\ATKOSD2\ATKOSD2.exe PRC - [2009.02.06 17:13:16 | 001,593,344 | ---- | M] () -- C:\Programme\ASUS\Wireless Console 3\wcourier.exe PRC - [2008.12.29 11:21:02 | 000,159,744 | ---- | M] (ASUS) -- C:\Programme\ASUS\ATK Media\DMedia.exe PRC - [2008.12.22 18:15:34 | 000,174,648 | ---- | M] (ASUS) -- C:\Programme\ASUS\ATK Hotkey\WDC.exe PRC - [2008.12.09 16:00:58 | 000,297,528 | ---- | M] (ASUS) -- C:\Programme\ASUS\SmartLogon\sensorsrv.exe PRC - [2008.11.26 20:54:00 | 000,211,512 | ---- | M] (ATK) -- C:\Programme\P4G\BatteryLife.exe PRC - [2008.10.01 00:02:48 | 000,851,968 | ---- | M] (ATK) -- C:\Programme\ASUS\Splendid\ACMON.exe PRC - [2008.08.18 12:27:32 | 000,117,304 | ---- | M] (ASUS) -- C:\Programme\ASUS\ATK Hotkey\MsgTranAgt.exe PRC - [2008.08.18 11:56:22 | 000,098,304 | ---- | M] (ASUS) -- C:\Programme\ASUS\ATK Hotkey\HControlUser.exe PRC - [2008.08.13 22:00:08 | 000,113,208 | ---- | M] (ASUS) -- C:\Programme\ASUS\ATK Hotkey\KBFiltr.exe PRC - [2008.08.13 21:59:52 | 000,100,920 | ---- | M] () -- C:\Programme\ASUS\ATK Hotkey\AsLdrSrv.exe PRC - [2008.08.13 17:21:56 | 002,482,176 | ---- | M] (ASUS) -- C:\Programme\ASUS\ATK Hotkey\ATKOSD.exe PRC - [2008.04.01 00:09:30 | 000,266,240 | ---- | M] (ASUSTek Computer Inc.) -- C:\Programme\ASUS\ASUS Data Security Manager\ADSMTray.exe PRC - [2008.03.31 03:55:48 | 000,225,280 | ---- | M] (ASUSTek Computer Inc.) -- C:\Programme\ASUS\ASUS Data Security Manager\ADSMSrv.exe PRC - [2007.11.30 12:20:44 | 000,051,768 | ---- | M] () -- C:\Programme\ASUS\ASUS Live Update\ALU.exe PRC - [2007.08.08 01:08:40 | 000,094,208 | ---- | M] () -- C:\Programme\ATKGFNEX\GFNEXSrv.exe PRC - [2007.08.03 13:24:54 | 000,125,496 | ---- | M] () -- C:\Programme\ASUS\NB Probe\SPM\spmgr.exe PRC - [2006.11.02 14:35:35 | 000,176,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wpcumi.exe PRC - [2005.07.06 16:43:42 | 000,155,648 | ---- | M] (ASUSTeK) -- C:\Windows\System32\ACEngSvr.exe ========== Modules (No Company Name) ========== MOD - [2009.01.06 11:11:44 | 000,090,112 | R--- | M] () -- C:\Programme\VIA\VIAudioi\VDeck\DTS2APOAPI.DLL MOD - [2008.10.30 16:37:04 | 000,015,360 | ---- | M] () -- C:\Programme\P4G\OvrClk.dll MOD - [2008.08.20 16:49:56 | 000,016,384 | ---- | M] () -- C:\Programme\P4G\DevMng.dll MOD - [2008.03.17 11:50:00 | 000,069,632 | R--- | M] () -- C:\Programme\VIA\VIAudioi\VDeck\QSAPOAPI.DLL MOD - [2008.02.14 07:57:00 | 000,094,208 | R--- | M] () -- C:\Programme\VIA\VIAudioi\VDeck\VMICAPI.DLL MOD - [2007.11.30 12:20:44 | 000,051,768 | ---- | M] () -- C:\Programme\ASUS\ASUS Live Update\ALU.exe MOD - [2007.11.12 16:41:50 | 000,106,496 | ---- | M] () -- C:\Programme\ASUS\ATK Hotkey\MsgTran.dll MOD - [2007.06.15 11:28:36 | 000,147,456 | ---- | M] () -- C:\Programme\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt.dll MOD - [2007.06.01 18:08:18 | 000,143,360 | ---- | M] () -- C:\Programme\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll MOD - [2007.03.09 17:16:52 | 000,106,496 | ---- | M] () -- C:\Programme\ATKGFNEX\AGFNEX.dll ========== Win32 Services (SafeList) ========== SRV - [2012.08.02 18:58:29 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.07.21 11:24:17 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2012.05.25 17:13:56 | 000,151,912 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Windows\System32\mfevtps.exe -- (mfevtp) SRV - [2012.04.22 13:51:04 | 000,720,936 | ---- | M] (Nokia) [On_Demand | Stopped] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) SRV - [2012.03.28 01:14:06 | 000,138,232 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Norton Internet Security\Engine\19.7.1.5\ccSvcHst.exe -- (NIS) SRV - [2012.01.12 15:52:57 | 000,296,232 | ---- | M] (CyberLink) [Auto | Running] -- E:\Program Files (x86)\Cyberlink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe -- (CyberLink PowerDVD 12 Media Server Service) SRV - [2012.01.12 15:52:55 | 000,087,336 | ---- | M] (CyberLink Corp.) [Auto | Running] -- E:\Program Files (x86)\Cyberlink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe -- (CLHNServiceForPowerDVD12) SRV - [2012.01.12 15:52:55 | 000,075,048 | ---- | M] (CyberLink) [Auto | Running] -- E:\Program Files (x86)\Cyberlink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe -- (CyberLink PowerDVD 12 Media Server Monitor Service) SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2008.08.13 21:59:52 | 000,100,920 | ---- | M] () [Auto | Running] -- C:\Programme\ASUS\ATK Hotkey\AsLdrSrv.exe -- (ASLDRService) SRV - [2008.03.31 03:55:48 | 000,225,280 | ---- | M] (ASUSTek Computer Inc.) [Auto | Running] -- C:\Programme\ASUS\ASUS Data Security Manager\ADSMSrv.exe -- (ADSMService) SRV - [2008.01.19 09:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2008.01.19 09:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) SRV - [2007.08.08 01:08:40 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Programme\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv) SRV - [2007.08.03 13:24:54 | 000,125,496 | ---- | M] () [Auto | Running] -- C:\Programme\ASUS\NB Probe\SPM\spmgr.exe -- (spmgr) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) DRV - File not found [Kernel | On_Demand | Stopped] -- System32\DRIVERS\ipswuio.sys -- (ipswuio) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp) DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive) DRV - [2012.08.04 11:31:52 | 000,054,016 | ---- | M] () [Kernel | Boot | Unknown] -- C:\Windows\System32\drivers\uolrhsf.sys -- (eqnsvfug) DRV - [2012.07.03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector) DRV - [2012.04.28 02:18:22 | 000,368,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\Definitions\IPSDefs\20120505.001\IDSvix86.sys -- (IDSVix86) DRV - [2012.04.22 13:51:38 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd) DRV - [2012.04.05 12:13:27 | 000,374,392 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Programme\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl) DRV - [2012.04.05 12:13:27 | 000,106,104 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Programme\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv) DRV - [2012.04.05 12:09:15 | 000,141,944 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SYMEVENT.SYS -- (SymEvent) DRV - [2012.04.03 01:38:08 | 000,821,880 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\Definitions\BASHDefs\20120413.001\BHDrvx86.sys -- (BHDrvx86) DRV - [2012.03.29 08:28:37 | 000,345,208 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\NIS\1307010.005\symtdiv.sys -- (SYMTDIv) DRV - [2012.03.29 08:28:30 | 000,905,336 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\System32\drivers\NIS\1307010.005\symefa.sys -- (SymEFA) DRV - [2012.03.29 08:06:25 | 000,149,624 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\NIS\1307010.005\ironx86.sys -- (SymIRON) DRV - [2012.03.29 08:03:27 | 000,574,072 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\NIS\1307010.005\srtsp.sys -- (SRTSP) DRV - [2012.03.29 08:03:27 | 000,032,888 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\NIS\1307010.005\srtspx.sys -- (SRTSPX) Symantec Real Time Storage Protection (PEL) DRV - [2012.03.22 20:01:49 | 000,030,264 | ---- | M] (ASUSTek Computer Inc) [File_System | Boot | Running] -- C:\Windows\System32\drivers\AsDsm.sys -- (AsDsm) DRV - [2012.02.22 13:29:46 | 000,464,304 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\mfehidk.sys -- (mfehidk) DRV - [2012.02.22 13:29:46 | 000,121,544 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mfeapfk.sys -- (mfeapfk) DRV - [2012.01.11 22:57:42 | 000,087,536 | ---- | M] (CyberLink Corp.) [2012/04/09 21:40:11] [Kernel | Auto | Running] -- E:\Program Files (x86)\Cyberlink\PowerDVD12\Common\NavFilter\000.fcl -- ({329F96B6-DF1E-4328-BFDA-39EA953C1312}) DRV - [2012.01.09 17:28:20 | 000,023,168 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc) DRV - [2012.01.09 17:28:20 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd) DRV - [2012.01.09 17:28:20 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt) DRV - [2012.01.09 17:28:20 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev) DRV - [2011.12.03 03:00:00 | 001,576,312 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\Definitions\VirusDefs\20120504.033\NAVEX15.SYS -- (NAVEX15) DRV - [2011.12.03 03:00:00 | 000,086,136 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\Definitions\VirusDefs\20120504.033\NAVENG.SYS -- (NAVENG) DRV - [2011.11.30 00:44:14 | 000,132,744 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\NIS\1307010.005\ccsetx86.sys -- (ccSet_NIS) DRV - [2011.10.27 08:18:45 | 000,120,432 | ---- | M] (Cyberlink Corp.) [Kernel | Auto | Running] -- E:\Program Files (x86)\Cyberlink\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12.sys -- (ntk_PowerDVD12) DRV - [2011.08.16 00:51:40 | 000,340,088 | R--- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\NIS\1307010.005\symds.sys -- (SymDS) DRV - [2009.09.05 15:25:36 | 001,183,744 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr) DRV - [2009.08.05 07:18:22 | 000,048,640 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L1E60x86.sys -- (L1E) DRV - [2009.03.20 08:21:38 | 000,984,064 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\viahduaa.sys -- (VIAHdAudAddService) DRV - [2009.01.14 13:51:50 | 000,230,952 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SRS_PremiumSound_i386.sys -- (SRS_PremiumSound_Service) DRV - [2008.12.24 10:39:44 | 000,014,392 | ---- | M] (ATK0100) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ATKACPI.sys -- (MTsensor) DRV - [2008.11.03 09:03:28 | 000,013,880 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\kbfiltr.sys -- (kbfiltr) DRV - [2008.08.11 04:14:12 | 001,752,704 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC) DRV - [2008.05.29 10:21:04 | 000,015,416 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [File_System | Boot | Running] -- C:\Windows\System32\drivers\lullaby.sys -- (lullaby) DRV - [2008.05.23 18:25:42 | 000,131,000 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\WimFltr.sys -- (WimFltr) DRV - [2007.08.03 06:26:22 | 000,020,936 | ---- | M] () [Kernel | Auto | Running] -- C:\Programme\ASUS\NB Probe\SPM\ghaio.sys -- (ghaio) DRV - [2007.07.24 12:09:04 | 000,013,880 | ---- | M] () [Kernel | Auto | Running] -- C:\Programme\ATKGFNEX\ASMMAP.sys -- (ASMMAP) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_270.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nokia.com/EnablerPlugin: C:\Program Files\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( ) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: e:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\IPSFFPlgn\ [2012.04.05 12:09:46 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\coFFPlgn\ [2012.08.04 10:09:40 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.07.21 11:24:18 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.08.03 19:05:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Timeforce\AppData\Roaming\mozilla\Extensions [2012.04.24 21:19:55 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2012.07.21 11:24:18 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2012.06.16 22:17:57 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.06.16 22:17:57 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.06.16 22:17:57 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.06.16 22:17:57 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.06.16 22:17:57 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.06.16 22:17:57 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Programme\Norton Internet Security\Engine\19.7.1.5\coieplg.dll (Symantec Corporation) O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Programme\Norton Internet Security\Engine\19.7.1.5\ips\ipsbho.dll (Symantec Corporation) O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Programme\Norton Internet Security\Engine\19.7.1.5\coieplg.dll (Symantec Corporation) O4 - HKLM..\Run: [ACMON] C:\Programme\ASUS\Splendid\ACMON.exe (ATK) O4 - HKLM..\Run: [ADSMTray] C:\Programme\ASUS\ASUS Data Security Manager\ADSMTray.exe (ASUSTek Computer Inc.) O4 - HKLM..\Run: [ASUS Camera ScreenSaver] C:\Windows\AsScrProlog.exe () O4 - HKLM..\Run: [ASUS Screen Saver Protector] C:\Windows\AsScrPro.exe (ASUS) O4 - HKLM..\Run: [ATKMEDIA] C:\Programme\ASUS\ATK Media\DMedia.exe (ASUS) O4 - HKLM..\Run: [ATKOSD2] C:\Programme\ASUS\ATKOSD2\ATKOSD2.exe (ASUS) O4 - HKLM..\Run: [ETDWare] C:\Programme\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.) O4 - HKLM..\Run: [HControlUser] C:\Programme\ASUS\ATK Hotkey\HControlUser.exe (ASUS) O4 - HKLM..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe (VIA) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [MSConfig] C:\Windows\System32\msconfig.exe (Microsoft Corporation) O4 - HKLM..\Run: [WPCUMI] C:\Windows\System32\wpcumi.exe (Microsoft Corporation) O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1 O9 - Extra Button: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - e:\Program Files\ICQ7.7\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - e:\Program Files\ICQ7.7\ICQ.exe (ICQ, LLC.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000031 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{20C7BF59-B5A0-4244-ACD2-DE0100797360}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E0F3D964-BC1E-4B00-B1DE-DA3D09B5555F}: DhcpNameServer = 192.168.1.1 O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk /r \??\C:) O34 - HKLM BootExecute: (autocheck autochk /r \??\E:) O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2012.08.03 19:23:11 | 000,151,912 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\mfevtps.exe [2012.08.03 19:23:05 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee [2012.08.03 19:10:22 | 000,000,000 | ---D | C] -- C:\Users\Timeforce\AppData\Roaming\Malwarebytes [2012.08.03 19:07:09 | 000,000,000 | ---D | C] -- C:\Users\Timeforce\AppData\Local\Macromedia [2012.08.03 19:07:09 | 000,000,000 | ---D | C] -- C:\Users\Timeforce\AppData\Roaming\Adobe [2012.08.03 19:05:36 | 000,000,000 | ---D | C] -- C:\Users\Timeforce\AppData\Roaming\Mozilla [2012.08.03 19:05:36 | 000,000,000 | ---D | C] -- C:\Users\Timeforce\AppData\Local\Mozilla [2012.08.03 19:04:47 | 000,000,000 | ---D | C] -- C:\Users\Timeforce\AppData\Roaming\Macromedia [2012.08.03 19:03:57 | 000,000,000 | R--D | C] -- C:\Users\Timeforce\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup [2012.08.03 19:03:57 | 000,000,000 | R--D | C] -- C:\Users\Timeforce\Searches [2012.08.03 19:03:57 | 000,000,000 | R--D | C] -- C:\Users\Timeforce\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools [2012.08.03 19:03:48 | 000,000,000 | ---D | C] -- C:\Users\Timeforce\AppData\Roaming\Identities [2012.08.03 19:03:47 | 000,000,000 | R--D | C] -- C:\Users\Timeforce\Contacts [2012.08.03 19:03:15 | 000,000,000 | ---D | C] -- C:\Users\Timeforce\AppData\Local\VirtualStore [2012.08.03 19:02:41 | 000,000,000 | -HSD | C] -- C:\Users\Timeforce\Vorlagen [2012.08.03 19:02:41 | 000,000,000 | -HSD | C] -- C:\Users\Timeforce\AppData\Local\Verlauf [2012.08.03 19:02:41 | 000,000,000 | -HSD | C] -- C:\Users\Timeforce\AppData\Local\Temporary Internet Files [2012.08.03 19:02:41 | 000,000,000 | -HSD | C] -- C:\Users\Timeforce\Startmenü [2012.08.03 19:02:41 | 000,000,000 | -HSD | C] -- C:\Users\Timeforce\SendTo [2012.08.03 19:02:41 | 000,000,000 | -HSD | C] -- C:\Users\Timeforce\Recent [2012.08.03 19:02:41 | 000,000,000 | -HSD | C] -- C:\Users\Timeforce\Netzwerkumgebung [2012.08.03 19:02:41 | 000,000,000 | -HSD | C] -- C:\Users\Timeforce\Lokale Einstellungen [2012.08.03 19:02:41 | 000,000,000 | -HSD | C] -- C:\Users\Timeforce\Documents\Eigene Videos [2012.08.03 19:02:41 | 000,000,000 | -HSD | C] -- C:\Users\Timeforce\Documents\Eigene Musik [2012.08.03 19:02:41 | 000,000,000 | -HSD | C] -- C:\Users\Timeforce\Documents\Eigene Bilder [2012.08.03 19:02:41 | 000,000,000 | -HSD | C] -- C:\Users\Timeforce\Druckumgebung [2012.08.03 19:02:41 | 000,000,000 | -HSD | C] -- C:\Users\Timeforce\Cookies [2012.08.03 19:02:41 | 000,000,000 | -HSD | C] -- C:\Users\Timeforce\AppData\Local\Anwendungsdaten [2012.08.03 19:02:41 | 000,000,000 | -HSD | C] -- C:\Users\Timeforce\Anwendungsdaten [2012.08.03 19:02:40 | 000,000,000 | --SD | C] -- C:\Users\Timeforce\AppData\Roaming\Microsoft [2012.08.03 19:02:40 | 000,000,000 | R--D | C] -- C:\Users\Timeforce\Videos [2012.08.03 19:02:40 | 000,000,000 | R--D | C] -- C:\Users\Timeforce\Saved Games [2012.08.03 19:02:40 | 000,000,000 | R--D | C] -- C:\Users\Timeforce\Pictures [2012.08.03 19:02:40 | 000,000,000 | R--D | C] -- C:\Users\Timeforce\Music [2012.08.03 19:02:40 | 000,000,000 | R--D | C] -- C:\Users\Timeforce\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance [2012.08.03 19:02:40 | 000,000,000 | R--D | C] -- C:\Users\Timeforce\Links [2012.08.03 19:02:40 | 000,000,000 | R--D | C] -- C:\Users\Timeforce\Favorites [2012.08.03 19:02:40 | 000,000,000 | R--D | C] -- C:\Users\Timeforce\Downloads [2012.08.03 19:02:40 | 000,000,000 | R--D | C] -- C:\Users\Timeforce\Documents [2012.08.03 19:02:40 | 000,000,000 | R--D | C] -- C:\Users\Timeforce\Desktop [2012.08.03 19:02:40 | 000,000,000 | R--D | C] -- C:\Users\Timeforce\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories [2012.08.03 19:02:40 | 000,000,000 | -HSD | C] -- C:\Users\Timeforce\Eigene Dateien [2012.08.03 19:02:40 | 000,000,000 | -H-D | C] -- C:\Users\Timeforce\AppData [2012.08.03 19:02:40 | 000,000,000 | ---D | C] -- C:\Users\Timeforce\AppData\Local\Temp [2012.08.03 19:02:40 | 000,000,000 | ---D | C] -- C:\Users\Timeforce\AppData\Local\Microsoft [2012.08.03 19:02:40 | 000,000,000 | ---D | C] -- C:\Users\Timeforce\AppData\Roaming\Media Center Programs ========== Files - Modified Within 30 Days ========== [2012.08.04 11:36:17 | 000,000,000 | ---- | M] () -- C:\Users\Timeforce\defogger_reenable [2012.08.04 11:31:52 | 000,054,016 | ---- | M] () -- C:\Windows\System32\drivers\uolrhsf.sys [2012.08.04 10:58:15 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.08.04 10:16:20 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.08.04 10:16:20 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.08.04 10:16:20 | 000,126,260 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.08.04 10:16:20 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.08.04 10:12:16 | 000,044,544 | ---- | M] (Absolute Software Corp.) -- C:\Windows\System32\agremove.exe [2012.08.04 10:09:01 | 000,005,328 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2012.08.04 10:09:00 | 000,005,328 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2012.08.04 10:08:54 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.08.04 10:08:51 | 2110,873,600 | -HS- | M] () -- C:\hiberfil.sys [2012.08.03 19:13:08 | 000,045,056 | ---- | M] () -- C:\Windows\System32\acovcnt.exe [2012.08.03 19:11:12 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.08.03 19:02:42 | 000,000,680 | RHS- | M] () -- C:\Users\Timeforce\ntuser.pol [2012.08.03 18:19:28 | 004,503,728 | ---- | M] () -- C:\ProgramData\ras_0oed.pad [2012.07.17 20:19:45 | 000,254,720 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT ========== Files Created - No Company Name ========== [2012.08.04 11:36:17 | 000,000,000 | ---- | C] () -- C:\Users\Timeforce\defogger_reenable [2012.08.04 11:31:52 | 000,054,016 | ---- | C] () -- C:\Windows\System32\drivers\uolrhsf.sys [2012.08.03 19:11:12 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.08.03 19:04:03 | 000,000,949 | ---- | C] () -- C:\Users\Timeforce\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk [2012.08.03 19:03:56 | 000,000,944 | ---- | C] () -- C:\Users\Timeforce\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk [2012.08.03 19:03:47 | 000,000,915 | ---- | C] () -- C:\Users\Timeforce\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk [2012.08.03 19:02:41 | 000,000,680 | RHS- | C] () -- C:\Users\Timeforce\ntuser.pol [2012.08.03 19:02:21 | 2110,873,600 | -HS- | C] () -- C:\hiberfil.sys [2012.08.03 18:04:07 | 004,503,728 | ---- | C] () -- C:\ProgramData\ras_0oed.pad [2012.03.27 08:40:15 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2012.03.27 08:40:14 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2012.03.27 08:40:01 | 000,643,072 | ---- | C] () -- C:\Windows\System32\autochk.exe [2012.03.27 06:28:39 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2012.03.22 20:13:35 | 000,140,288 | ---- | C] () -- C:\Windows\System32\igfxtvcx.dll [2012.03.22 20:12:52 | 000,045,056 | ---- | C] () -- C:\Windows\System32\acovcnt.exe [2012.03.22 20:06:48 | 000,047,672 | ---- | C] () -- C:\Windows\AsScrProlog.exe [2012.03.22 20:06:17 | 000,230,952 | ---- | C] () -- C:\Windows\System32\drivers\SRS_PremiumSound_i386.sys [2012.03.22 20:01:58 | 000,057,344 | ---- | C] () -- C:\Windows\System32\LogonStart.dll [2012.03.22 20:00:16 | 001,752,704 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys [2012.03.22 20:00:16 | 000,028,672 | ---- | C] () -- C:\Windows\System32\drivers\sncduvc.sys [2012.03.22 19:55:32 | 000,013,880 | ---- | C] ( ) -- C:\Windows\System32\drivers\kbfiltr.sys [2012.03.22 19:54:52 | 000,139,824 | ---- | C] () -- C:\Windows\System32\igfcg500.bin [2011.02.11 20:10:52 | 000,439,308 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin [2011.02.11 20:10:50 | 000,982,240 | ---- | C] () -- C:\Windows\System32\igkrng500.bin [2011.02.11 20:10:50 | 000,092,356 | ---- | C] () -- C:\Windows\System32\igfcg500m.bin [2011.02.11 19:40:40 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll [2011.02.11 19:38:44 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config ========== LOP Check ========== [2012.08.03 19:34:42 | 000,032,530 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > OTL Extras OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 04.08.2012 11:43:09 - Run 1
OTL by OldTimer - Version 3.2.43.0 Folder = C:\Users\Timeforce\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,97 Gb Total Physical Memory | 1,02 Gb Available Physical Memory | 52,05% Memory free
4,16 Gb Paging File | 2,99 Gb Available in Paging File | 71,91% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 99,61 Gb Total Space | 49,83 Gb Free Space | 50,03% Space Free | Partition Type: NTFS
Drive D: | 100,00 Mb Total Space | 53,07 Mb Free Space | 53,07% Space Free | Partition Type: NTFS
Drive E: | 133,18 Gb Total Space | 114,74 Gb Free Space | 86,15% Space Free | Partition Type: NTFS
Computer Name: SIMONE-PC | User Name: Timeforce | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "e:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "e:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{076F0822-1409-49E9-9155-AFD382920484}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{08EEB77E-FAD0-4124-BC45-B434B1DF71C2}" = dir=in | app=e:\program files (x86)\cyberlink\powerdvd12\kernel\dms\clmsserverpdvd12.exe |
"{0FEA0BEE-0F70-42FB-A46C-B15BF04F781D}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{1057B949-17AD-4ED6-96A4-C0B0B82BDB31}" = dir=in | app=e:\program files (x86)\cyberlink\powerdvd12\powerdvd12ml.exe |
"{34FC72DC-5853-4E6A-AB15-3F452A090D85}" = dir=in | app=e:\program files (x86)\cyberlink\powerdvd12\kernel\dmr\powerdvd12dmrengine.exe |
"{3A220534-BFEB-4409-9625-2394645689D9}" = dir=in | app=e:\program files (x86)\cyberlink\powerdvd12\powerdvd12.exe |
"{4013C87C-8636-41C5-BBD6-D91F209EF6FC}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{455CEB0C-A7FC-4DEE-BE87-B44F3B793A60}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{4994F213-D19F-4F34-B91C-F1019A0F6044}" = protocol=6 | dir=in | app=e:\program files\icq7.7\icq.exe |
"{4E7FE5B6-CAD0-478E-93C7-3CE7E4CDB962}" = protocol=6 | dir=in | app=e:\program files\icq7.7\icq.exe |
"{58FBBEA6-6F05-43A9-BA2D-C534124A5D1A}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{6122CB76-1940-4FA6-9F96-D5114CE79B62}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{65C454D7-A79E-4A26-A70F-4E1877DEF5CA}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{66F3A4C4-994C-4A07-9A0A-65252B52BCFC}" = dir=in | app=e:\program files (x86)\cyberlink\powerdvd12\powerdvd12agent.exe |
"{88243ABD-4249-42DD-B2DA-E870B78A0868}" = protocol=17 | dir=in | app=e:\program files\icq7.7\icq.exe |
"{9D743E8F-38F4-4BC2-B2CC-D2E88C77F12B}" = dir=in | app=e:\program files (x86)\cyberlink\powerdvd12\movie\powerdvd cinema\powerdvdcinema12.exe |
"{ADD35162-04B0-4717-98D3-239681C046AD}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{C6DEB870-8794-41EA-90FD-8D158514BBEE}" = protocol=17 | dir=in | app=e:\program files\icq7.7\icq.exe |
"{E015ADB9-8836-49B7-B284-90CB90D0C5E6}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"TCP Query User{262939A1-4136-4ACB-842F-AE8A9DC1DF2B}E:\program files (x86)\sto\game\cryptic studios\star trek online\live\gameclient.exe" = protocol=6 | dir=in | app=e:\program files (x86)\sto\game\cryptic studios\star trek online\live\gameclient.exe |
"TCP Query User{B7342CF8-BEFF-48BD-829D-028125C20BC1}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"UDP Query User{233BAE9C-DF90-4121-9C62-3F1AA99CE077}E:\program files (x86)\sto\game\cryptic studios\star trek online\live\gameclient.exe" = protocol=17 | dir=in | app=e:\program files (x86)\sto\game\cryptic studios\star trek online\live\gameclient.exe |
"UDP Query User{9DAF1ADA-3021-43DC-AF4B-5EAD889AD4C3}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{06585B02-F20D-4AB2-9A64-86EF2AE0F8F0}" = ASUS AI Recovery
"{0969AF05-4FF6-4C00-9406-43599238DE0D}" = ASUS Splendid Video Enhancement Technology
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{122ADF8C-DDA1-480C-9936-C88F2825B265}" = Apple Application Support
"{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}" = ASUS LifeFrame3
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{20FDF948-C8ED-4543-A539-F7F4AEF5AFA2}" = Wireless Console 3
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 22
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Client Installation Program
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
"{3B05F2FB-745B-4012-ADF2-439F36B2E70B}" = ATKOSD2
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3F4BA3A2-7BE0-48EA-B4BC-CA4D842A409A}" = Cisco EAP-FAST Module
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B6B024F-F6D4-4A7B-8ADA-F9F8370320CC}" = SRS Premium Sound
"{567C654B-7FE9-4970-8323-56E8191D1941}" = ASUS FancyStart
"{6324A1EF-CEF4-43E3-8BCD-9EF3F67317FD}" = NB Probe
"{64452561-169F-4A36-A2FF-B5E118EC65F5}" = ASUS SmartLogon
"{6AD9F5F3-5BD0-4000-BD9C-B536CF86D988}" = iTunes
"{6B77A7F6-DD63-4F13-A6FF-83137A5AC354}" = ASUS CopyProtect
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE}" = ICQ7.7
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7964AE02-9127-42C0-A917-2CE4CD4EFE3B}" = Nokia Suite
"{7C05592D-424B-46CB-B505-E0013E8E75C9}" = ATK Hotkey
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8F1ADE4D-EFAC-4F5A-B346-23C2687FAF50}" = Apple Mobile Device Support
"{934B3B19-8193-467A-B356-E73F82647D38}" = Cisco LEAP Module
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}" = ASUS Power4Gear Hybrid
"{9D48531D-2135-49FC-BC29-ACCDA5396A76}" = ASUS MultiFrame
"{9D6D7811-43B3-463C-BC79-5D1755269989}" = Net4Switch
"{A57025CC-5F2E-4D01-B387-06DB10500D43}" = Nokia Connectivity Cable Driver
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{B46BEA36-0B71-4A4E-AE41-87241643FA0A}" = CyberLink PowerDVD 12
"{BAD1449B-DF0C-4118-B76D-68C54009576C}" = Cisco PEAP Module
"{BF91B300-EEBC-4223-96F3-0FCBF7241B50}" = AmIcoSingLun
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D1E5870E-E3E5-4475-98A6-ADD614524ADF}" = ATK Media
"{D3D54F3E-C5C3-443D-978F-87A72E5616E8}" = ATK Generic Function Service
"{DA41F9E9-B878-467F-95E7-27E4D1943533}" = Multimedia Card Reader
"{DA5B2BDC-F654-4A88-A669-4D34BC7846A1}" = PC Connectivity Solution
"{DE10AB76-4756-4913-BE25-55D1C1051F9A}" = WinFlash
"{E3B64CC5-C011-40C0-92BC-7316CD5E5688}" = Microsoft_VC100_CRT_SP1_x86
"{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}" = ASUS Live Update
"{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}" = ASUS Virtual Camera
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FA2092C5-7979-412D-A962-6485274AE1EE}" = ASUS Data Security Manager
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Asus_Camera_ScreenSaver" = Asus_Camera_ScreenSaver
"Big Kahuna Words" = Big Kahuna Words
"Elantech" = ETDWare PS/2-x86 7.0.5.1 WHQL
"Free M4a to MP3 Converter_is1" = Free M4a to MP3 Converter 7.0
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager
"InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}" = CyberLink PowerDVD 12
"InstallShield_{BF91B300-EEBC-4223-96F3-0FCBF7241B50}" = AmIcoSingLun
"Luxor" = Luxor
"Mahjongg PC" = Mahjongg PC
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"METRIS PC" = METRIS PC
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"MozBackup" = MozBackup 1.5.1
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NIS" = Norton Internet Security
"Nokia Suite" = Nokia Suite
"Philips Songbird" = Philips Songbird
"Solitaire PC" = Solitaire PC
"Star Trek Online" = Star Trek Online
"T4EPlayer" = T4E Player
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"TVWiz" = Intel(R) TV Wizard
"USB 2.0 1.3M UVC WebCam" = USB 2.0 1.3M UVC WebCam
"USB Mass Storage Filter Driver" = Multimedia Card Reader
"VLC media player" = VLC media player 2.0.1
"WinRAR archiver" = WinRAR 4.11 (32-Bit)
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 27.06.2012 17:15:27 | Computer Name = Simone-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Users\Simone\Downloads\iTunes64Setup.exe".
Die
abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 28.06.2012 12:42:19 | Computer Name = Simone-PC | Source = Microsoft-Windows-CAPI2 | ID = 131585
Description =
Error - 28.06.2012 14:47:47 | Computer Name = Simone-PC | Source = EventSystem | ID = 4622
Description =
Error - 03.08.2012 12:05:17 | Computer Name = Simone-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung HControl.exe, Version 1.0.49.2, Zeitstempel
0x49c38d71, fehlerhaftes Modul HControl.exe, Version 1.0.49.2, Zeitstempel 0x49c38d71,
Ausnahmecode 0xc0000005, Fehleroffset 0x0000f610, Prozess-ID 0xdec, Anwendungsstartzeit
01cd717f2f9a1fd2.
Error - 03.08.2012 12:06:22 | Computer Name = Simone-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung HControl.exe, Version 1.0.49.2, Zeitstempel
0x49c38d71, fehlerhaftes Modul HControl.exe, Version 1.0.49.2, Zeitstempel 0x49c38d71,
Ausnahmecode 0xc0000005, Fehleroffset 0x0000f610, Prozess-ID 0xc70, Anwendungsstartzeit
01cd7191d5eec312.
Error - 03.08.2012 12:08:12 | Computer Name = Simone-PC | Source = EventSystem | ID = 4609
Description =
Error - 03.08.2012 12:13:51 | Computer Name = Simone-PC | Source = EventSystem | ID = 4609
Description =
Error - 03.08.2012 12:41:47 | Computer Name = Simone-PC | Source = EventSystem | ID = 4609
Description =
Error - 03.08.2012 13:11:56 | Computer Name = Simone-PC | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 14.0.1.4577 arbeitet nicht mehr mit
Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über
das Problem zu suchen. Prozess-ID: 173c Anfangszeit: 01cd719a33875b4c Zeitpunkt der
Beendigung: 31
Error - 03.08.2012 13:29:49 | Computer Name = Simone-PC | Source = Application Hang | ID = 1002
Description = Programm Install.exe, Version 5.0.448.0 arbeitet nicht mehr mit Windows
zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
zu suchen. Prozess-ID: 568 Anfangszeit: 01cd719ca5536619 Zeitpunkt der Beendigung:
14
[ System Events ]
Error - 03.08.2012 12:42:29 | Computer Name = Simone-PC | Source = Service Control Manager | ID = 7026
Description =
Error - 03.08.2012 12:42:29 | Computer Name = Simone-PC | Source = Service Control Manager | ID = 7001
Description =
Error - 03.08.2012 12:42:29 | Computer Name = Simone-PC | Source = Service Control Manager | ID = 7001
Description =
Error - 03.08.2012 12:42:29 | Computer Name = Simone-PC | Source = Service Control Manager | ID = 7001
Description =
Error - 03.08.2012 12:42:29 | Computer Name = Simone-PC | Source = Service Control Manager | ID = 7001
Description =
Error - 03.08.2012 12:42:29 | Computer Name = Simone-PC | Source = Service Control Manager | ID = 7001
Description =
Error - 03.08.2012 12:42:29 | Computer Name = Simone-PC | Source = Service Control Manager | ID = 7001
Description =
Error - 03.08.2012 12:59:21 | Computer Name = Simone-PC | Source = Service Control Manager | ID = 7001
Description =
Error - 03.08.2012 12:59:21 | Computer Name = Simone-PC | Source = Service Control Manager | ID = 7001
Description =
Error - 03.08.2012 12:59:25 | Computer Name = Simone-PC | Source = Service Control Manager | ID = 7001
Description =
< End of report >
Gmer GMER Logfile: Code:
ATTFilter GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-08-04 13:36:34
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST925041 rev.0002
Running: u3m8ir0d.exe; Driver: C:\Users\TIMEFO~1\AppData\Local\Temp\awdiqpog.sys
---- System - GMER 1.0.15 ----
SSDT 879F7550 ZwAlertResumeThread
SSDT 879F7610 ZwAlertThread
SSDT 910B1968 ZwAllocateVirtualMemory
SSDT 87232108 ZwAlpcConnectPort
SSDT 879F08A0 ZwAssignProcessToJobObject
SSDT 879F7150 ZwCreateMutant
SSDT 879F4E80 ZwCreateSymbolicLinkObject
SSDT 879FF338 ZwCreateThread
SSDT 879F09B8 ZwDebugActiveProcess
SSDT 910B1AF8 ZwDuplicateObject
SSDT 910B17C8 ZwFreeVirtualMemory
SSDT 879F72E0 ZwImpersonateAnonymousToken
SSDT 879F73C0 ZwImpersonateThread
SSDT 87296108 ZwLoadDriver
SSDT 879F3B80 ZwMapViewOfSection
SSDT 879F7048 ZwOpenEvent
SSDT 910B1C98 ZwOpenProcess
SSDT 910B1A38 ZwOpenProcessToken
SSDT 878C4660 ZwOpenSection
SSDT 910B1BC8 ZwOpenThread
SSDT 879F0298 ZwProtectVirtualMemory
SSDT 878C4278 ZwResumeThread
SSDT 879F38F0 ZwSetContextThread
SSDT 879F39D0 ZwSetInformationProcess
SSDT 879F0F90 ZwSetSystemInformation
SSDT 878C4CE8 ZwSuspendProcess
SSDT 879F31D0 ZwSuspendThread
SSDT 879FF418 ZwTerminateProcess
SSDT 879F3810 ZwTerminateThread
SSDT 879F3AC0 ZwUnmapViewOfSection
SSDT 910B1898 ZwWriteVirtualMemory
SSDT 879F4F70 ZwCreateThreadEx
---- Kernel code sections - GMER 1.0.15 ----
.text ntkrnlpa.exe!KeSetEvent + 11D 81CE77E0 8 Bytes [50, 75, 9F, 87, 10, 76, 9F, ...]
.text ntkrnlpa.exe!KeSetEvent + 131 81CE77F4 4 Bytes [68, 19, 0B, 91]
.text ntkrnlpa.exe!KeSetEvent + 13D 81CE7800 4 Bytes [08, 21, 23, 87]
.text ntkrnlpa.exe!KeSetEvent + 191 81CE7854 4 Bytes [A0, 08, 9F, 87]
.text ntkrnlpa.exe!KeSetEvent + 1F5 81CE78B8 4 Bytes [50, 71, 9F, 87]
.text ...
.text E:\Program Files (x86)\Cyberlink\PowerDVD12\Common\NavFilter\000.fcl section is writeable [0xB18F5000, 0x2892, 0xE8000020]
.vmp2 E:\Program Files (x86)\Cyberlink\PowerDVD12\Common\NavFilter\000.fcl entry point in ".vmp2" section [0xB1918050]
---- Devices - GMER 1.0.15 ----
AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
AttachedDevice \Driver\tdx \Device\Tcp SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\tdx \Device\Udp SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\tdx \Device\RawIp SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)
---- Files - GMER 1.0.15 ----
File C:\ADSM_PData_0150 0 bytes
File C:\ADSM_PData_0150\DB 0 bytes
File C:\ADSM_PData_0150\DB\SI.db 624 bytes
File C:\ADSM_PData_0150\DB\UL.db 16 bytes
File C:\ADSM_PData_0150\DB\VL.db 16 bytes
File C:\ADSM_PData_0150\DB\WAL.db 2048 bytes
File C:\ADSM_PData_0150\DragWait.exe 315392 bytes executable
File C:\ADSM_PData_0150\_avt 512 bytes
---- EOF - GMER 1.0.15 ----
Nun noch eine kleine Frage von einem Bekannten der ebenfalls betroffen ist: Wenn er die Festplatte aus seinem Laptop in ein Gehäuse für eine Externe Platte reinsetzt und sämtliche Scans über seinen PC laufen lassen würde, würde das seinen PC evtl ebenfalls infizieren oder wäre es bedenkenlos da es über eine Externe Platte läuft? Vielen dank schon mal. Greetz Marcel Und hier noch der Log von Malwarebytes: Zitat:
Zitat:
|
| Themen zu Verschlüsselungstrojaner vorhanden |
| adwcleaner, bho, bonjour, converter, defender, desktop, error, externe platte, fehler, festplatte, firefox, flash player, format, frage, home, install.exe, installation, logfile, mozilla, mp3, plug-in, registry, rundll, security, software, symantec, teamspeak, udp, usb 2.0, vista |
Baum-Darstellung