Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg?

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 03.09.2012, 18:42   #1
dalyay
 
tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg? - Standard

tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg?



Hallo,

ich habe hier ein kleines Problem. Ich habe laut "AntiVir" 2 bösewichte mit dem Namen:

- tr/sirefef.16896
- tr/atraps.gen2

Leider bekomme ich die nicht so ohne weiteres entfernt. Selbst in quarantäne lassen die sich nicht schieben. Ich hoffe ihr könnt mir helfen.

HAbe hier noch das Log von Malwarebytes wenn das helfen sollte.

Code:
ATTFilter
 Malwarebytes Anti-Malware  (Trial) 1.62.0.1300
www.malwarebytes.org

Database version: v2012.09.03.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Sebastian :: ADMIN-PC [limited]

Protection: Enabled

03.09.2012 19:31:16
mbam-log-2012-09-03 (19-15-32).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 149142
Time elapsed: 39 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 2
C:\Windows\Installer\{5c5eea11-aaa1-99c9-2255-cb68e6cb1d7b}\U\80000000.@ (Rootkit.0Access.64) -> No action taken.
C:\Windows\Installer\{5c5eea11-aaa1-99c9-2255-cb68e6cb1d7b}\U\800000cb.@ (RootKit.0Access.H) -> No action taken.

(end)
         

Alt 04.09.2012, 22:01   #2
Larusso
/// Selecta Jahrusso
 
tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg? - Standard

tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg?





Bitte folge den Anweisungen hier und poste die geforderten Logfiles.
http://www.trojaner-board.de/69886-a...-beachten.html
__________________

__________________

Alt 07.09.2012, 03:12   #3
dalyay
 
tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg? - Standard

tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg?



Hallo,

hier die files


[CODE]OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 07.09.2012 04:01:24 - Run 1
OTL by OldTimer - Version 3.2.61.1     Folder = C:\Users\Sebastian\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
15,98 Gb Total Physical Memory | 13,91 Gb Available Physical Memory | 87,01% Memory free
31,96 Gb Paging File | 29,77 Gb Available in Paging File | 93,14% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 89,33 Gb Total Space | 24,31 Gb Free Space | 27,21% Space Free | Partition Type: NTFS
Drive D: | 298,05 Gb Total Space | 233,84 Gb Free Space | 78,46% Space Free | Partition Type: NTFS
 
Computer Name: ADMIN-PC | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.09.07 04:00:48 | 000,599,552 | ---- | M] (OldTimer Tools) -- C:\Users\Sebastian\Desktop\OTL.exe
PRC - [2012.08.21 08:17:22 | 001,536,712 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_271.exe
PRC - [2012.07.18 18:04:33 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2012.07.18 18:04:23 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.07.18 18:04:22 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.07.14 02:13:42 | 000,913,888 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.07.03 13:46:44 | 000,462,920 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011.06.26 16:42:46 | 000,378,472 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2011.03.03 16:48:28 | 002,656,280 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2011.03.03 16:48:28 | 000,326,168 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2010.08.11 16:18:06 | 000,487,561 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.08.21 08:17:22 | 009,465,032 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_271.dll
MOD - [2012.07.14 02:14:07 | 002,003,424 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2012.05.30 20:06:48 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012.05.30 20:06:30 | 001,242,512 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011.06.26 16:42:30 | 000,237,160 | ---- | M] () -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll
 
 
========== Services (SafeList) ==========
 
SRV - [2012.08.21 08:17:22 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.07.18 18:04:33 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.07.18 18:04:23 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.07.14 02:17:12 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.06.26 16:42:46 | 000,378,472 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2011.03.03 16:48:28 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2011.03.03 16:48:28 | 000,326,168 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2011.01.05 13:41:38 | 001,515,792 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV - [2011.01.05 13:28:50 | 000,340,240 | ---- | M] () [On_Demand | Stopped] -- C:\Programme\Intel\WiFi\bin\PanDhcpDns.exe -- (MyWiFiDHCPDNS)
SRV - [2011.01.05 13:26:56 | 000,836,880 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.07.18 18:04:42 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.07.18 18:04:42 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2012.07.18 18:04:41 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012.04.25 12:11:36 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.07.05 13:53:46 | 000,174,184 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2011.03.30 15:12:14 | 001,395,760 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2011.03.03 17:23:42 | 000,027,760 | ---- | M] (ST Microelectronics) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Accelern.sys -- (Acceler)
DRV:64bit: - [2011.03.03 17:07:44 | 000,335,464 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtsPStor.sys -- (RSPCIESTOR)
DRV:64bit: - [2011.03.03 17:02:38 | 000,076,912 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C)
DRV:64bit: - [2011.01.04 11:29:46 | 008,507,392 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwNs64.sys -- (NETwNs64)
DRV:64bit: - [2010.11.21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.21 05:23:47 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010.11.21 05:23:47 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010.11.21 05:23:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.10.19 23:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:64bit: - [2010.09.30 21:00:06 | 000,180,736 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2010.09.30 21:00:06 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2010.08.20 11:05:12 | 000,021,616 | ---- | M] (ST Microelectronics) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\stdcfltn.sys -- (stdcfltn)
DRV:64bit: - [2010.06.07 16:45:00 | 000,174,848 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CtClsFlt.sys -- (CtClsFlt)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.babylon.com/?affID=112555&tt=3412_8&babsrc=HP_ss&mntrId=dca16f640000000000005c260a6b8f85
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 42 31 23 12 44 7F CD 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=112555&tt=3412_8&babsrc=SP_ss&mntrId=dca16f640000000000005c260a6b8f85
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_271.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_271.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.08.21 07:34:48 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.08.21 07:38:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
 
[2012.08.21 07:34:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\mozilla\Extensions
[2012.08.21 07:34:48 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.07.14 02:15:45 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.07.14 02:45:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.07.14 02:45:08 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.07.14 02:45:08 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.07.14 02:45:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.07.14 02:45:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.07.14 02:45:07 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O4:64bit: - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation)
O4:64bit: - HKLM..\Run: [NVHotkey] C:\Windows\SysNative\nvHotkey.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Integrated Webcam Live! Central] C:\Program Files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKCU..\Run: [DriverMax] C:\Program Files (x86)\Innovative Solutions\DriverMax\drivermax.exe (Innovative Solutions)
O4 - HKCU..\Run: [DriverMax_RESTART]  File not found
O4 - HKCU..\Run: [Personal ID] C:\PROGRA~2\COOLSP~1\PERSON~1\PID.EXE (coolspot AG, Düsseldorf)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {682C59F5-478C-4421-9070-AD170D143B77} hxxp://www.dell.com/support/troubleshooting/Content/Ode/pcd64.cab (Launcher Class)
O16 - DPF: {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} hxxp://support.dell.com/systemprofiler/DellSystemLite.CAB (DellSystemLite.Scanner)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5865820E-726C-4286-B22B-2CEBFBF19153}: DhcpNameServer = 192.168.2.1
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.09.05 00:05:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UseNeXT
[2012.09.05 00:05:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\UseNeXT
[2012.09.04 23:51:43 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\WinRAR
[2012.09.04 23:51:43 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012.09.04 23:51:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012.09.04 23:51:42 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2012.09.04 23:14:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Foxit Software
[2012.09.04 23:13:23 | 014,662,576 | ---- | C] (Foxit Corporation                                           ) -- C:\Users\Admin\Desktop\FoxitReader531.0606_enu_Setup.exe
[2012.09.03 22:09:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EAGLE Layout Editor 6.2.0
[2012.09.03 22:09:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\EAGLE-6.2.0
[2012.09.03 22:09:23 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\CadSoft
[2012.09.03 21:28:37 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Dropbox
[2012.09.03 19:03:43 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Malwarebytes
[2012.09.03 19:03:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.09.03 19:03:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.09.03 19:03:36 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.09.03 19:03:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.08.28 03:53:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Resource Hacker
[2012.08.28 03:53:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Resource Hacker
[2012.08.24 22:52:57 | 000,000,000 | ---D | C] -- C:\ProgramData\VOWSoft
[2012.08.24 22:52:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iPodRobot
[2012.08.24 22:52:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iPodRobot
[2012.08.22 20:21:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Blizzard Entertainment
[2012.08.21 22:10:53 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\libimobiledevice
[2012.08.21 19:54:00 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Personal ID
[2012.08.21 19:54:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\coolspot AG
[2012.08.21 19:53:25 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Utherverse
[2012.08.21 19:51:55 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Secret City
[2012.08.21 19:46:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SecretCity 3DChat
[2012.08.21 19:46:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Utherverse Digital Inc
[2012.08.21 10:17:29 | 000,000,000 | ---D | C] -- C:\Windows\Panther
[2012.08.21 10:17:08 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\OEM
[2012.08.21 10:17:08 | 000,000,000 | ---D | C] -- C:\Hotfix
[2012.08.21 10:17:08 | 000,000,000 | ---D | C] -- C:\Drivers
[2012.08.21 10:16:06 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\XPSViewer
[2012.08.21 10:16:06 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\de-DE
[2012.08.21 10:16:06 | 000,000,000 | ---D | C] -- C:\Windows\de-DE
[2012.08.21 10:16:06 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\de
[2012.08.21 10:16:06 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\0407
[2012.08.21 10:16:05 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\de-DE
[2012.08.21 10:16:05 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\de
[2012.08.21 10:16:05 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\0407
[2012.08.21 10:14:43 | 000,004,096 | ---- | C] (SCM Microsystems, Inc.) -- C:\Windows\SysNative\drivers\de-DE\pscr.sys.mui
[2012.08.21 10:14:28 | 000,011,776 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrSerIb.sys.mui
[2012.08.21 10:14:27 | 000,011,776 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrSerId.sys.mui
[2012.08.21 10:14:27 | 000,002,560 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysNative\drivers\de-DE\BrParwdm.sys.mui
[2012.08.21 08:17:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe
[2012.08.21 07:46:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Battle.net
[2012.08.21 07:38:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Thunderbird
[2012.08.21 07:38:01 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Avira
[2012.08.21 07:37:56 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.4
[2012.08.21 07:37:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OpenOffice.org 3
[2012.08.21 07:36:00 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Apple Computer
[2012.08.21 07:36:00 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Apple Computer
[2012.08.21 07:35:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012.08.21 07:35:49 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2012.08.21 07:35:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2012.08.21 07:35:49 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2012.08.21 07:35:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2012.08.21 07:35:49 | 000,000,000 | ---D | C] -- C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
[2012.08.21 07:35:36 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Apple
[2012.08.21 07:35:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update
[2012.08.21 07:35:30 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple
[2012.08.21 07:35:26 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2012.08.21 07:35:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Bonjour
[2012.08.21 07:35:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple
[2012.08.21 07:35:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Apple
[2012.08.21 07:33:56 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Mozilla
[2012.08.21 07:33:56 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Mozilla
[2012.08.21 07:33:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2012.08.21 07:33:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service
[2012.08.21 07:32:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2012.08.21 07:32:35 | 000,132,832 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys
[2012.08.21 07:32:35 | 000,098,848 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2012.08.21 07:32:35 | 000,027,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2012.08.21 07:32:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2012.08.21 07:32:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
[2012.08.21 07:21:08 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Innovative Solutions
[2012.08.21 07:21:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverMax
[2012.08.21 07:21:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Innovative Solutions
[2012.08.21 07:19:14 | 000,000,000 | -HSD | C] -- C:\Windows\SysNative\%APPDATA%
[2012.08.21 07:18:07 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Macromedia
[2012.08.21 07:17:00 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Adobe
[2012.08.21 07:16:39 | 000,000,000 | ---D | C] -- C:\temp
[2012.08.21 07:16:02 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Macromed
[2012.08.21 07:16:01 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed
[2012.08.21 07:08:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2012.08.21 07:08:31 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Babylon
[2012.08.21 07:08:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon
[2012.08.21 07:08:30 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\YourFileDownloader
[2012.08.21 07:04:20 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Easeware
[2012.08.21 06:51:09 | 000,053,248 | ---- | C] (Windows XP Bundled build C-Centric Single User) -- C:\Windows\SysWow64\CSVer.dll
[2012.08.21 04:43:23 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Dell
[2012.08.21 04:43:22 | 000,000,000 | ---D | C] -- C:\ProgramData\PCDr
[2012.08.21 04:43:20 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AlienAutopsy
[2012.08.21 04:43:18 | 000,000,000 | ---D | C] -- C:\Program Files\AlienAutopsy
[2012.08.21 04:42:32 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\PCDr
[2012.08.21 04:40:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
[2012.08.21 04:39:04 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA
[2012.08.21 04:38:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NVIDIA Corporation
[2012.08.21 04:38:11 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation
[2012.08.21 04:38:03 | 000,067,176 | ---- | C] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll
[2012.08.21 04:38:03 | 000,057,960 | ---- | C] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll
[2012.08.21 04:37:56 | 000,000,000 | ---D | C] -- C:\Program Files\NVIDIA Corporation
[2012.08.21 04:35:03 | 000,021,616 | ---- | C] (ST Microelectronics) -- C:\Windows\SysNative\drivers\stdcfltn.sys
[2012.08.21 04:35:03 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\DRVSTORE
[2012.08.21 04:34:21 | 000,000,000 | ---D | C] -- C:\Program Files\STMicroelectronics
[2012.08.21 04:31:32 | 000,000,000 | ---D | C] -- C:\Program Files\Synaptics
[2012.08.21 04:31:19 | 001,395,760 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\drivers\SynTP.sys
[2012.08.21 04:31:19 | 000,400,168 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\SynCOM.dll
[2012.08.21 04:31:19 | 000,273,704 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\SynCtrl.dll
[2012.08.21 04:31:19 | 000,218,408 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysWow64\SynCtrl.dll
[2012.08.21 04:31:19 | 000,215,336 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\SynTPAPI.dll
[2012.08.21 04:31:19 | 000,173,352 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysWow64\SynCOM.dll
[2012.08.21 04:31:19 | 000,148,264 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\SynTPCo4.dll
[2012.08.21 04:31:19 | 000,107,816 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysWow64\SynTPCOM.dll
[2012.08.21 04:30:54 | 000,081,008 | ---- | C] (ST Microelectronics) -- C:\Windows\SysNative\accelernco01.dll
[2012.08.21 04:30:54 | 000,027,760 | ---- | C] (ST Microelectronics) -- C:\Windows\SysNative\drivers\Accelern.sys
[2012.08.21 04:28:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\postureAgent
[2012.08.21 04:28:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Intel
[2012.08.21 01:43:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET
[2012.08.21 01:15:06 | 000,000,000 | -HSD | C] -- C:\Users\Admin\AppData\Local\{5c5eea11-aaa1-99c9-2255-cb68e6cb1d7b}
[2012.08.21 01:10:51 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Atheros_L1e
[2012.08.21 01:10:29 | 000,076,912 | ---- | C] (Atheros Communications, Inc.) -- C:\Windows\SysNative\drivers\L1C62x64.sys
[2012.08.21 01:09:09 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Downloaded Installations
[2012.08.21 01:08:24 | 000,000,000 | ---D | C] -- C:\Intel
[2012.08.21 01:08:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD APP
[2012.08.21 01:08:22 | 000,000,000 | ---D | C] -- C:\Program Files\ATI
[2012.08.21 01:08:10 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies
[2012.08.21 00:46:13 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Intel
[2012.08.21 00:46:09 | 000,000,000 | ---D | C] -- C:\Users\Admin\Roaming
[2012.08.21 00:46:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Roaming
[2012.08.21 00:45:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel PROSet Wireless
[2012.08.21 00:45:24 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Intel
[2012.08.21 00:45:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Intel
[2012.08.21 00:45:23 | 000,000,000 | ---D | C] -- C:\Program Files\Intel
[2012.08.21 00:45:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Cisco
[2012.08.21 00:45:00 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
[2012.08.21 00:44:56 | 000,000,000 | ---D | C] -- C:\dell
[2012.08.21 00:27:02 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Creative
[2012.08.21 00:26:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Integrated Webcam
[2012.08.21 00:25:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Creative
[2012.08.21 00:24:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Integrated Webcam
[2012.08.21 00:24:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Creative Live! Cam
[2012.08.21 00:23:57 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\InstallShield Installation Information
[2012.08.21 00:23:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InstallShield
[2012.08.21 00:21:38 | 000,000,000 | R--D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2012.08.21 00:21:38 | 000,000,000 | R--D | C] -- C:\Users\Admin\Searches
[2012.08.21 00:21:38 | 000,000,000 | R--D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2012.08.21 00:21:32 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Identities
[2012.08.21 00:21:31 | 000,000,000 | R--D | C] -- C:\Users\Admin\Contacts
[2012.08.21 00:21:30 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\VirtualStore
[2012.08.21 00:21:27 | 000,000,000 | --SD | C] -- C:\Users\Admin\AppData\Roaming\Microsoft
[2012.08.21 00:21:27 | 000,000,000 | R--D | C] -- C:\Users\Admin\Videos
[2012.08.21 00:21:27 | 000,000,000 | R--D | C] -- C:\Users\Admin\Saved Games
[2012.08.21 00:21:27 | 000,000,000 | R--D | C] -- C:\Users\Admin\Pictures
[2012.08.21 00:21:27 | 000,000,000 | R--D | C] -- C:\Users\Admin\Music
[2012.08.21 00:21:27 | 000,000,000 | R--D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2012.08.21 00:21:27 | 000,000,000 | R--D | C] -- C:\Users\Admin\Links
[2012.08.21 00:21:27 | 000,000,000 | R--D | C] -- C:\Users\Admin\Favorites
[2012.08.21 00:21:27 | 000,000,000 | R--D | C] -- C:\Users\Admin\Downloads
[2012.08.21 00:21:27 | 000,000,000 | R--D | C] -- C:\Users\Admin\Documents
[2012.08.21 00:21:27 | 000,000,000 | R--D | C] -- C:\Users\Admin\Desktop
[2012.08.21 00:21:27 | 000,000,000 | R--D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2012.08.21 00:21:27 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Vorlagen
[2012.08.21 00:21:27 | 000,000,000 | -HSD | C] -- C:\Users\Admin\AppData\Local\Verlauf
[2012.08.21 00:21:27 | 000,000,000 | -HSD | C] -- C:\Users\Admin\AppData\Local\Temporary Internet Files
[2012.08.21 00:21:27 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Startmenü
[2012.08.21 00:21:27 | 000,000,000 | -HSD | C] -- C:\Users\Admin\SendTo
[2012.08.21 00:21:27 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Recent
[2012.08.21 00:21:27 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Netzwerkumgebung
[2012.08.21 00:21:27 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Lokale Einstellungen
[2012.08.21 00:21:27 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Documents\Eigene Videos
[2012.08.21 00:21:27 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Documents\Eigene Musik
[2012.08.21 00:21:27 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Eigene Dateien
[2012.08.21 00:21:27 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Documents\Eigene Bilder
[2012.08.21 00:21:27 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Druckumgebung
[2012.08.21 00:21:27 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Cookies
[2012.08.21 00:21:27 | 000,000,000 | -HSD | C] -- C:\Users\Admin\AppData\Local\Anwendungsdaten
[2012.08.21 00:21:27 | 000,000,000 | -HSD | C] -- C:\Users\Admin\Anwendungsdaten
[2012.08.21 00:21:27 | 000,000,000 | -H-D | C] -- C:\Users\Admin\AppData
[2012.08.21 00:21:27 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Temp
[2012.08.21 00:21:27 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Microsoft
[2012.08.21 00:21:27 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Media Center Programs
[2012.08.21 00:21:23 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen
[2012.08.21 00:21:23 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü
[2012.08.21 00:21:23 | 000,000,000 | -HSD | C] -- C:\Recovery
[2012.08.21 00:21:23 | 000,000,000 | -HSD | C] -- C:\Programme
[2012.08.21 00:21:23 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien
[2012.08.21 00:21:23 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten
[2012.08.21 00:21:23 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos
[2012.08.21 00:21:23 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik
[2012.08.21 00:21:23 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder
[2012.08.21 00:21:23 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen
[2012.08.21 00:21:23 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente
[2012.08.21 00:21:23 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten
[2012.08.21 00:21:20 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2012.08.21 00:18:03 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch
[2012.08.21 00:17:53 | 000,000,000 | -HSD | C] -- C:\System Volume Information
 
========== Files - Modified Within 30 Days ==========
 
[2012.09.07 04:00:26 | 000,000,000 | ---- | M] () -- C:\Users\Admin\defogger_reenable
[2012.09.07 03:44:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.09.06 19:53:21 | 000,021,072 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.09.06 19:53:21 | 000,021,072 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.09.06 19:52:20 | 001,498,332 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.09.06 19:52:20 | 000,654,166 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.09.06 19:52:20 | 000,616,008 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.09.06 19:52:20 | 000,130,006 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.09.06 19:52:20 | 000,106,388 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.09.06 19:46:11 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.09.06 19:46:08 | 4280,672,254 | -HS- | M] () -- C:\hiberfil.sys
[2012.09.05 00:05:52 | 000,001,857 | ---- | M] () -- C:\Users\Admin\Desktop\UseNeXT.lnk
[2012.09.04 23:13:37 | 014,662,576 | ---- | M] (Foxit Corporation                                           ) -- C:\Users\Admin\Desktop\FoxitReader531.0606_enu_Setup.exe
[2012.08.24 22:52:57 | 000,001,228 | ---- | M] () -- C:\Users\Public\Desktop\plist Editor for Windows.lnk
[2012.08.21 19:51:55 | 000,002,463 | ---- | M] () -- C:\Users\Admin\Desktop\Secret City.lnk
[2012.08.21 10:16:01 | 000,295,922 | ---- | M] () -- C:\Windows\SysNative\perfi007.dat
[2012.08.21 10:16:01 | 000,038,104 | ---- | M] () -- C:\Windows\SysNative\perfd007.dat
[2012.08.21 07:43:46 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2012.08.21 07:40:15 | 000,293,448 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.08.21 07:38:40 | 000,002,086 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
[2012.08.21 07:35:59 | 000,001,783 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012.08.21 07:21:08 | 000,001,234 | ---- | M] () -- C:\Users\Admin\Desktop\DriverMax.lnk
[2012.08.21 07:08:40 | 000,000,304 | ---- | M] () -- C:\user.js
[2012.08.21 04:31:34 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_SynTP_01009.Wdf
[2012.08.21 01:22:20 | 000,072,822 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf
[2012.08.21 01:22:20 | 000,072,822 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf
[2012.08.21 00:44:40 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2012.08.21 00:19:33 | 000,159,772 | ---- | M] () -- C:\Windows\SysWow64\license.rtf
[2012.08.21 00:19:33 | 000,159,772 | ---- | M] () -- C:\Windows\SysNative\license.rtf
 
========== Files Created - No Company Name ==========
 
[2012.09.07 04:00:26 | 000,000,000 | ---- | C] () -- C:\Users\Admin\defogger_reenable
[2012.09.05 00:05:52 | 000,001,857 | ---- | C] () -- C:\Users\Admin\Desktop\UseNeXT.lnk
[2012.09.03 19:24:56 | 000,023,552 | ---- | C] () -- C:\Windows\Installer\{5c5eea11-aaa1-99c9-2255-cb68e6cb1d7b}\U\800000cb.@
[2012.09.03 19:24:55 | 000,016,896 | ---- | C] () -- C:\Windows\Installer\{5c5eea11-aaa1-99c9-2255-cb68e6cb1d7b}\U\80000000.@
[2012.08.24 22:52:57 | 000,001,228 | ---- | C] () -- C:\Users\Public\Desktop\plist Editor for Windows.lnk
[2012.08.21 19:51:55 | 000,002,463 | ---- | C] () -- C:\Users\Admin\Desktop\Secret City.lnk
[2012.08.21 10:17:09 | 000,000,028 | RH-- | C] () -- C:\Windows\version
[2012.08.21 10:16:18 | 000,654,166 | ---- | C] () -- C:\Windows\SysNative\perfh007.dat
[2012.08.21 10:16:18 | 000,295,922 | ---- | C] () -- C:\Windows\SysNative\perfi007.dat
[2012.08.21 10:16:18 | 000,130,006 | ---- | C] () -- C:\Windows\SysNative\perfc007.dat
[2012.08.21 10:16:18 | 000,038,104 | ---- | C] () -- C:\Windows\SysNative\perfd007.dat
[2012.08.21 07:43:46 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
[2012.08.21 07:38:40 | 000,002,098 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
[2012.08.21 07:38:40 | 000,002,086 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
[2012.08.21 07:35:59 | 000,001,783 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012.08.21 07:35:36 | 000,002,519 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
[2012.08.21 07:21:08 | 000,001,234 | ---- | C] () -- C:\Users\Admin\Desktop\DriverMax.lnk
[2012.08.21 07:16:03 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.08.21 07:15:53 | 000,001,792 | ---- | C] () -- C:\Windows\Installer\{5c5eea11-aaa1-99c9-2255-cb68e6cb1d7b}\U\00000001.@
[2012.08.21 07:08:40 | 000,000,304 | ---- | C] () -- C:\user.js
[2012.08.21 04:38:03 | 000,007,621 | ---- | C] () -- C:\Windows\SysNative\nvinfo.pb
[2012.08.21 04:31:34 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_SynTP_01009.Wdf
[2012.08.21 04:28:21 | 000,008,192 | ---- | C] () -- C:\Windows\SysNative\drivers\IntelMEFWVer.dll
[2012.08.21 01:22:20 | 000,072,822 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf
[2012.08.21 01:22:20 | 000,072,822 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf
[2012.08.21 01:15:06 | 000,002,048 | -HS- | C] () -- C:\Windows\Installer\{5c5eea11-aaa1-99c9-2255-cb68e6cb1d7b}\@
[2012.08.21 01:15:06 | 000,002,048 | -HS- | C] () -- C:\Users\Admin\AppData\Local\{5c5eea11-aaa1-99c9-2255-cb68e6cb1d7b}\@
[2012.08.21 00:44:40 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2012.08.21 00:25:59 | 000,057,656 | ---- | C] () -- C:\Windows\SysNative\drivers\FilterPC.bmp
[2012.08.21 00:25:59 | 000,024,995 | ---- | C] () -- C:\Windows\SysNative\drivers\FilterPC.jpg
[2012.08.21 00:21:41 | 000,001,405 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
[2012.08.21 00:21:39 | 000,001,439 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2012.08.21 00:19:27 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[2012.08.21 00:19:25 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
[2012.08.21 00:17:53 | 4280,672,254 | -HS- | C] () -- C:\hiberfil.sys
[2011.11.01 22:39:16 | 000,059,904 | ---- | C] () -- C:\Windows\SysWow64\OpenVideo.dll
[2011.11.01 22:39:04 | 000,054,784 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll
 
========== LOP Check ==========
 
[2012.08.21 07:08:31 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Babylon
[2012.09.03 22:09:23 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\CadSoft
[2012.09.03 21:28:37 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Dropbox
[2012.08.21 07:04:20 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Easeware
[2012.08.21 04:42:34 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\PCDr
[2012.08.21 19:53:25 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\Utherverse
[2012.08.21 07:08:30 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\YourFileDownloader
[2009.07.14 07:08:49 | 000,005,670 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >
         
--- --- ---



[CODE]
OTL Logfile:
Code:
ATTFilter
OTL Extras logfile created on: 07.09.2012 04:01:24 - Run 1
OTL by OldTimer - Version 3.2.61.1     Folder = C:\Users\Sebastian\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
15,98 Gb Total Physical Memory | 13,91 Gb Available Physical Memory | 87,01% Memory free
31,96 Gb Paging File | 29,77 Gb Available in Paging File | 93,14% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 89,33 Gb Total Space | 24,31 Gb Free Space | 27,21% Space Free | Partition Type: NTFS
Drive D: | 298,05 Gb Total Space | 233,84 Gb Free Space | 78,46% Space Free | Partition Type: NTFS
 
Computer Name: ADMIN-PC | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0090A87C-3E0E-43D4-AA71-A71B06563A4A}" = AlienAutopsy
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1927E640-A2C6-4BA7-8F43-FFD2AE3DFCF3}" = Intel(R) PROSet/Wireless WiFi-Software
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{6A76BEAF-6D1F-4273-A79B-DA8410A2E56B}" = Apple Mobile Device Support
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{83BC740C-46AB-E0AD-4B2D-E11C84B472AC}" = AMD Catalyst Install Manager
"{840A3BAA-4C68-4581-9C7A-6F8D6CF531B9}" = iTunes
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 269.03
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 269.03
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 269.03
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller Driver 268.90
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.11.0621
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.2.23.3
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"AlienAutopsy" = AlienAutopsy
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"ProInst" = Intel PROSet Wireless
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WinRAR archiver" = WinRAR 4.20 (64-Bit)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{122ADF8C-DDA1-480C-9936-C88F2825B265}" = Apple Application Support
"{26AFAD40-2FF3-4C75-8903-8D403822C289}" = NVIDIA PhysX
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
"{4C552FD3-2CCD-4E00-AC64-0681DBB3F8B5}" = OpenOffice.org 3.4
"{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F722209B-739E-40E4-ADB1-062BD032A0DB}" = Personal ID
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Advanced Audio FX Engine" = Advanced Audio FX Engine
"Avira AntiVir Desktop" = Avira Free Antivirus
"DMX5_is1" = DriverMax 6
"EAGLE 6.2.0" = EAGLE 6.2.0
"Foxit Reader_is1" = Foxit Reader
"Integrated Webcam Live! Central" = Integrated Webcam Live! Central
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"Mozilla Thunderbird 14.0 (x86 de)" = Mozilla Thunderbird 14.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIA StereoUSB Driver" = NVIDIA 3D Vision Controller Driver
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"plist Editor for Windows" = plist Editor for Windows 1.0.2
"ResourceHacker_is1" = Resource Hacker Version 3.6.0
"Secret City" = Secret City
"UseNeXT_is1" = UseNeXT
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 05.09.2012 06:22:55 | Computer Name = Admin-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 999
 
Error - 05.09.2012 06:22:52 | Computer Name = Admin-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 05.09.2012 06:22:52 | Computer Name = Admin-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 2325
 
Error - 05.09.2012 06:22:52 | Computer Name = Admin-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 2325
 
Error - 05.09.2012 13:14:48 | Computer Name = Admin-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 05.09.2012 13:14:48 | Computer Name = Admin-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 24718499
 
Error - 05.09.2012 13:14:48 | Computer Name = Admin-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 24718499
 
Error - 06.09.2012 13:46:15 | Computer Name = Admin-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 06.09.2012 17:48:13 | Computer Name = Admin-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files
 (x86)\innovative solutions\drivermax\DPInst\ia64\dpinst.exe".  Die abhängige Assemblierung
 "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="ia64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 06.09.2012 21:47:18 | Computer Name = Admin-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: svchost.exe, Version: 6.1.7600.16385,
 Zeitstempel: 0x4a5bc3c1  Name des fehlerhaften Moduls: mshtml.dll, Version: 9.0.8112.16448,
 Zeitstempel: 0x4fed329d  Ausnahmecode: 0xc0000005  Fehleroffset: 0x000000000000d789
ID
 des fehlerhaften Prozesses: 0xb00  Startzeit der fehlerhaften Anwendung: 0x01cd8c9aa6cff7f7
Pfad
 der fehlerhaften Anwendung: C:\Windows\system32\svchost.exe  Pfad des fehlerhaften
 Moduls: C:\Windows\system32\mshtml.dll  Berichtskennung: f45d8597-f88d-11e1-a604-d0df9a41bd64
 
[ System Events ]
Error - 20.08.2012 18:31:03 | Computer Name = Admin-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
Error - 20.08.2012 19:05:24 | Computer Name = Admin-PC | Source = ACPI | ID = 327693
Description = : Der eingebettete Controller (EC) hat nicht innerhalb des angegebenen
 Zeitlimits reagiert. Dies deutet auf einen Fehler in der EC-Hardware oder -Firmware
 hin bzw. darauf, dass das BIOS auf falsche Art auf den EC zugreift. Fragen Sie 
den Computerhersteller nach einem aktualisierten BIOS. Dieser Fehler kann in einigen
 Situationen zur Folge haben, dass der Computer fehlerhaft läuft.
 
Error - 20.08.2012 19:39:56 | Computer Name = Admin-PC | Source = Service Control Manager | ID = 7023
Description = 
 
Error - 20.08.2012 19:42:54 | Computer Name = Admin-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
 Fehler 0x80242016 fehlgeschlagen: Sicherheitsupdate für Internet Explorer 8 unter
 Windows 7 für x64-basierte Systeme (KB2544521)
 
Error - 20.08.2012 19:42:54 | Computer Name = Admin-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
 Fehler 0x80242016 fehlgeschlagen: Update für die Kompatibilitätsansichtsliste für
 Internet Explorer*8 für Windows 7 für x64-basierte Systeme (KB2598845)
 
Error - 20.08.2012 20:10:28 | Computer Name = Admin-PC | Source = Service Control Manager | ID = 7023
Description = 
 
Error - 21.08.2012 01:15:52 | Computer Name = Admin-PC | Source = Service Control Manager | ID = 7023
Description = 
 
Error - 21.08.2012 21:50:52 | Computer Name = Admin-PC | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR3 gefunden.
 
Error - 21.08.2012 23:59:16 | Computer Name = Admin-PC | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR4 gefunden.
 
Error - 04.09.2012 17:57:34 | Computer Name = Admin-PC | Source = DCOM | ID = 10010
Description = 
 
 
< End of report >
         
--- --- ---
__________________

Alt 07.09.2012, 13:05   #4
Larusso
/// Selecta Jahrusso
 
tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg? - Standard

tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg?



Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.
__________________
mfg, Daniel

ASAP & UNITE Member
Alliance of Security Analysis Professionals
Unified Network of Instructors and Trusted Eliminators

Lerne, zurück zu schlagen und unterstütze uns!
TB Akademie

Alt 11.09.2012, 15:16   #5
Larusso
/// Selecta Jahrusso
 
tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg? - Standard

tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg?



Fehlende Rückmeldung
Dieses Thema wurde aus den Abos gelöscht. Somit bekomm ich keine Benachrichtigung über neue Antworten.
PM an mich falls Du denoch weiter machen willst.

Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner schon sauber ist.

Jeder andere bitte hier klicken und einen eigenen Thread erstellen

__________________
mfg, Daniel

ASAP & UNITE Member
Alliance of Security Analysis Professionals
Unified Network of Instructors and Trusted Eliminators

Lerne, zurück zu schlagen und unterstütze uns!
TB Akademie

Alt 11.09.2012, 21:02   #6
dalyay
 
tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg? - Standard

tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg?



Hallo,

hätte gerne früher geaantwortet, aber der PC hat sich nur noch im abgesicherten Modus sarten lassen. Nach Neustart ging das Fenster von ComboFix mehrmals auf und direkt wieder zu. Ich konnte nichts öffnen oder anklicken. Konnte den PC nur mit der Powertaste ausschalten. Ich bin dann irgendwann über den Adminaccount reingegangen in dem ich sonst nie bin.

Code:
ATTFilter
ComboFix 12-09-11.02 - Admin 11.09.2012  21:40:21.1.8 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.16366.14394 [GMT 2:00]
ausgeführt von:: c:\users\Sebastian\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Roaming
c:\windows\Installer\{5c5eea11-aaa1-99c9-2255-cb68e6cb1d7b}\@
c:\windows\Installer\{5c5eea11-aaa1-99c9-2255-cb68e6cb1d7b}\U\00000001.@
c:\windows\Installer\{5c5eea11-aaa1-99c9-2255-cb68e6cb1d7b}\U\80000000.@
c:\windows\Installer\{5c5eea11-aaa1-99c9-2255-cb68e6cb1d7b}\U\800000cb.@
.
Infizierte Kopie von c:\windows\system32\services.exe wurde gefunden und desinfiziert 
Kopie von - c:\windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe wurde wiederhergestellt 
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-08-11 bis 2012-09-11  ))))))))))))))))))))))))))))))
.
.
2012-09-11 19:43 . 2012-09-11 19:43	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-09-07 03:29 . 2012-09-07 03:29	--------	d-----w-	C:\totalcmd
2012-09-07 03:24 . 2012-09-07 03:24	--------	d-----w-	c:\program files (x86)\FileZilla FTP Client
2012-09-04 22:05 . 2012-09-04 22:05	--------	d-----w-	c:\program files (x86)\UseNeXT
2012-09-04 21:51 . 2012-09-04 21:51	--------	d-----w-	c:\program files\WinRAR
2012-09-04 21:14 . 2012-09-04 21:14	--------	d-----w-	c:\program files (x86)\Foxit Software
2012-09-03 20:09 . 2012-09-03 20:09	--------	d-----w-	c:\program files (x86)\EAGLE-6.2.0
2012-09-03 17:03 . 2012-09-03 17:03	--------	d-----w-	c:\programdata\Malwarebytes
2012-08-28 01:53 . 2012-08-28 01:53	--------	d-----w-	c:\program files (x86)\Resource Hacker
2012-08-24 20:52 . 2012-08-24 20:52	--------	d-----w-	c:\programdata\VOWSoft
2012-08-24 20:52 . 2012-08-24 20:52	--------	d-----w-	c:\program files (x86)\iPodRobot
2012-08-22 18:21 . 2012-08-22 18:21	--------	d-----w-	c:\programdata\Blizzard Entertainment
2012-08-21 17:54 . 2012-08-21 17:54	--------	d-----w-	c:\program files (x86)\coolspot AG
2012-08-21 17:46 . 2012-08-21 17:46	--------	d-----w-	c:\program files (x86)\SecretCity 3DChat
2012-08-21 17:46 . 2012-08-21 17:46	--------	d-----w-	c:\program files (x86)\Utherverse Digital Inc
2012-08-21 08:17 . 2012-08-20 22:21	--------	d-----w-	c:\windows\Panther
2012-08-21 08:17 . 2012-08-21 08:17	--------	d-----w-	C:\Hotfix
2012-08-21 08:17 . 2012-08-21 08:17	--------	d-----w-	C:\Drivers
2012-08-21 08:17 . 2012-08-20 22:20	--------	d-----w-	c:\windows\system32\OEM
2012-08-21 08:16 . 2012-08-21 08:16	--------	d-----w-	c:\windows\SysWow64\XPSViewer
2012-08-21 08:16 . 2012-08-21 08:16	--------	d-----w-	c:\windows\SysWow64\drivers\UMDF\de-DE
2012-08-21 08:16 . 2012-08-21 08:16	--------	d-----w-	c:\windows\SysWow64\drivers\de-DE
2012-08-21 08:16 . 2012-08-21 08:16	--------	d-----w-	c:\windows\SysWow64\de
2012-08-21 08:16 . 2012-08-21 08:16	--------	d-----w-	c:\windows\SysWow64\0407
2012-08-21 08:16 . 2012-08-21 08:16	--------	d-----w-	c:\windows\de-DE
2012-08-21 08:16 . 2012-08-20 23:38	--------	d-----w-	c:\windows\SysWow64\wbem\de-DE
2012-08-21 08:16 . 2012-08-21 08:16	--------	d-----w-	c:\windows\system32\drivers\UMDF\de-DE
2012-08-21 08:16 . 2012-08-21 08:16	--------	d-----w-	c:\windows\system32\drivers\de-DE
2012-08-21 08:16 . 2012-08-21 08:16	--------	d-----w-	c:\windows\system32\de
2012-08-21 08:16 . 2012-08-21 08:16	--------	d-----w-	c:\windows\system32\0407
2012-08-21 08:16 . 2012-08-20 23:38	--------	d-----w-	c:\windows\system32\wbem\de-DE
2012-08-21 08:14 . 2009-07-14 03:05	3584	----a-w-	c:\windows\system32\Spool\prtprocs\x64\de-DE\LXKPTPRC.DLL.mui
2012-08-21 05:46 . 2012-08-21 05:47	--------	d-----w-	c:\programdata\Battle.net
2012-08-21 05:42 . 2012-09-03 19:29	--------	d-----w-	c:\users\Sebastian
2012-08-21 05:38 . 2012-08-21 05:38	--------	d-----w-	c:\program files (x86)\Mozilla Thunderbird
2012-08-21 05:37 . 2012-08-21 05:37	--------	d-----w-	c:\program files (x86)\OpenOffice.org 3
2012-08-21 05:33 . 2012-08-21 05:40	--------	d-----w-	c:\program files (x86)\Mozilla Maintenance Service
2012-08-21 05:32 . 2012-07-18 16:04	27760	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2012-08-21 05:32 . 2012-07-18 16:04	132832	----a-w-	c:\windows\system32\drivers\avipbb.sys
2012-08-21 05:32 . 2012-07-18 16:04	98848	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2012-08-21 05:32 . 2012-08-21 05:32	--------	d-----w-	c:\programdata\Avira
2012-08-21 05:32 . 2012-08-21 05:32	--------	d-----w-	c:\program files (x86)\Avira
2012-08-21 05:21 . 2012-08-21 05:21	--------	d-----w-	c:\program files (x86)\Innovative Solutions
2012-08-21 05:19 . 2012-08-21 05:19	--------	d-sh--w-	c:\windows\system32\%APPDATA%
2012-08-21 05:16 . 2012-08-21 06:17	70344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-08-21 05:16 . 2012-08-21 06:17	426184	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2012-08-21 05:16 . 2012-08-21 05:16	--------	d-----w-	c:\windows\SysWow64\Macromed
2012-08-21 05:16 . 2012-08-21 05:16	--------	d-----w-	c:\windows\system32\Macromed
2012-08-21 04:51 . 2011-12-06 13:55	53248	----a-w-	c:\windows\SysWow64\CSVer.dll
2012-08-21 02:43 . 2012-08-21 02:43	--------	d-----w-	c:\programdata\PCDr
2012-08-21 02:43 . 2012-08-21 02:43	--------	d-----w-	c:\program files\AlienAutopsy
2012-08-21 02:39 . 2012-09-11 19:56	--------	d-----w-	c:\programdata\NVIDIA
2012-08-21 02:35 . 2012-08-21 05:35	--------	dc----w-	c:\windows\system32\DRVSTORE
2012-08-21 02:35 . 2010-08-20 09:05	21616	----a-w-	c:\windows\system32\drivers\stdcfltn.sys
2012-08-21 02:34 . 2012-08-21 02:34	--------	d-----w-	c:\program files\STMicroelectronics
2012-08-21 02:31 . 2012-08-21 02:31	--------	d-----w-	c:\program files\Synaptics
2012-08-21 02:31 . 2011-03-30 13:12	215336	----a-w-	c:\windows\system32\SynTPAPI.dll
2012-08-21 02:31 . 2011-03-30 13:12	1721576	----a-w-	c:\windows\system32\WdfCoInstaller01009.dll
2012-08-21 02:31 . 2011-03-30 13:12	148264	----a-w-	c:\windows\system32\SynTPCo4.dll
2012-08-21 02:31 . 2011-03-30 13:12	1395760	----a-w-	c:\windows\system32\drivers\SynTP.sys
2012-08-21 02:31 . 2011-03-30 13:12	107816	----a-w-	c:\windows\SysWow64\SynTPCOM.dll
2012-08-21 02:31 . 2011-03-30 13:12	400168	----a-w-	c:\windows\system32\SynCOM.dll
2012-08-21 02:31 . 2011-03-30 13:12	273704	----a-w-	c:\windows\system32\SynCtrl.dll
2012-08-21 02:31 . 2011-03-30 13:12	218408	----a-w-	c:\windows\SysWow64\SynCtrl.dll
2012-08-21 02:31 . 2011-03-30 13:12	173352	----a-w-	c:\windows\SysWow64\SynCOM.dll
2012-08-21 02:30 . 2011-03-03 15:23	81008	----a-w-	c:\windows\system32\accelernco01.dll
2012-08-21 02:30 . 2011-03-03 15:23	27760	----a-w-	c:\windows\system32\drivers\Accelern.sys
2012-08-21 02:28 . 2011-03-03 14:48	8192	----a-w-	c:\windows\system32\drivers\IntelMEFWVer.dll
2012-08-21 02:28 . 2012-08-21 02:28	--------	d-----w-	c:\program files (x86)\Common Files\postureAgent
2012-08-21 02:28 . 2012-08-21 04:51	--------	d-----w-	c:\program files (x86)\Intel
2012-08-21 02:27 . 2011-03-03 15:07	9888360	----a-w-	c:\windows\SysWow64\RtsPStorIcon.dll
2012-08-21 02:27 . 2011-03-03 15:07	335464	----a-w-	c:\windows\system32\drivers\RtsPStor.sys
2012-08-20 23:51 . 2011-02-19 12:05	1139200	----a-w-	c:\windows\system32\FntCache.dll
2012-08-20 23:51 . 2011-02-19 12:04	902656	----a-w-	c:\windows\system32\d2d1.dll
2012-08-20 23:51 . 2011-02-19 06:30	739840	----a-w-	c:\windows\SysWow64\d2d1.dll
2012-08-20 23:49 . 2012-05-04 11:00	366592	----a-w-	c:\windows\system32\qdvd.dll
2012-08-20 23:49 . 2012-05-04 09:59	514560	----a-w-	c:\windows\SysWow64\qdvd.dll
2012-08-20 23:43 . 2012-08-20 23:43	--------	d-----w-	c:\program files (x86)\Microsoft.NET
2012-08-20 23:30 . 2012-07-16 00:40	9133488	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{47679C7B-1F12-4896-8E81-30BF787E5E37}\mpengine.dll
2012-08-20 23:23 . 2010-02-23 08:16	294912	----a-w-	c:\windows\system32\browserchoice.exe
2012-08-20 23:18 . 2012-03-01 06:46	23408	----a-w-	c:\windows\system32\drivers\fs_rec.sys
2012-08-20 23:18 . 2012-03-01 06:38	220672	----a-w-	c:\windows\system32\wintrust.dll
2012-08-20 23:18 . 2012-03-01 06:33	81408	----a-w-	c:\windows\system32\imagehlp.dll
2012-08-20 23:18 . 2012-03-01 06:28	5120	----a-w-	c:\windows\system32\wmi.dll
2012-08-20 23:18 . 2012-03-01 05:37	172544	----a-w-	c:\windows\SysWow64\wintrust.dll
2012-08-20 23:18 . 2012-03-01 05:33	159232	----a-w-	c:\windows\SysWow64\imagehlp.dll
2012-08-20 23:18 . 2012-03-01 05:29	5120	----a-w-	c:\windows\SysWow64\wmi.dll
2012-08-20 23:17 . 2012-08-03 02:27	62134624	----a-w-	c:\windows\system32\MRT.exe
2012-08-20 23:15 . 2011-11-17 06:41	1731920	----a-w-	c:\windows\system32\ntdll.dll
2012-08-20 23:15 . 2011-11-17 05:38	1292080	----a-w-	c:\windows\SysWow64\ntdll.dll
2012-08-20 23:13 . 2011-11-19 14:58	77312	----a-w-	c:\windows\system32\packager.dll
2012-08-20 23:13 . 2011-11-19 14:01	67072	----a-w-	c:\windows\SysWow64\packager.dll
2012-08-20 23:10 . 2012-08-20 23:10	--------	d-----w-	c:\windows\SysWow64\Atheros_L1e
2012-08-20 23:10 . 2011-03-03 15:02	76912	----a-w-	c:\windows\system32\drivers\L1C62x64.sys
2012-08-20 23:08 . 2012-08-20 23:08	--------	d-----w-	c:\program files (x86)\AMD APP
2012-08-20 23:08 . 2012-08-20 23:08	--------	d-----w-	C:\Intel
2012-08-20 23:08 . 2012-08-20 23:08	--------	d-----w-	c:\program files\ATI
2012-08-20 23:08 . 2012-08-20 23:08	--------	d-----w-	c:\program files\ATI Technologies
2012-08-20 22:49 . 2012-02-17 06:38	1031680	----a-w-	c:\windows\system32\rdpcore.dll
2012-08-20 22:49 . 2012-02-17 05:34	826880	----a-w-	c:\windows\SysWow64\rdpcore.dll
2012-08-20 22:49 . 2012-02-17 04:57	23552	----a-w-	c:\windows\system32\drivers\tdtcp.sys
2012-08-20 22:47 . 2012-06-02 22:19	2428952	----a-w-	c:\windows\system32\wuaueng.dll
2012-08-20 22:47 . 2012-06-02 22:19	57880	----a-w-	c:\windows\system32\wuauclt.exe
2012-08-20 22:47 . 2012-06-02 22:19	44056	----a-w-	c:\windows\system32\wups2.dll
2012-08-20 22:47 . 2012-06-02 22:15	2622464	----a-w-	c:\windows\system32\wucltux.dll
2012-08-20 22:47 . 2012-06-02 22:19	38424	----a-w-	c:\windows\system32\wups.dll
2012-08-20 22:47 . 2012-06-02 22:19	701976	----a-w-	c:\windows\system32\wuapi.dll
2012-08-20 22:47 . 2012-06-02 22:15	99840	----a-w-	c:\windows\system32\wudriver.dll
2012-08-20 22:47 . 2012-06-02 13:19	186752	----a-w-	c:\windows\system32\wuwebv.dll
2012-08-20 22:47 . 2012-06-02 13:15	36864	----a-w-	c:\windows\system32\wuapp.exe
2012-08-20 22:46 . 2012-08-20 22:46	--------	d-----w-	c:\users\Public\Roaming
2012-08-20 22:46 . 2012-08-20 22:46	--------	d-----w-	c:\users\Default\Roaming
2012-08-20 22:45 . 2012-08-20 22:45	--------	d-----w-	c:\program files\Common Files\Intel
2012-08-20 22:45 . 2012-08-20 22:45	--------	d-----w-	c:\program files (x86)\Cisco
2012-08-20 22:45 . 2012-08-20 22:45	--------	d-----w-	c:\programdata\Intel
2012-08-20 22:45 . 2012-08-20 22:45	--------	d-----w-	c:\program files\Intel
2012-08-20 22:45 . 2012-09-07 03:32	--------	d-sh--w-	c:\windows\Installer
2012-08-20 22:44 . 2012-08-20 22:44	--------	d-----w-	C:\dell
2012-08-20 22:25 . 2012-08-20 22:25	--------	d-----w-	c:\program files (x86)\Creative
2012-08-20 22:24 . 2012-08-20 22:24	--------	d-----w-	c:\program files (x86)\Integrated Webcam
2012-08-20 22:24 . 2010-06-07 14:45	174848	----a-w-	c:\windows\system32\drivers\CtClsFlt.sys
2012-08-20 22:24 . 2009-05-28 08:49	224768	----a-w-	c:\windows\system32\drivers\CtAudDrv.sys
2012-08-20 22:24 . 2012-08-20 22:24	--------	d-----w-	c:\program files (x86)\Creative Live! Cam
2012-08-20 22:23 . 2012-08-21 02:38	--------	d--h--w-	c:\program files (x86)\InstallShield Installation Information
2012-08-20 22:23 . 2012-08-20 22:23	--------	d-----w-	c:\program files (x86)\Common Files\InstallShield
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DriverMax"="c:\program files (x86)\Innovative Solutions\DriverMax\drivermax.exe" [2012-07-31 11324352]
"Personal ID"="c:\progra~2\COOLSP~1\PERSON~1\PID.EXE" [2012-08-21 1132984]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Integrated Webcam Live! Central"="c:\program files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe" [2010-08-11 487561]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-07-18 348664]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-06-07 421776]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-03-03 2656280]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-21 250056]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2010-06-07 174848]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-07-14 113120]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2011-01-05 340240]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-04-25 52736]
S0 stdcfltn;Disk Class Filter Driver for Accelerometer;c:\windows\system32\DRIVERS\stdcfltn.sys [2010-08-20 21616]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2012-07-18 27760]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-07-18 86224]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-06-26 378472]
S3 Acceler;Accelerometer Service;c:\windows\system32\DRIVERS\Accelern.sys [2011-03-03 27760]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2011-03-03 76912]
S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]
S3 NETwNs64;___ Intel(R) Wireless WiFi Link der Serie 5000 Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [2011-01-04 8507392]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-09-30 80384]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-09-30 180736]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2011-07-05 174184]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys [2011-03-03 335464]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-09-11 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-21 06:17]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19	97792	----a-w-	c:\users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19	97792	----a-w-	c:\users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19	97792	----a-w-	c:\users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19	97792	----a-w-	c:\users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2011-01-05 1933584]
"NVHotkey"="c:\windows\system32\nvHotkey.dll" [2011-06-26 315496]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fdlo2jvk.default\
.
Supplementary scan did not complete!
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
Wow6432Node-HKCU-Run-DriverMax_RESTART - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-09-11  21:57:42 - PC wurde neu gestartet
.
Vor Suchlauf: 13 Verzeichnis(se), 25.722.769.408 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 27.402.240.000 Bytes frei
.
- - End Of File - - A4B70E3B952B44FC00FA2C1A41C936B1
         

Geändert von dalyay (11.09.2012 um 21:10 Uhr)

Alt 12.09.2012, 14:46   #7
Larusso
/// Selecta Jahrusso
 
tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg? - Standard

tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg?



Zitat:
c:\users\Sebastian\Downloads\ComboFix.exe
Zitat:
WICHTIG - Speichere Combofix auf deinem Desktop



Geht der Normalmodus wieder ?
__________________
mfg, Daniel

ASAP & UNITE Member
Alliance of Security Analysis Professionals
Unified Network of Instructors and Trusted Eliminators

Lerne, zurück zu schlagen und unterstütze uns!
TB Akademie

Alt 12.09.2012, 16:40   #8
dalyay
 
tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg? - Standard

tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg?



Ja, der normal modus geht wieder.

habe combofix jetzt nochmal vom Desktop ausgeführt.

Code:
ATTFilter
ComboFix 12-09-12.02 - Admin 12.09.2012  17:33:18.2.8 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.16366.14306 [GMT 2:00]
ausgeführt von:: c:\users\Sebastian\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-08-12 bis 2012-09-12  ))))))))))))))))))))))))))))))
.
.
2012-09-12 15:36 . 2012-09-12 15:36	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-09-11 20:23 . 2012-09-11 20:49	--------	d-----w-	c:\program files (x86)\Common Files\Blizzard Entertainment
2012-09-07 03:29 . 2012-09-07 03:29	--------	d-----w-	C:\totalcmd
2012-09-07 03:24 . 2012-09-07 03:24	--------	d-----w-	c:\program files (x86)\FileZilla FTP Client
2012-09-04 22:05 . 2012-09-04 22:05	--------	d-----w-	c:\program files (x86)\UseNeXT
2012-09-04 21:51 . 2012-09-04 21:51	--------	d-----w-	c:\program files\WinRAR
2012-09-04 21:14 . 2012-09-04 21:14	--------	d-----w-	c:\program files (x86)\Foxit Software
2012-09-03 20:09 . 2012-09-03 20:09	--------	d-----w-	c:\program files (x86)\EAGLE-6.2.0
2012-09-03 17:03 . 2012-09-03 17:03	--------	d-----w-	c:\programdata\Malwarebytes
2012-08-28 01:53 . 2012-08-28 01:53	--------	d-----w-	c:\program files (x86)\Resource Hacker
2012-08-24 20:52 . 2012-08-24 20:52	--------	d-----w-	c:\programdata\VOWSoft
2012-08-24 20:52 . 2012-08-24 20:52	--------	d-----w-	c:\program files (x86)\iPodRobot
2012-08-22 18:21 . 2012-08-22 18:21	--------	d-----w-	c:\programdata\Blizzard Entertainment
2012-08-21 17:54 . 2012-08-21 17:54	--------	d-----w-	c:\program files (x86)\coolspot AG
2012-08-21 17:46 . 2012-08-21 17:46	--------	d-----w-	c:\program files (x86)\SecretCity 3DChat
2012-08-21 17:46 . 2012-08-21 17:46	--------	d-----w-	c:\program files (x86)\Utherverse Digital Inc
2012-08-21 08:17 . 2012-08-20 22:21	--------	d-----w-	c:\windows\Panther
2012-08-21 08:17 . 2012-08-21 08:17	--------	d-----w-	C:\Hotfix
2012-08-21 08:17 . 2012-08-21 08:17	--------	d-----w-	C:\Drivers
2012-08-21 08:17 . 2012-08-20 22:20	--------	d-----w-	c:\windows\system32\OEM
2012-08-21 08:16 . 2012-08-21 08:16	--------	d-----w-	c:\windows\SysWow64\XPSViewer
2012-08-21 08:16 . 2012-08-21 08:16	--------	d-----w-	c:\windows\SysWow64\drivers\UMDF\de-DE
2012-08-21 08:16 . 2012-08-21 08:16	--------	d-----w-	c:\windows\SysWow64\drivers\de-DE
2012-08-21 08:16 . 2012-08-21 08:16	--------	d-----w-	c:\windows\SysWow64\de
2012-08-21 08:16 . 2012-08-21 08:16	--------	d-----w-	c:\windows\SysWow64\0407
2012-08-21 08:16 . 2012-08-21 08:16	--------	d-----w-	c:\windows\de-DE
2012-08-21 08:16 . 2012-08-20 23:38	--------	d-----w-	c:\windows\SysWow64\wbem\de-DE
2012-08-21 08:16 . 2012-08-21 08:16	--------	d-----w-	c:\windows\system32\drivers\UMDF\de-DE
2012-08-21 08:16 . 2012-08-21 08:16	--------	d-----w-	c:\windows\system32\drivers\de-DE
2012-08-21 08:16 . 2012-08-21 08:16	--------	d-----w-	c:\windows\system32\de
2012-08-21 08:16 . 2012-08-21 08:16	--------	d-----w-	c:\windows\system32\0407
2012-08-21 08:16 . 2012-08-20 23:38	--------	d-----w-	c:\windows\system32\wbem\de-DE
2012-08-21 08:14 . 2009-07-14 03:05	3584	----a-w-	c:\windows\system32\Spool\prtprocs\x64\de-DE\LXKPTPRC.DLL.mui
2012-08-21 05:46 . 2012-08-21 05:47	--------	d-----w-	c:\programdata\Battle.net
2012-08-21 05:42 . 2012-09-03 19:29	--------	d-----w-	c:\users\Sebastian
2012-08-21 05:38 . 2012-08-21 05:38	--------	d-----w-	c:\program files (x86)\Mozilla Thunderbird
2012-08-21 05:37 . 2012-08-21 05:37	--------	d-----w-	c:\program files (x86)\OpenOffice.org 3
2012-08-21 05:33 . 2012-08-21 05:40	--------	d-----w-	c:\program files (x86)\Mozilla Maintenance Service
2012-08-21 05:32 . 2012-07-18 16:04	27760	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2012-08-21 05:32 . 2012-07-18 16:04	132832	----a-w-	c:\windows\system32\drivers\avipbb.sys
2012-08-21 05:32 . 2012-07-18 16:04	98848	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2012-08-21 05:32 . 2012-08-21 05:32	--------	d-----w-	c:\programdata\Avira
2012-08-21 05:32 . 2012-08-21 05:32	--------	d-----w-	c:\program files (x86)\Avira
2012-08-21 05:21 . 2012-08-21 05:21	--------	d-----w-	c:\program files (x86)\Innovative Solutions
2012-08-21 05:19 . 2012-08-21 05:19	--------	d-sh--w-	c:\windows\system32\%APPDATA%
2012-08-21 05:16 . 2012-08-21 06:17	70344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-08-21 05:16 . 2012-08-21 06:17	426184	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2012-08-21 05:16 . 2012-08-21 05:16	--------	d-----w-	c:\windows\SysWow64\Macromed
2012-08-21 05:16 . 2012-08-21 05:16	--------	d-----w-	c:\windows\system32\Macromed
2012-08-21 04:51 . 2011-12-06 13:55	53248	----a-w-	c:\windows\SysWow64\CSVer.dll
2012-08-21 02:43 . 2012-08-21 02:43	--------	d-----w-	c:\programdata\PCDr
2012-08-21 02:43 . 2012-08-21 02:43	--------	d-----w-	c:\program files\AlienAutopsy
2012-08-21 02:39 . 2012-09-12 15:29	--------	d-----w-	c:\programdata\NVIDIA
2012-08-21 02:35 . 2012-08-21 05:35	--------	dc----w-	c:\windows\system32\DRVSTORE
2012-08-21 02:35 . 2010-08-20 09:05	21616	----a-w-	c:\windows\system32\drivers\stdcfltn.sys
2012-08-21 02:34 . 2012-08-21 02:34	--------	d-----w-	c:\program files\STMicroelectronics
2012-08-21 02:31 . 2012-08-21 02:31	--------	d-----w-	c:\program files\Synaptics
2012-08-21 02:31 . 2011-03-30 13:12	215336	----a-w-	c:\windows\system32\SynTPAPI.dll
2012-08-21 02:31 . 2011-03-30 13:12	1721576	----a-w-	c:\windows\system32\WdfCoInstaller01009.dll
2012-08-21 02:31 . 2011-03-30 13:12	148264	----a-w-	c:\windows\system32\SynTPCo4.dll
2012-08-21 02:31 . 2011-03-30 13:12	1395760	----a-w-	c:\windows\system32\drivers\SynTP.sys
2012-08-21 02:31 . 2011-03-30 13:12	107816	----a-w-	c:\windows\SysWow64\SynTPCOM.dll
2012-08-21 02:31 . 2011-03-30 13:12	400168	----a-w-	c:\windows\system32\SynCOM.dll
2012-08-21 02:31 . 2011-03-30 13:12	273704	----a-w-	c:\windows\system32\SynCtrl.dll
2012-08-21 02:31 . 2011-03-30 13:12	218408	----a-w-	c:\windows\SysWow64\SynCtrl.dll
2012-08-21 02:31 . 2011-03-30 13:12	173352	----a-w-	c:\windows\SysWow64\SynCOM.dll
2012-08-21 02:30 . 2011-03-03 15:23	81008	----a-w-	c:\windows\system32\accelernco01.dll
2012-08-21 02:30 . 2011-03-03 15:23	27760	----a-w-	c:\windows\system32\drivers\Accelern.sys
2012-08-21 02:28 . 2011-03-03 14:48	8192	----a-w-	c:\windows\system32\drivers\IntelMEFWVer.dll
2012-08-21 02:28 . 2012-08-21 02:28	--------	d-----w-	c:\program files (x86)\Common Files\postureAgent
2012-08-21 02:28 . 2012-08-21 04:51	--------	d-----w-	c:\program files (x86)\Intel
2012-08-21 02:27 . 2011-03-03 15:07	9888360	----a-w-	c:\windows\SysWow64\RtsPStorIcon.dll
2012-08-21 02:27 . 2011-03-03 15:07	335464	----a-w-	c:\windows\system32\drivers\RtsPStor.sys
2012-08-20 23:51 . 2011-02-19 12:05	1139200	----a-w-	c:\windows\system32\FntCache.dll
2012-08-20 23:51 . 2011-02-19 12:04	902656	----a-w-	c:\windows\system32\d2d1.dll
2012-08-20 23:51 . 2011-02-19 06:30	739840	----a-w-	c:\windows\SysWow64\d2d1.dll
2012-08-20 23:49 . 2012-05-04 11:00	366592	----a-w-	c:\windows\system32\qdvd.dll
2012-08-20 23:49 . 2012-05-04 09:59	514560	----a-w-	c:\windows\SysWow64\qdvd.dll
2012-08-20 23:43 . 2012-08-20 23:43	--------	d-----w-	c:\program files (x86)\Microsoft.NET
2012-08-20 23:30 . 2012-07-16 00:40	9133488	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{47679C7B-1F12-4896-8E81-30BF787E5E37}\mpengine.dll
2012-08-20 23:23 . 2010-02-23 08:16	294912	----a-w-	c:\windows\system32\browserchoice.exe
2012-08-20 23:18 . 2012-03-01 06:46	23408	----a-w-	c:\windows\system32\drivers\fs_rec.sys
2012-08-20 23:18 . 2012-03-01 06:38	220672	----a-w-	c:\windows\system32\wintrust.dll
2012-08-20 23:18 . 2012-03-01 06:33	81408	----a-w-	c:\windows\system32\imagehlp.dll
2012-08-20 23:18 . 2012-03-01 06:28	5120	----a-w-	c:\windows\system32\wmi.dll
2012-08-20 23:18 . 2012-03-01 05:37	172544	----a-w-	c:\windows\SysWow64\wintrust.dll
2012-08-20 23:18 . 2012-03-01 05:33	159232	----a-w-	c:\windows\SysWow64\imagehlp.dll
2012-08-20 23:18 . 2012-03-01 05:29	5120	----a-w-	c:\windows\SysWow64\wmi.dll
2012-08-20 23:17 . 2012-08-03 02:27	62134624	----a-w-	c:\windows\system32\MRT.exe
2012-08-20 23:15 . 2011-11-17 06:41	1731920	----a-w-	c:\windows\system32\ntdll.dll
2012-08-20 23:15 . 2011-11-17 05:38	1292080	----a-w-	c:\windows\SysWow64\ntdll.dll
2012-08-20 23:13 . 2011-11-19 14:58	77312	----a-w-	c:\windows\system32\packager.dll
2012-08-20 23:13 . 2011-11-19 14:01	67072	----a-w-	c:\windows\SysWow64\packager.dll
2012-08-20 23:10 . 2012-08-20 23:10	--------	d-----w-	c:\windows\SysWow64\Atheros_L1e
2012-08-20 23:10 . 2011-03-03 15:02	76912	----a-w-	c:\windows\system32\drivers\L1C62x64.sys
2012-08-20 23:08 . 2012-08-20 23:08	--------	d-----w-	c:\program files (x86)\AMD APP
2012-08-20 23:08 . 2012-08-20 23:08	--------	d-----w-	C:\Intel
2012-08-20 23:08 . 2012-08-20 23:08	--------	d-----w-	c:\program files\ATI
2012-08-20 23:08 . 2012-08-20 23:08	--------	d-----w-	c:\program files\ATI Technologies
2012-08-20 22:49 . 2012-02-17 06:38	1031680	----a-w-	c:\windows\system32\rdpcore.dll
2012-08-20 22:49 . 2012-02-17 05:34	826880	----a-w-	c:\windows\SysWow64\rdpcore.dll
2012-08-20 22:49 . 2012-02-17 04:57	23552	----a-w-	c:\windows\system32\drivers\tdtcp.sys
2012-08-20 22:47 . 2012-06-02 22:19	2428952	----a-w-	c:\windows\system32\wuaueng.dll
2012-08-20 22:47 . 2012-06-02 22:19	57880	----a-w-	c:\windows\system32\wuauclt.exe
2012-08-20 22:47 . 2012-06-02 22:19	44056	----a-w-	c:\windows\system32\wups2.dll
2012-08-20 22:47 . 2012-06-02 22:15	2622464	----a-w-	c:\windows\system32\wucltux.dll
2012-08-20 22:47 . 2012-06-02 22:19	38424	----a-w-	c:\windows\system32\wups.dll
2012-08-20 22:47 . 2012-06-02 22:19	701976	----a-w-	c:\windows\system32\wuapi.dll
2012-08-20 22:47 . 2012-06-02 22:15	99840	----a-w-	c:\windows\system32\wudriver.dll
2012-08-20 22:47 . 2012-06-02 13:19	186752	----a-w-	c:\windows\system32\wuwebv.dll
2012-08-20 22:47 . 2012-06-02 13:15	36864	----a-w-	c:\windows\system32\wuapp.exe
2012-08-20 22:46 . 2012-08-20 22:46	--------	d-----w-	c:\users\Public\Roaming
2012-08-20 22:46 . 2012-08-20 22:46	--------	d-----w-	c:\users\Default\Roaming
2012-08-20 22:45 . 2012-08-20 22:45	--------	d-----w-	c:\program files\Common Files\Intel
2012-08-20 22:45 . 2012-08-20 22:45	--------	d-----w-	c:\program files (x86)\Cisco
2012-08-20 22:45 . 2012-08-20 22:45	--------	d-----w-	c:\programdata\Intel
2012-08-20 22:45 . 2012-08-20 22:45	--------	d-----w-	c:\program files\Intel
2012-08-20 22:45 . 2012-09-07 03:32	--------	d-sh--w-	c:\windows\Installer
2012-08-20 22:44 . 2012-08-20 22:44	--------	d-----w-	C:\dell
2012-08-20 22:25 . 2012-08-20 22:25	--------	d-----w-	c:\program files (x86)\Creative
2012-08-20 22:24 . 2012-08-20 22:24	--------	d-----w-	c:\program files (x86)\Integrated Webcam
2012-08-20 22:24 . 2010-06-07 14:45	174848	----a-w-	c:\windows\system32\drivers\CtClsFlt.sys
2012-08-20 22:24 . 2009-05-28 08:49	224768	----a-w-	c:\windows\system32\drivers\CtAudDrv.sys
2012-08-20 22:24 . 2012-08-20 22:24	--------	d-----w-	c:\program files (x86)\Creative Live! Cam
2012-08-20 22:23 . 2012-08-21 02:38	--------	d--h--w-	c:\program files (x86)\InstallShield Installation Information
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DriverMax"="c:\program files (x86)\Innovative Solutions\DriverMax\drivermax.exe" [2012-07-31 11324352]
"Personal ID"="c:\progra~2\COOLSP~1\PERSON~1\PID.EXE" [2012-08-21 1132984]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Integrated Webcam Live! Central"="c:\program files (x86)\Integrated Webcam\Live! Central\WebcamInt.exe" [2010-08-11 487561]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-07-18 348664]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-06-07 421776]
.
c:\users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Admin\AppData\Roaming\Dropbox\bin\Dropbox.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-21 250056]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2010-06-07 174848]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-07-14 113120]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2011-01-05 340240]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-04-25 52736]
S0 stdcfltn;Disk Class Filter Driver for Accelerometer;c:\windows\system32\DRIVERS\stdcfltn.sys [2010-08-20 21616]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2012-07-18 27760]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-07-18 86224]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-06-26 378472]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-03-03 2656280]
S3 Acceler;Accelerometer Service;c:\windows\system32\DRIVERS\Accelern.sys [2011-03-03 27760]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2011-03-03 76912]
S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]
S3 NETwNs64;___ Intel(R) Wireless WiFi Link der Serie 5000 Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [2011-01-04 8507392]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-09-30 80384]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-09-30 180736]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2011-07-05 174184]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys [2011-03-03 335464]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-09-12 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-21 06:17]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19	97792	----a-w-	c:\users\Sebastian\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2011-01-05 1933584]
"NVHotkey"="c:\windows\system32\nvHotkey.dll" [2011-06-26 315496]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"*WerKernelReporting"="c:\windows\SYSTEM32\WerFault.exe" [2009-07-14 415232]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fdlo2jvk.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-09-12  17:37:28
ComboFix-quarantined-files.txt  2012-09-12 15:37
ComboFix2.txt  2012-09-11 19:57
.
Vor Suchlauf: 13 Verzeichnis(se), 33.580.015.616 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 33.153.294.336 Bytes frei
.
- - End Of File - - 87FFA5CD75DA4419DFB7454E8DCD866C
         

Alt 12.09.2012, 21:00   #9
Larusso
/// Selecta Jahrusso
 
tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg? - Standard

tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg?



Downloade dir bitte Farbar's Service Scanner
Gehe sicher, dass folgende Optionen angehakt sind.
  • Internet Services
  • Windows Firewall
  • System Restore
  • Security Center/Action Center
  • Windows Update
  • Windows Defender
  • Other Services
[*] Klicke auf Scan.
  • Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.
Poste bitte den Inhalt hier.
__________________
mfg, Daniel

ASAP & UNITE Member
Alliance of Security Analysis Professionals
Unified Network of Instructors and Trusted Eliminators

Lerne, zurück zu schlagen und unterstütze uns!
TB Akademie

Alt 12.09.2012, 23:37   #10
dalyay
 
tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg? - Standard

tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg?



Code:
ATTFilter
Farbar Service Scanner Version: 06-08-2012
Ran by Sebastian (ATTENTION: The logged in user is not administrator) on 13-09-2012 at 00:35:20
Running from "C:\Users\Sebastian\Desktop"
Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============
Dnscache Service is not running. Checking service configuration:
The start type of Dnscache service is OK.
The ImagePath of Dnscache service is OK.
The ServiceDll of Dnscache service is OK.

Dhcp Service is not running. Checking service configuration:
The start type of Dhcp service is OK.
The ImagePath of Dhcp service is OK.
The ServiceDll of Dhcp service is OK.

Nsi Service is not running. Checking service configuration:
The start type of Nsi service is OK.
The ImagePath of Nsi service is OK.
Checking ServiceDll: ATTENTION!=====> Unable to open Nsi registry key. The service key does not exist.

nsiproxy Service is not running. Checking service configuration:
The start type of nsiproxy service is OK.
The ImagePath of nsiproxy service is OK.

tdx Service is not running. Checking service configuration:
The start type of tdx service is OK.
The ImagePath of tdx service is OK.

afd Service is not running. Checking service configuration:
The start type of afd service is OK.
The ImagePath of afd service is OK.

Tcpip Service is not running. Checking service configuration:
The start type of Tcpip service is OK.
The ImagePath of Tcpip service is OK.


Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============
mpsdrv Service is not running. Checking service configuration:
The start type of mpsdrv service is OK.
The ImagePath of mpsdrv service is OK.

MpsSvc Service is not running. Checking service configuration:
The start type of MpsSvc service is OK.
The ImagePath of MpsSvc service is OK.
The ServiceDll of MpsSvc service is OK.

bfe Service is not running. Checking service configuration:
The start type of bfe service is OK.
The ImagePath of bfe service is OK.
The ServiceDll of bfe service is OK.


Firewall Disabled Policy: 
==================


System Restore:
============
SDRSVC Service is not running. Checking service configuration:
The start type of SDRSVC service is OK.
The ImagePath of SDRSVC service is OK.
The ServiceDll of SDRSVC service is OK.

VSS Service is not running. Checking service configuration:
The start type of VSS service is OK.
The ImagePath of VSS service is OK.


System Restore Disabled Policy: 
========================


Action Center:
============
wscsvc Service is not running. Checking service configuration:
The start type of wscsvc service is OK.
The ImagePath of wscsvc service is OK.
The ServiceDll of wscsvc service is OK.

winmgmt Service is not running. Checking service configuration:
The start type of winmgmt service is OK.
The ImagePath of winmgmt: "%systemroot%\system32\svchost.exe -k netsvcs".
The ServiceDll of winmgmt service is OK.


Windows Update:
============
wuauserv Service is not running. Checking service configuration:
The start type of wuauserv service is OK.
The ImagePath of wuauserv service is OK.
The ServiceDll of wuauserv service is OK.

BITS Service is not running. Checking service configuration:
The start type of BITS service is set to Demand. The default start type is Auto.
The ImagePath of BITS service is OK.
The ServiceDll of BITS service is OK.

EventSystem Service is not running. Checking service configuration:
The start type of EventSystem service is OK.
The ImagePath of EventSystem service is OK.
The ServiceDll of EventSystem service is OK.

cryptsvc Service is not running. Checking service configuration:
The start type of cryptsvc service is OK.
The ImagePath of cryptsvc service is OK.
The ServiceDll of cryptsvc service is OK.


Windows Autoupdate Disabled Policy: 
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is OK.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.

PlugPlay Service is not running. Checking service configuration:
The start type of PlugPlay service is OK.
The ImagePath of PlugPlay service is OK.


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****
         

Alt 13.09.2012, 14:30   #11
Larusso
/// Selecta Jahrusso
 
tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg? - Standard

tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg?



Downloade dir bitte ServiceRepair.exe auf deinem Desktop.
Doppelklick auf die Datei und bestätige die ersten Nachricht mit Yes.
Das Tool wird einen Neustart verlangen, dies bitte zulassen.



Bitte lass FSS.exe erneut wie vorher laufen und poste die FSS.txt hier
__________________
mfg, Daniel

ASAP & UNITE Member
Alliance of Security Analysis Professionals
Unified Network of Instructors and Trusted Eliminators

Lerne, zurück zu schlagen und unterstütze uns!
TB Akademie

Alt 13.09.2012, 19:46   #12
dalyay
 
tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg? - Standard

tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg?



Code:
ATTFilter
Farbar Service Scanner Version: 06-08-2012
Ran by Sebastian (ATTENTION: The logged in user is not administrator) on 13-09-2012 at 20:40:55
Running from "C:\Users\Sebastian\Desktop"
Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============
Dnscache Service is not running. Checking service configuration:
The start type of Dnscache service is OK.
The ImagePath of Dnscache service is OK.
The ServiceDll of Dnscache service is OK.

Dhcp Service is not running. Checking service configuration:
The start type of Dhcp service is OK.
The ImagePath of Dhcp service is OK.
The ServiceDll of Dhcp service is OK.

Nsi Service is not running. Checking service configuration:
The start type of Nsi service is OK.
The ImagePath of Nsi service is OK.
Checking ServiceDll: ATTENTION!=====> Unable to open Nsi registry key. The service key does not exist.

nsiproxy Service is not running. Checking service configuration:
The start type of nsiproxy service is OK.
The ImagePath of nsiproxy service is OK.

tdx Service is not running. Checking service configuration:
The start type of tdx service is OK.
The ImagePath of tdx service is OK.

afd Service is not running. Checking service configuration:
The start type of afd service is OK.
The ImagePath of afd service is OK.

Tcpip Service is not running. Checking service configuration:
The start type of Tcpip service is OK.
The ImagePath of Tcpip service is OK.


Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============
mpsdrv Service is not running. Checking service configuration:
The start type of mpsdrv service is OK.
The ImagePath of mpsdrv service is OK.

MpsSvc Service is not running. Checking service configuration:
The start type of MpsSvc service is OK.
The ImagePath of MpsSvc service is OK.
The ServiceDll of MpsSvc service is OK.

bfe Service is not running. Checking service configuration:
The start type of bfe service is OK.
The ImagePath of bfe service is OK.
The ServiceDll of bfe service is OK.


Firewall Disabled Policy: 
==================


System Restore:
============
SDRSVC Service is not running. Checking service configuration:
The start type of SDRSVC service is OK.
The ImagePath of SDRSVC service is OK.
The ServiceDll of SDRSVC service is OK.

VSS Service is not running. Checking service configuration:
The start type of VSS service is OK.
The ImagePath of VSS service is OK.


System Restore Disabled Policy: 
========================


Action Center:
============
wscsvc Service is not running. Checking service configuration:
The start type of wscsvc service is OK.
The ImagePath of wscsvc service is OK.
The ServiceDll of wscsvc service is OK.

winmgmt Service is not running. Checking service configuration:
The start type of winmgmt service is OK.
The ImagePath of winmgmt: "%systemroot%\system32\svchost.exe -k netsvcs".
The ServiceDll of winmgmt service is OK.


Windows Update:
============
wuauserv Service is not running. Checking service configuration:
The start type of wuauserv service is OK.
The ImagePath of wuauserv service is OK.
The ServiceDll of wuauserv service is OK.

BITS Service is not running. Checking service configuration:
The start type of BITS service is set to Demand. The default start type is Auto.
The ImagePath of BITS service is OK.
The ServiceDll of BITS service is OK.

EventSystem Service is not running. Checking service configuration:
The start type of EventSystem service is OK.
The ImagePath of EventSystem service is OK.
The ServiceDll of EventSystem service is OK.

cryptsvc Service is not running. Checking service configuration:
The start type of cryptsvc service is OK.
The ImagePath of cryptsvc service is OK.
The ServiceDll of cryptsvc service is OK.


Windows Autoupdate Disabled Policy: 
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is OK.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.

PlugPlay Service is not running. Checking service configuration:
The start type of PlugPlay service is OK.
The ImagePath of PlugPlay service is OK.


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys
[2012-09-12 21:14] - [2012-08-22 20:12] - 1913200 ____A (Microsoft Corporation) F782CAD3CEDBB3F9FFE3BF2775D92DDC

C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****
         

Code:
ATTFilter
Log Opened: 2012-09-13 @ 20:41:13
20:41:13 - -----------------
20:41:13 - | Begin Logging |
20:41:13 - -----------------
20:41:13 - Fix started on a WIN_7 X64 computer
20:41:13 - Prep in progress.  Please Wait.
20:41:14 - Prep complete
20:41:14 - Repairing Services Now.  Please wait...
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Win7\BFE.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent\SubLayer>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent\Provider>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent\Filter>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\BootTime\Filter>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\BootTime>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Win7\BITS.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS\Security>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS\Performance>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Win7\iphlpsvc.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Teredo>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters\Teredo\{FA88062C-9A61-4C1E-AC45-7143F8F01AAD}>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters\Teredo>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters\Isatap\{8AD2FB26-F91E-44F1-9B24-3C0AE56C9CE0}>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters\Isatap>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters\IPHTTPS>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Interfaces>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\config>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Win7\MpsSvc.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Security>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords\Teredo>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords\RPC-EPMap>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords\IPTLSOut>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords\IPTLSIn>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords\DHCP>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Win7\SharedAccess.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\GloballyOpenPorts>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\AuthorizedApplications>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Epoch2>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Epoch>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\StandardProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\StandardProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\PublicProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\PublicProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\FirewallRules>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\DomainProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\DomainProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Win7\WinDefend.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend\TriggerInfo\0>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend\TriggerInfo>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend\Security>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Win7\wscsvc.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wscsvc\Security>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wscsvc\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wscsvc>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Win7\wuauserv.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wuauserv\Security>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wuauserv\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wuauserv>

SetACL finished successfully.
20:41:14 - Services Repair Complete.
20:41:48 - Reboot Initiated
         

Geändert von dalyay (13.09.2012 um 19:54 Uhr)

Alt 16.09.2012, 16:39   #13
Larusso
/// Selecta Jahrusso
 
tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg? - Standard

tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg?



Hy und sorry für die Verzögerung.


Starte bitte die FSS.exe erneut.
Gib bitte folgendes in die Search: Textbox ein

nsi

und klicke auf Export Service.
Poste bitte die FSS.txt in deiner nächsten Antwort.
__________________
mfg, Daniel

ASAP & UNITE Member
Alliance of Security Analysis Professionals
Unified Network of Instructors and Trusted Eliminators

Lerne, zurück zu schlagen und unterstütze uns!
TB Akademie

Alt 17.09.2012, 17:51   #14
dalyay
 
tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg? - Standard

tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg?



Code:
ATTFilter
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\services\nsi]
"DisplayName"="@%SystemRoot%\\system32\\nsisvc.dll,-200"
"ImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,\
  74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
  00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
  6b,00,20,00,4c,00,6f,00,63,00,61,00,6c,00,53,00,65,00,72,00,76,00,69,00,63,\
  00,65,00,00,00
"Description"="@%SystemRoot%\\system32\\nsisvc.dll,-201"
"ObjectName"="NT Authority\\LocalService"
"ErrorControl"=dword:00000001
"Start"=dword:00000002
"Type"=dword:00000020
"DependOnService"=hex(7):6e,00,73,00,69,00,70,00,72,00,6f,00,78,00,79,00,00,00,\
  00,00
"ServiceSidType"=dword:00000001
"RequiredPrivileges"=hex(7):53,00,65,00,43,00,72,00,65,00,61,00,74,00,65,00,47,\
  00,6c,00,6f,00,62,00,61,00,6c,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,\
  67,00,65,00,00,00,53,00,65,00,49,00,6d,00,70,00,65,00,72,00,73,00,6f,00,6e,\
  00,61,00,74,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,\
  00,00,00,00
"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\
  00,01,00,00,00,c0,d4,01,00,01,00,00,00,e0,93,04,00,00,00,00,00,00,00,00,00
         

Alt 17.09.2012, 18:15   #15
Larusso
/// Selecta Jahrusso
 
tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg? - Standard

tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg?



Downloade dir bitte folgende Datei auf deinem Desktop.

http://download.bleepingcomputer.com...ices/7/nsi.reg


Doppelklick darauf und erlaube die Änderungen in der Registry.
Starte den Rechner neu auf.


Erstelle bitte eine neue FSS.txt wie zuvor und poste diese hier.
__________________
mfg, Daniel

ASAP & UNITE Member
Alliance of Security Analysis Professionals
Unified Network of Instructors and Trusted Eliminators

Lerne, zurück zu schlagen und unterstütze uns!
TB Akademie

Antwort

Themen zu tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg?
action, anti-malware, antivir, code, detected, disabled, explorer, file, hoffe, installer, kleines, limited, log, malicious, malwarebytes, namen, quarantäne, quick, registry, service, startup, system, tr/atraps.gen, version, weiteres



Ähnliche Themen: tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg?


  1. Trojaner TR/Sirefef.BC.57, TR/Sirefef.AG.9, TR/ATRAPS.Gen2, TR/Necurs.A.71 und SpyHunter 4 auf Rechner
    Log-Analyse und Auswertung - 07.05.2013 (7)
  2. Avira findet TR/Sirefef.16896 und TR/ATRAPS.Gen und TR/ATRAPS.Gen2 in Windows\Installer und W32/Patched.UA in Windows\System32\service.exe
    Plagegeister aller Art und deren Bekämpfung - 14.11.2012 (23)
  3. Antivir schickt Viren (TR/ATRAPS.Gen2 + TR/Sirefef.W.16896) in Quarantäne
    Plagegeister aller Art und deren Bekämpfung - 21.10.2012 (60)
  4. TR/Sirefef.16896 und TR/ATRAPS.Gen2 im Papierkorb-Verzeichnis (Win7 x64)
    Plagegeister aller Art und deren Bekämpfung - 23.09.2012 (5)
  5. TR/ATRAPS.Gen2 und TR/Sirefef.W.16896 in C:\$Recycle.Bin\S-1-5-18\......
    Plagegeister aller Art und deren Bekämpfung - 19.09.2012 (3)
  6. TR/Sirefef.16896 und TR/ATRAPS.Gen2 auf Laptop gefunden
    Plagegeister aller Art und deren Bekämpfung - 14.09.2012 (33)
  7. TR/ATRAPS.Gen2 und TR/Sirefef.16896 lässt sich nicht entfernen
    Log-Analyse und Auswertung - 06.09.2012 (33)
  8. TR/ATRAPS.Gen2, TR/Sirefef.16896 (in C:\Windows\Installer\...) und W32/Patched.UA (C:\Windows\System32\services.exe)
    Plagegeister aller Art und deren Bekämpfung - 04.09.2012 (5)
  9. Trojaner geangelt TR/ATRAPS.Gen2 TR/Sirefef.16896
    Plagegeister aller Art und deren Bekämpfung - 30.08.2012 (38)
  10. multipler Befall: ATRAPS.Gen2, Sirefef.16896, BDS/ZeroAccess
    Log-Analyse und Auswertung - 29.08.2012 (13)
  11. TR/Winwebsec.AJ.14;BDS/ZAccess.W;EXP/JAVA.Teqwari.gen;TR/Agent.2049;TR/ATRAPS.gen2 und TR/sirefef.16896 von AVIRA gefunden
    Log-Analyse und Auswertung - 21.08.2012 (12)
  12. Trojaner TR/ATRAPS.Gen2 und TR/Sirefef.16896 lassen sich nicht entfernen
    Plagegeister aller Art und deren Bekämpfung - 20.08.2012 (5)
  13. Avira: Wiederholte Warnung zu TR/ATRAPS.Gen2 und TR/Sirefef.16896
    Log-Analyse und Auswertung - 15.08.2012 (1)
  14. TR/Sirefef.16896 und TR/ATRAPS.Gen2 wurden gefunden.
    Plagegeister aller Art und deren Bekämpfung - 15.08.2012 (1)
  15. Trojaner Atraps.Gen, Atraps.Gen2 und Sirefef.AB.20 - gelöscht, aber auch sicher?
    Log-Analyse und Auswertung - 14.07.2012 (23)
  16. TR/ATRAPS.GEN, TR/ATRAPS.Gen2 6 seit ein paar Minuten auch noch ein Sirefef.P.528
    Plagegeister aller Art und deren Bekämpfung - 13.07.2012 (1)
  17. Antivir findet 4 Trojaner: TR/ATRAPS.Gen, TR/ATRAPS.Gen2, Sirefef.P.342, Dldr.Phdet.E.41
    Log-Analyse und Auswertung - 11.07.2012 (1)

Zum Thema tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg? - Hallo, ich habe hier ein kleines Problem. Ich habe laut "AntiVir" 2 bösewichte mit dem Namen: - tr/sirefef.16896 - tr/atraps.gen2 Leider bekomme ich die nicht so ohne weiteres entfernt. Selbst - tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg?...
Archiv
Du betrachtest: tr/sirefef.16896 und tr/atraps.gen2; wie bekomme ich die weg? auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.