Live Security Platinum per Adobe Flashplayer eingefangen.

Great Healer · 11.08.2012, 14:28

Gute Tag trojaner Team,
ich war feudig im Netz unterwegs bis sich ein Flash Elemente öffnet, Antivire auf einmal Alarm schlägt und die Firewall Adobe den Zugriff verweigern will. Hat leider alles nicht geholfen, das Ding ist trotzdem drauf gekommen.

Habe schonmal OTL drüber laufen lassen. Falls da was nicht stimmt lasse ich es gerne nochmal laufen. Danke schonmal für die Hilfe.

Code:

ATTFilter

OTL logfile created on: 8/11/2012 3:18:08 PM - Run 2
OTL by OldTimer - Version 3.2.56.0     Folder = C:\Users\Jan\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.86 Gb Total Physical Memory | 3.08 Gb Available Physical Memory | 79.81% Memory free
7.71 Gb Paging File | 7.09 Gb Available in Paging File | 91.97% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 74.52 Gb Total Space | 36.31 Gb Free Space | 48.72% Space Free | Partition Type: NTFS
Drive D: | 207.33 Gb Total Space | 140.68 Gb Free Space | 67.85% Space Free | Partition Type: NTFS
 
Computer Name: JAN-PC | User Name: Jan | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Jan\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (AFBAgent) -- C:\Windows\SysNative\FBAgent.exe (ASUSTeK Computer Inc.)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (OverwolfUpdaterService) -- C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe (Overwolf Ltd)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (ZuneWlanCfgSvc) -- C:\Programme\Zune\ZuneWlanCfgSvc.exe (Microsoft Corporation)
SRV - (WMZuneComm) -- C:\Programme\Zune\WMZuneComm.exe (Microsoft Corporation)
SRV - (ZuneNetworkSvc) -- C:\Programme\Zune\ZuneNss.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (ATKGFNEXSrv) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS)
SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
SRV - (ASLDRService) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (ASUS)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (ADSMService) -- C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe (ASUSTek Computer Inc.)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (tap0901) -- C:\Windows\SysNative\drivers\tap0901.sys (The OpenVPN Project)
DRV:64bit: - (SPUVCbv) -- C:\Windows\SysNative\drivers\SPUVCBv_x64.sys (Digital Camera)
DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (AsDsm) -- C:\Windows\SysNative\drivers\AsDsm.sys (ASUSTek Computer Inc)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atipmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (JME) -- C:\Windows\SysNative\drivers\JME.sys (JMicron Technology Corp.)
DRV:64bit: - (CnxtHdAudService) -- C:\Windows\SysNative\drivers\CHDRT64.sys (Conexant Systems Inc.)
DRV:64bit: - (ETD) -- C:\Windows\SysNative\drivers\ETD.sys (ELAN Microelectronic Corp.)
DRV:64bit: - (AtiHdmiService) -- C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV:64bit: - (HECIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (JMCR) -- C:\Windows\SysNative\drivers\jmcr.sys (JMicron Technology Corporation)
DRV:64bit: - (SNP2UVC) -- C:\Windows\SysNative\drivers\snp2uvc.sys ()
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (kbfiltr) -- C:\Windows\SysNative\drivers\kbfiltr.sys ( )
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (lullaby) -- C:\Windows\SysNative\drivers\lullaby.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (SiSGbeLH) -- C:\Windows\SysNative\drivers\SiSG664.sys (Silicon Integrated Systems Corp.)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (MTsensor) -- C:\Windows\SysNative\drivers\ATK64AMD.sys (ASUS)
DRV:64bit: - (WimFltr) -- C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (ASMMAP64) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys (ASUS)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3418490897-977339167-1968602665-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-3418490897-977339167-1968602665-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-3418490897-977339167-1968602665-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0E 51 0E 5E DE 75 CD 01  [binary data]
IE - HKU\S-1-5-21-3418490897-977339167-1968602665-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-3418490897-977339167-1968602665-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-3418490897-977339167-1968602665-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.cineplex.de/kino/programm/city47/?scope=nextweek"
FF - prefs.js..network.proxy.autoconfig_url: "file:///C:\\Users\\Jan\\AppData\\Local\\Temp\\proxtube.pac"
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_268.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_268.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.4.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.4.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: D:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Jan\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/07/18 14:45:27 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/07/18 14:45:27 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2012/06/01 16:37:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jan\AppData\Roaming\mozilla\Extensions
[2012/08/07 00:55:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Jan\AppData\Roaming\mozilla\Firefox\Profiles\xo23vrsm.default\extensions
[2012/06/01 19:00:29 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\Jan\AppData\Roaming\mozilla\Firefox\Profiles\xo23vrsm.default\extensions\ich@maltegoetz.de
[2012/06/01 16:35:45 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012/08/07 00:55:17 | 000,080,872 | ---- | M] () (No name found) -- C:\USERS\JAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\XO23VRSM.DEFAULT\EXTENSIONS\{9C51BD27-6ED8-4000-A2BF-36CB95C0C947}.XPI
[2012/07/18 14:45:27 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/04/21 03:54:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/04/21 03:54:08 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/04/21 03:54:08 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012/04/21 03:54:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/04/21 03:54:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/04/21 03:54:08 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009/06/10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [ETDWare] C:\Programme\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.)
O4:64bit: - HKLM..\Run: [Setwallpaper] c:\programdata\SetWallpaper.cmd File not found
O4:64bit: - HKLM..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe ()
O4:64bit: - HKLM..\Run: [Zune Launcher] C:\Program Files\Zune\ZuneLauncher.exe (Microsoft Corporation)
O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)
O4 - HKLM..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3418490897-977339167-1968602665-1001..\Run: [Facebook Update] C:\Users\Jan\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKU\S-1-5-21-3418490897-977339167-1968602665-1001..\Run: [Raptr] C:\PROGRA~2\Raptr\raptrstub.exe --startup File not found
O4 - HKU\S-1-5-21-3418490897-977339167-1968602665-1001..\Run: [Spotify Web Helper] C:\Users\Jan\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe ()
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-21-3418490897-977339167-1968602665-1001..\RunOnce: [0C1CFAF40000F549004A1E29F875F002] C:\ProgramData\0C1CFAF40000F549004A1E29F875F002\0C1CFAF40000F549004A1E29F875F002.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7A98638E-665A-4475-B3FD-22943112DF98}: DhcpNameServer = 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B3A67F96-211F-4884-B86E-5E5542EDA616}: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Overwolf\SKYPE4~1.DLL (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/08/11 06:41:33 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Jan\Desktop\OTL.exe
[2012/08/11 06:00:15 | 010,652,120 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\Jan\Desktop\mbam-setup-1.62.0.1300.exe
[2012/08/11 05:51:56 | 000,000,000 | ---D | C] -- C:\ProgramData\0C1CFAF40000F549004A1E29F875F002
[2012/08/03 21:36:11 | 000,000,000 | ---D | C] -- C:\Users\Jan\AppData\Roaming\OverPlay.net, LP
[2012/08/03 21:35:59 | 000,000,000 | ---D | C] -- C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OverPlay.net, LP
[2012/08/03 21:34:55 | 000,000,000 | ---D | C] -- C:\Users\Jan\AppData\Local\Apps
[2012/08/03 21:34:54 | 000,000,000 | ---D | C] -- C:\Users\Jan\AppData\Local\Deployment
[2012/08/03 21:34:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Tap0901
[2012/07/16 20:03:25 | 000,000,000 | ---D | C] -- C:\Users\Jan\AppData\Local\Spotify
[2012/07/16 20:02:49 | 000,000,000 | ---D | C] -- C:\Users\Jan\AppData\Roaming\Spotify
[2012/07/13 23:49:32 | 000,000,000 | ---D | C] -- C:\Users\Jan\Documents\C9
[2012/07/13 19:46:58 | 000,000,000 | ---D | C] -- C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Webzen Hub
[2012/07/13 19:46:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Overwolf
[2012/07/13 19:46:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Overwolf
[2012/07/13 19:45:21 | 000,000,000 | ---D | C] -- C:\Users\Jan\AppData\Local\Overwolf
[2012/07/13 19:45:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NVIDIA Corporation
[2012/07/13 19:45:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Wise Installation Wizard
[2012/07/13 19:44:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\C9
[2008/08/12 06:45:20 | 000,155,648 | ---- | C] (ASUS) -- C:\Program Files (x86)\Common Files\MSIactionall.dll
[1 C:\Windows\SysNative\drivers\*.tmp files -> C:\Windows\SysNative\drivers\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/08/11 06:52:01 | 000,000,000 | ---- | M] () -- C:\Users\Jan\defogger_reenable
[2012/08/11 06:41:34 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Jan\Desktop\OTL.exe
[2012/08/11 06:41:14 | 000,050,477 | ---- | M] () -- C:\Users\Jan\Desktop\Defogger.exe
[2012/08/11 06:37:57 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012/08/11 06:37:57 | 000,653,928 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012/08/11 06:37:57 | 000,615,810 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012/08/11 06:37:57 | 000,129,800 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012/08/11 06:37:57 | 000,106,190 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012/08/11 06:13:27 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/08/11 06:13:21 | 3105,263,616 | -HS- | M] () -- C:\hiberfil.sys
[2012/08/11 06:12:30 | 000,000,434 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.ics
[2012/08/11 06:11:38 | 000,015,568 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/08/11 06:11:38 | 000,015,568 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/08/11 06:00:24 | 010,652,120 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\Jan\Desktop\mbam-setup-1.62.0.1300.exe
[2012/08/11 04:55:27 | 000,171,420 | ---- | M] () -- C:\Users\Jan\Desktop\lol.png
[2012/08/11 03:04:00 | 000,001,130 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3418490897-977339167-1968602665-1001UA.job
[2012/08/11 00:04:00 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3418490897-977339167-1968602665-1001Core.job
[2012/08/10 04:01:06 | 000,024,275 | ---- | M] () -- C:\Users\Jan\Desktop\kleinmarkt.png
[2012/08/06 20:25:10 | 000,012,477 | ---- | M] () -- C:\Users\Jan\Desktop\GD Krass!!!.ods
[2012/08/06 20:16:25 | 000,013,560 | ---- | M] () -- C:\Users\Jan\Desktop\Gun Bros.odt
[2012/08/02 11:59:42 | 000,021,349 | ---- | M] () -- C:\Users\Jan\Desktop\MonstaFish.odt
[2012/07/29 02:47:45 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012/07/29 02:47:45 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/07/24 21:35:05 | 000,011,684 | ---- | M] () -- C:\Users\Jan\Desktop\ZumbaKurse.ods
[2012/07/17 16:45:30 | 000,001,598 | ---- | M] () -- C:\Windows\SysNative\AutoRunFilter.ini
[2012/07/16 20:03:24 | 000,001,797 | ---- | M] () -- C:\Users\Jan\Desktop\Spotify.lnk
[2012/07/14 13:38:03 | 000,001,198 | ---- | M] () -- C:\Windows\SysNative\ServiceFilter.ini
[2012/07/13 19:46:58 | 000,001,977 | ---- | M] () -- C:\Users\Public\Desktop\Webzen Hub.lnk
[2012/07/13 19:44:46 | 000,000,774 | ---- | M] () -- C:\Users\Jan\Desktop\C9.lnk
[1 C:\Windows\SysNative\drivers\*.tmp files -> C:\Windows\SysNative\drivers\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/08/11 06:52:01 | 000,000,000 | ---- | C] () -- C:\Users\Jan\defogger_reenable
[2012/08/11 06:41:12 | 000,050,477 | ---- | C] () -- C:\Users\Jan\Desktop\Defogger.exe
[2012/08/11 04:55:27 | 000,171,420 | ---- | C] () -- C:\Users\Jan\Desktop\lol.png
[2012/08/10 04:01:06 | 000,024,275 | ---- | C] () -- C:\Users\Jan\Desktop\kleinmarkt.png
[2012/08/06 20:12:13 | 000,013,560 | ---- | C] () -- C:\Users\Jan\Desktop\Gun Bros.odt
[2012/08/02 11:41:04 | 000,021,349 | ---- | C] () -- C:\Users\Jan\Desktop\MonstaFish.odt
[2012/08/01 19:25:24 | 000,012,477 | ---- | C] () -- C:\Users\Jan\Desktop\GD Krass!!!.ods
[2012/07/16 20:03:24 | 000,001,797 | ---- | C] () -- C:\Users\Jan\Desktop\Spotify.lnk
[2012/07/16 20:03:24 | 000,001,783 | ---- | C] () -- C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
[2012/07/13 19:46:58 | 000,001,977 | ---- | C] () -- C:\Users\Public\Desktop\Webzen Hub.lnk
[2012/07/13 19:44:46 | 000,000,774 | ---- | C] () -- C:\Users\Jan\Desktop\C9.lnk
[2012/06/02 03:21:56 | 000,002,048 | -HS- | C] () -- C:\Users\Jan\AppData\Local\{cfffdb83-ddd1-9f74-799d-9f67e4a95739}\@
[2012/05/30 23:41:45 | 000,233,472 | ---- | C] () -- C:\Windows\GetPath.exe
[2012/05/30 23:41:44 | 005,795,840 | ---- | C] () -- C:\Windows\QMTTest.exe
[2012/05/30 23:41:44 | 000,565,248 | ---- | C] () -- C:\Windows\wl.exe
[2012/05/30 23:41:44 | 000,258,048 | ---- | C] () -- C:\Windows\macwrite.exe
[2012/05/30 23:41:44 | 000,217,088 | ---- | C] () -- C:\Windows\AsusSataCheck.exe
[2012/05/30 23:41:44 | 000,196,096 | ---- | C] () -- C:\Windows\WSMBIOS.exe
[2012/05/30 23:41:44 | 000,180,224 | ---- | C] () -- C:\Windows\txt2pdf.exe
[2012/05/30 23:41:44 | 000,155,648 | ---- | C] () -- C:\Windows\Display.exe
[2012/05/30 23:41:44 | 000,147,456 | ---- | C] () -- C:\Windows\Section.exe
[2012/05/30 23:41:44 | 000,131,072 | ---- | C] () -- C:\Windows\hotkey.exe
[2012/05/30 23:41:44 | 000,122,368 | ---- | C] () -- C:\Windows\WBT.exe
[2012/05/30 23:41:44 | 000,103,936 | ---- | C] () -- C:\Windows\WMarker.exe
[2012/05/30 23:41:44 | 000,077,824 | ---- | C] () -- C:\Windows\WGPNV.exe
[2012/05/30 23:41:44 | 000,057,344 | ---- | C] () -- C:\Windows\keylearn.exe
[2012/05/30 23:41:44 | 000,053,248 | ---- | C] () -- C:\Windows\Q2DInertia.exe
[2012/05/30 23:41:44 | 000,045,056 | ---- | C] () -- C:\Windows\MtGesTure.exe
[2012/05/30 23:41:44 | 000,024,576 | ---- | C] () -- C:\Windows\MoveToFront.exe
[2012/05/30 23:41:44 | 000,020,096 | ---- | C] () -- C:\Windows\ATSZIO64.sys
[2012/05/30 23:41:44 | 000,018,560 | ---- | C] () -- C:\Windows\ATSZIO.sys
[2012/05/30 23:41:44 | 000,008,704 | ---- | C] () -- C:\Windows\MixerCtrl.exe
[2011/11/22 23:13:22 | 000,080,584 | ---- | C] () -- C:\Windows\SPRemove_x64.exe
[2011/11/22 23:13:22 | 000,072,904 | ---- | C] () -- C:\Windows\SPRemove.exe
[2011/11/22 23:13:21 | 000,001,580 | ---- | C] () -- C:\Windows\Remove.ini
[2011/09/28 17:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011/03/30 23:40:12 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\LogonStart.dll
[2011/03/30 23:35:34 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2009/04/08 19:31:56 | 000,106,496 | ---- | C] () -- C:\Program Files (x86)\Common Files\CPInstallAction.dll
[2008/05/22 17:35:54 | 000,051,962 | ---- | C] () -- C:\Program Files (x86)\Common Files\banner.jpg

< End of report >

Live Security Platinum per Adobe Flashplayer eingefangen.

Log-Analyse und Auswertung: Live Security Platinum per Adobe Flashplayer eingefangen.

Live Security Platinum per Adobe Flashplayer eingefangen.

Ähnliche Themen: Live Security Platinum per Adobe Flashplayer eingefangen.