| |
| |||||||
Log-Analyse und Auswertung: Trojan.Ransom.FGen - "Der Computer ist für die Verletzung der Gesetze der BRD wurde blockiert" - mit Bordmitteln nicht zu killenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
14.09.2012, 10:16
| #1 |
| |  Trojan.Ransom.FGen - "Der Computer ist für die Verletzung der Gesetze der BRD wurde blockiert" - mit Bordmitteln nicht zu killen Einen schönen guten Morgen, ich versuche seit zwei Tagen das Ding zu killen, aber diesmal muss ich Eure Hilfe in Anspruch nehmen. Wie in der Überschrift schon beschrieben, habe ich einen Ukash Trojaner. Version 1.15 nach botfrei.de Das einzige Tool was in zumindest findet ist Malwarebytes. Jedoch lässt er sich wie gesagt nur finden, aber nicht entfernen. Ich wäre dankbar für Eure Hilfe - hier meine Logfiles: Malwarebytes: Code:
ATTFilter Malwarebytes Anti-Malware 1.65.0.1400 www.malwarebytes.org Datenbank Version: v2012.09.14.01 Windows 7 Service Pack 1 x86 NTFS (Abgesichertenmodus/Netzwerkfähig) Internet Explorer 9.0.8112.16421 Harry :: PC [Administrator] 14.09.2012 09:55:17 mbam-log-2012-09-14 (10-07-23).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 240394 Laufzeit: 3 Minute(n), 58 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 1 C:\Users\Harry\AppData\Roaming\hellomoto (Trojan.Ransom.FGen) -> Keine Aktion durchgeführt. Infizierte Dateien: 2 C:\Users\Harry\AppData\Roaming\hellomoto\TujP.dat (Trojan.Ransom.FGen) -> Keine Aktion durchgeführt. C:\Users\Harry\AppData\Roaming\hellomoto\BukF.dat (Trojan.Ransom.FGen) -> Keine Aktion durchgeführt. (Ende) Code:
ATTFilter OTL logfile created on: 14.09.2012 10:56:41 - Run 3 OTL by OldTimer - Version 3.2.48.0 Folder = C:\Users\Harry\Desktop Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 1,92 Gb Available Physical Memory | 64,10% Memory free 6,00 Gb Paging File | 4,95 Gb Available in Paging File | 82,48% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 465,66 Gb Total Space | 168,36 Gb Free Space | 36,15% Space Free | Partition Type: NTFS Drive E: | 465,75 Gb Total Space | 55,56 Gb Free Space | 11,93% Space Free | Partition Type: NTFS Computer Name: PC | User Name: Harry | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.09.09 10:09:48 | 000,917,984 | ---- | M] (Mozilla Corporation) -- C:\Mozilla Firefox\firefox.exe PRC - [2012.09.07 17:04:44 | 000,981,656 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\explorer.exe PRC - [2012.09.06 22:05:46 | 004,780,928 | ---- | M] (SUPERAntiSpyware.com) -- C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe PRC - [2012.07.11 20:54:49 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) -- C:\Programme\SUPERAntiSpyware\SASCore.exe PRC - [2012.06.12 15:54:13 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Harry\Desktop\OTL.exe PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe ========== Modules (No Company Name) ========== MOD - [2012.09.14 09:54:19 | 000,065,024 | ---- | M] () -- C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll MOD - [2012.09.14 09:54:19 | 000,052,736 | ---- | M] () -- C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10007.dll MOD - [2012.09.14 09:23:47 | 000,117,760 | ---- | M] () -- C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL MOD - [2012.09.14 09:23:47 | 000,052,224 | ---- | M] () -- C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll MOD - [2012.09.09 10:09:48 | 002,244,064 | ---- | M] () -- C:\Mozilla Firefox\mozjs.dll MOD - [2012.06.18 17:24:30 | 000,260,096 | ---- | M] () -- C:\Notepad++\NppShell_05.dll MOD - [2010.11.21 16:54:34 | 000,094,208 | ---- | M] () -- C:\FileZilla FTP Client\fzshellext.dll MOD - [2010.02.10 19:10:10 | 000,141,824 | ---- | M] () -- C:\WinRARer\RarExt.dll ========== Win32 Services (SafeList) ========== SRV - [2012.07.30 18:01:02 | 003,075,920 | ---- | M] (Emsisoft GmbH) [Auto | Stopped] -- C:\Programme\Emsisoft Anti-Malware\a2service.exe -- (a2AntiMalware) SRV - [2012.07.11 20:54:49 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Programme\SUPERAntiSpyware\SASCore.exe -- (!SASCORE) SRV - [2012.05.25 10:07:20 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.01.19 13:47:20 | 003,027,840 | ---- | M] (TeamViewer GmbH) [Auto | Stopped] -- C:\Programme\TeamViewer\Version7\TeamViewer_Service.exe -- (TeamViewer7) SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011.07.20 06:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv) SRV - [2011.05.21 06:01:00 | 002,214,504 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Programme\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService) SRV - [2010.11.20 05:17:58 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) SRV - [2010.03.11 19:08:41 | 000,435,016 | ---- | M] (TuneUp Software) [On_Demand | Stopped] -- C:\Programme\TuneUp Utilities 2010\TuneUpDefragService.exe -- (TuneUp.Defrag) SRV - [2010.02.25 19:40:18 | 001,047,880 | ---- | M] (TuneUp Software) [Auto | Stopped] -- C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc) SRV - [2010.02.25 19:37:08 | 000,030,024 | -H-- | M] (TuneUp Software) [Auto | Stopped] -- C:\Windows\System32\uxtuneup.dll -- (UxTuneUp) SRV - [2010.01.29 23:17:14 | 000,292,944 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\LogiShrd\Bluetooth\LBTServ.exe -- (LBTServ) SRV - [2010.01.11 22:00:00 | 000,240,232 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service) SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc) SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2009.03.30 12:34:36 | 000,241,664 | ---- | M] () [Auto | Stopped] -- C:\Programme\T-Mobile Internet Manager 03\AssistantServices.exe -- (UI Assistant Service) SRV - [2009.02.26 19:36:22 | 000,064,856 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Office\Office12\GrooveAuditService.exe -- (Microsoft Office Groove Audit Service) SRV - [2008.10.24 16:35:44 | 000,128,296 | ---- | M] () [Auto | Stopped] -- C:\AAVUpdateManager\aavus.exe -- (AAV UpdateService) SRV - [2007.07.24 12:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto | Stopped] -- C:\Programme\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2) SRV - [2007.05.28 18:57:54 | 000,275,968 | ---- | M] (Rocket Division Software) [Auto | Stopped] -- C:\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE) SRV - [2007.03.06 11:35:02 | 000,198,168 | ---- | M] (InterVideo Inc.) [Auto | Stopped] -- C:\Programme\Common Files\InterVideo\DeviceService\DevSvc.exe -- (Capture Device Service) SRV - [2006.11.02 21:40:12 | 000,174,656 | -H-- | M] () [Auto | Stopped] -- C:\Windows\System32\PSIService.exe -- (ProtexisLicensing) SRV - [2006.10.26 15:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose) SRV - [2006.10.26 14:40:34 | 000,335,872 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Common Files\microsoft shared\VS7DEBUG\mdm.exe -- (MDM) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\vmnetadapter.sys -- (VMnetAdapter) DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\rdvgkmd.sys -- (VGPU) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\tsusbhub.sys -- (tsusbhub) DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\synth3dvsc.sys -- (Synth3dVsc) DRV - File not found [Kernel | On_Demand | Unknown] -- -- (avcumbvn) DRV - File not found [Kernel | Auto | Stopped] -- -- (adfs) DRV - [2012.09.14 10:24:24 | 000,040,776 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy) DRV - [2012.04.30 18:45:28 | 000,054,072 | ---- | M] (Emsisoft GmbH) [File_System | On_Demand | Stopped] -- C:\Programme\Emsisoft Anti-Malware\a2accx86.sys -- (a2acc) DRV - [2011.07.22 18:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Stopped] -- C:\Programme\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV) DRV - [2011.07.12 23:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Stopped] -- C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL) DRV - [2011.05.21 06:01:00 | 010,589,800 | -H-- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2011.01.12 11:42:12 | 000,025,088 | -H-- | M] (TeamViewer GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\teamviewervpn.sys -- (teamviewervpn) DRV - [2010.11.20 05:30:16 | 000,175,360 | -H-- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus) DRV - [2010.11.20 05:30:16 | 000,040,704 | -H-- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt) DRV - [2010.11.20 05:30:16 | 000,028,032 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc) DRV - [2010.11.20 03:24:42 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV - [2010.11.20 03:21:16 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV - [2010.11.20 02:59:46 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb) DRV - [2010.11.20 02:14:46 | 000,017,920 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID) DRV - [2010.11.20 02:14:42 | 000,005,632 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap) DRV - [2010.08.12 12:07:48 | 000,298,216 | -H-- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmf6232.sys -- (NVNET) DRV - [2010.04.27 17:57:28 | 000,066,632 | -H-- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\WmXlCore.sys -- (WmXlCore) DRV - [2010.04.27 17:57:28 | 000,015,048 | -H-- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WmVirHid.sys -- (WmVirHid) DRV - [2010.04.27 17:57:22 | 000,022,856 | -H-- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\WmBEnum.sys -- (WmBEnum) DRV - [2010.04.27 15:01:26 | 000,037,704 | -H-- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WmFilter.sys -- (WmFilter) DRV - [2010.03.23 02:17:06 | 001,812,512 | -H-- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RTL85n86.sys -- (RTL85n86) DRV - [2010.03.19 00:11:53 | 000,722,416 | -H-- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sptd.sys -- (sptd) DRV - [2010.02.25 11:18:08 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Stopped] -- C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv) DRV - [2009.11.10 13:55:08 | 000,037,392 | -H-- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt) DRV - [2009.11.10 13:54:52 | 000,035,984 | -H-- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt) DRV - [2009.10.19 09:08:08 | 000,067,072 | -H-- | M] (SCM Microsystems Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SPR3322K.sys -- (SPR3322K) DRV - [2009.09.17 13:02:04 | 001,086,976 | -H-- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\viahduaa.sys -- (VIAHdAudAddService) DRV - [2009.07.14 01:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp) DRV - [2009.07.14 00:02:53 | 000,545,792 | -H-- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netr73.sys -- (netr73) DRV - [2009.07.14 00:02:52 | 000,347,264 | -H-- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvm62x32.sys -- (NVENETFD) DRV - [2009.01.12 10:12:56 | 000,105,344 | -H-- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbnmea.sys -- (ZTEusbnmea) DRV - [2009.01.04 18:29:50 | 000,104,960 | -H-- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbser6k.sys -- (ZTEusbser6k) DRV - [2009.01.04 18:29:50 | 000,104,960 | -H-- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k) DRV - [2008.12.11 23:11:04 | 000,022,528 | -H-- | M] (Bytemobile, Inc.) [Kernel | Boot | Unknown] -- C:\Windows\System32\drivers\BMLoad.sys -- (BMLoad) DRV - [2008.12.11 23:11:04 | 000,018,816 | -H-- | M] (Bytemobile, Inc.) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\tcpipBM.sys -- (tcpipBM) DRV - [2008.10.29 17:35:32 | 000,007,680 | -H-- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\massfilter.sys -- (massfilter) DRV - [2005.12.01 11:49:22 | 000,023,600 | -H-- | M] (Licensed for Gebhard Software) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\drhard.sys -- (drhard) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 96 36 A0 12 2F C1 CA 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/" FF - prefs.js..extensions.enabledItems: DeviceDetection@logitech.com:1.20.0.66 FF - prefs.js..extensions.enabledItems: {9ab67d74-ec41-4cb2-b417-df5d93ba1beb}:1.5.2 FF - prefs.js..extensions.enabledItems: {f759ca51-3a91-4dd1-ae78-9db5eee9ebf0}:5.6.9 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.10: C:\VLC\npvlc.dll (the VideoLAN Team) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ff-bmboc@bytemobile.com: C:\Program Files\T-Mobile Internet Manager 03\addon [2012.02.14 18:01:20 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Mozilla Firefox\components [2012.09.09 10:09:48 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Mozilla Firefox\plugins [2012.02.05 12:32:30 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Mozilla Firefox\components [2012.09.09 10:09:48 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Mozilla Firefox\plugins [2012.02.05 12:32:30 | 000,000,000 | ---D | M] [2010.03.25 14:20:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Harry\AppData\Roaming\mozilla\Extensions [2010.03.25 14:20:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Harry\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2012.07.11 12:21:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Harry\AppData\Roaming\mozilla\Firefox\Profiles\jr8eb5rj.default\extensions [2012.03.31 13:43:49 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Harry\AppData\Roaming\mozilla\Firefox\Profiles\jr8eb5rj.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2011.08.09 18:23:43 | 000,000,000 | ---D | M] (Разпознаване на устройство Logitech) -- C:\Users\Harry\AppData\Roaming\mozilla\Firefox\Profiles\jr8eb5rj.default\extensions\DeviceDetection@logitech.com [2011.08.13 16:33:46 | 000,031,532 | ---- | M] () (No name found) -- C:\USERS\HARRY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JR8EB5RJ.DEFAULT\EXTENSIONS\{9AB67D74-EC41-4CB2-B417-DF5D93BA1BEB}.XPI [2012.07.11 12:21:03 | 000,324,289 | ---- | M] () (No name found) -- C:\USERS\HARRY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JR8EB5RJ.DEFAULT\EXTENSIONS\{F759CA51-3A91-4DD1-AE78-9DB5EEE9EBF0}.XPI ========== Chrome ========== CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms} O1 HOSTS File: ([2011.03.02 11:18:31 | 000,000,881 | -H-- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 activate.adobe.com O1 - Hosts: 192.168.2.21 roihost O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found. O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.) O4 - HKLM..\Run: [CanonSolutionMenuEx] C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.) O4 - HKLM..\Run: [emsisoft anti-malware] C:\Program Files\Emsisoft Anti-Malware\a2guard.exe (Emsisoft GmbH) O4 - HKLM..\Run: [EvtMgr6] C:\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.) O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de) O4 - HKLM..\Run: [GrooveMonitor] C:\Office\Office12\GrooveMonitor.exe (Microsoft Corporation) O4 - HKLM..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe (VIA) O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [Smart File Advisor] C:\Program Files\Smart File Advisor\sfa.exe (Filefacts.net) O4 - HKLM..\Run: [UIExec] C:\Program Files\T-Mobile Internet Manager 03\UIExec.exe () O4 - HKCU..\Run: [AlcoholAutomount] C:\Alcohol Soft\Alcohol 120\axcmd.exe (Alcohol Soft Development Team) O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG) O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Programme\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com) O4 - HKCU..\Run: [WUDFPlatform] C:\Users\Harry\AppData\Local\Microsoft\Windows\1909\WUDFPlatform.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: hyxmep = C:\Windows\system32\KBDMLT47V.exe O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html File not found O8 - Extra context menu item: Free YouTube Download - C:\Users\Harry\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm () O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Harry\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm () O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html File not found O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html File not found O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html File not found O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\Office\Office10\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\PokerStars\PokerStarsUpdate.exe (PokerStars) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O15 - HKCU\..Trusted Domains: http ([]* in Trusted sites) O15 - HKCU\..Trusted Domains: rettungsdienst-vogelsberg.de ([www] http in Trusted sites) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 10.5.1) O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 10.5.1) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{09875B8A-10B3-4A6A-8BD1-8E67CCA45DE0}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0BCDFB0D-2E75-4B6B-89B7-5843ADFA8D33}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4FCE881E-C14A-4353-8ED8-DF7D68E27991}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BAC4EAD9-CC9E-42C4-83AD-49FC82FBBC43}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C77A54E2-2D41-4DF5-B974-940207FC13B0}: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Programme\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.) O20 - Winlogon\Notify\ScCertProp: DllName - (wlnotify.dll) - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Programme\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com) O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{3935f2f0-dbd5-11e0-bdbd-c0c09071e4dc}\Shell - "" = AutoRun O33 - MountPoints2\{3935f2f0-dbd5-11e0-bdbd-c0c09071e4dc}\Shell\AutoRun\command - "" = G:\Install.exe O33 - MountPoints2\{f9c940f0-a8fd-11df-a469-c648db700c8e}\Shell - "" = AutoRun O33 - MountPoints2\{f9c940f0-a8fd-11df-a469-c648db700c8e}\Shell\AutoRun\command - "" = G:\AutoRun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.09.14 10:24:24 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2012.09.14 10:18:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware [2012.09.14 10:17:58 | 000,000,000 | ---D | C] -- C:\Program Files\Emsisoft Anti-Malware [2012.09.14 10:17:58 | 000,000,000 | ---D | C] -- C:\Users\Harry\Documents\Anti-Malware [2012.09.14 09:30:28 | 000,000,000 | ---D | C] -- C:\Users\Harry\AppData\Roaming\hellomoto [2012.09.14 09:23:17 | 000,000,000 | ---D | C] -- C:\Users\Harry\AppData\Roaming\SUPERAntiSpyware.com [2012.09.14 09:23:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware [2012.09.14 09:23:10 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com [2012.09.14 09:23:10 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware [2012.09.14 09:06:56 | 000,000,000 | -HSD | C] -- C:\found.000 [2012.09.14 08:30:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner [2012.09.14 08:30:17 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner [2012.09.13 17:23:03 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2012.09.13 17:23:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.09.13 17:23:03 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2012.08.24 19:44:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dance eJay 7 [2012.08.24 19:44:41 | 000,057,344 | -H-- | C] (NexiTech, Inc.) -- C:\Windows\System32\WNASPINT.DLL [2012.08.24 19:42:33 | 000,000,000 | ---D | C] -- C:\eJay [2012.08.18 15:50:40 | 000,000,000 | ---D | C] -- C:\Users\Harry\Desktop\Bad Hersfeld Klinikum [2012.08.16 15:03:40 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2012.08.16 15:03:39 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2012.08.16 15:03:39 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2012.08.16 15:03:39 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2012.08.16 15:03:38 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll [2012.08.16 15:03:38 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll [2012.08.16 15:03:37 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2012.08.16 09:02:00 | 000,400,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\srcore.dll [2012.08.16 09:01:59 | 002,345,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2012.08.16 09:01:55 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\browcli.dll [2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [2 C:\*.tmp files -> C:\*.tmp -> ] [1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.09.14 10:24:24 | 000,040,776 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2012.09.14 10:18:17 | 000,001,049 | ---- | M] () -- C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk [2012.09.14 09:37:23 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.09.14 09:37:15 | 2415,370,240 | -HS- | M] () -- C:\hiberfil.sys [2012.09.14 09:35:45 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.09.14 09:23:14 | 000,001,961 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk [2012.09.14 09:08:26 | 000,003,536 | ---- | M] () -- C:\bootsqm.dat [2012.09.14 08:57:00 | 000,512,399 | ---- | M] () -- C:\Users\Harry\Desktop\adwcleaner.exe [2012.09.14 08:33:07 | 000,038,256 | ---- | M] () -- C:\Users\Harry\Documents\cc_20120914_083257.reg [2012.09.14 08:30:18 | 000,000,965 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk [2012.09.14 08:18:17 | 000,001,554 | ---- | M] () -- C:\Users\Harry\Desktop\Malewarebytes.lnk [2012.09.13 17:02:50 | 000,883,840 | ---- | M] () -- C:\Avira-DE-Cleaner.exe [2012.09.13 16:59:27 | 000,002,022 | ---- | M] () -- C:\Users\Harry\Desktop\Entfernen des Avira DE-Cleaners.lnk [2012.09.13 16:59:27 | 000,001,951 | ---- | M] () -- C:\Users\Harry\Desktop\Avira DE-Cleaner.lnk [2012.09.12 15:56:29 | 000,657,438 | -H-- | M] () -- C:\Windows\System32\perfh007.dat [2012.09.12 15:56:29 | 000,618,714 | -H-- | M] () -- C:\Windows\System32\perfh009.dat [2012.09.12 15:56:29 | 000,130,810 | -H-- | M] () -- C:\Windows\System32\perfc007.dat [2012.09.12 15:56:29 | 000,107,034 | -H-- | M] () -- C:\Windows\System32\perfc009.dat [2012.09.12 14:55:01 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.09.12 14:14:41 | 000,016,944 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.09.12 14:14:41 | 000,016,944 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.09.11 13:28:54 | 000,058,410 | ---- | M] () -- C:\Users\Harry\Documents\BP-Fulda-VgNr-566268-2012.pdf [2012.09.07 17:04:46 | 000,022,856 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2012.09.07 12:57:04 | 000,002,286 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk [2012.08.24 19:44:56 | 000,001,603 | ---- | M] () -- C:\Users\Public\Desktop\Dance eJay 7.lnk [2012.08.21 12:14:51 | 000,426,184 | -H-- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe [2012.08.21 12:14:51 | 000,070,344 | -H-- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl [2012.08.17 21:46:01 | 002,365,104 | -H-- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [2 C:\*.tmp files -> C:\*.tmp -> ] [1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.09.14 10:18:17 | 000,001,049 | ---- | C] () -- C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk [2012.09.14 09:23:14 | 000,001,961 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk [2012.09.14 09:08:26 | 000,003,536 | ---- | C] () -- C:\bootsqm.dat [2012.09.14 08:57:54 | 000,512,399 | ---- | C] () -- C:\Users\Harry\Desktop\adwcleaner.exe [2012.09.14 08:33:02 | 000,038,256 | ---- | C] () -- C:\Users\Harry\Documents\cc_20120914_083257.reg [2012.09.14 08:30:18 | 000,000,965 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk [2012.09.14 08:17:41 | 000,001,554 | ---- | C] () -- C:\Users\Harry\Desktop\Malewarebytes.lnk [2012.09.13 17:02:46 | 000,883,840 | ---- | C] () -- C:\Avira-DE-Cleaner.exe [2012.09.13 16:59:27 | 000,002,022 | ---- | C] () -- C:\Users\Harry\Desktop\Entfernen des Avira DE-Cleaners.lnk [2012.09.13 16:59:27 | 000,001,951 | ---- | C] () -- C:\Users\Harry\Desktop\Avira DE-Cleaner.lnk [2012.09.11 13:28:54 | 000,058,410 | ---- | C] () -- C:\Users\Harry\Documents\BP-Fulda-VgNr-566268-2012.pdf [2012.08.24 19:44:56 | 000,001,603 | ---- | C] () -- C:\Users\Public\Desktop\Dance eJay 7.lnk [2011.12.19 14:00:11 | 000,000,016 | RHS- | C] () -- C:\ProgramData\114101988478797566826574115114109 [2011.11.07 11:15:31 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe [2011.11.07 11:15:18 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe [2011.06.30 11:37:26 | 000,000,023 | ---- | C] () -- C:\Windows\ODBCINST.INI [2011.02.28 17:42:05 | 000,000,854 | ---- | C] () -- C:\Windows\DataTron.ini [2011.02.21 20:57:37 | 000,004,096 | -H-- | C] () -- C:\Users\Harry\AppData\Local\keyfile3.drm [2011.02.09 16:11:17 | 000,022,218 | ---- | C] () -- C:\Users\Harry\AppData\Roaming\Kommagetrennte Werte (DOS).ADR [2011.02.09 12:49:55 | 000,022,401 | ---- | C] () -- C:\Users\Harry\AppData\Roaming\Tabulatorgetrennte Werte (Windows).ADR [2011.02.05 13:55:31 | 000,022,232 | ---- | C] () -- C:\Users\Harry\AppData\Roaming\Kommagetrennte Werte (Windows).ADR [2010.12.31 10:47:12 | 000,000,344 | ---- | C] () -- C:\ProgramData\RCN6OzG3w4A [2010.12.31 10:25:32 | 000,000,280 | ---- | C] () -- C:\ProgramData\~KCBaEBnAsa [2010.12.31 10:25:32 | 000,000,176 | ---- | C] () -- C:\ProgramData\~KCBaEBnAsar [2010.12.31 10:25:30 | 000,000,336 | ---- | C] () -- C:\ProgramData\KCBaEBnAsa [2010.11.02 19:16:41 | 000,000,592 | ---- | C] () -- C:\Windows\RDOFFICE.INI ========== LOP Check ========== [2010.08.20 17:18:59 | 000,000,000 | ---D | M] -- C:\Users\Harry\AppData\Roaming\apm [2010.03.15 18:03:43 | 000,000,000 | ---D | M] -- C:\Users\Harry\AppData\Roaming\ArmA II Launcher [2011.08.25 16:11:05 | 000,000,000 | ---D | M] -- C:\Users\Harry\AppData\Roaming\Artisteer [2011.04.16 13:03:53 | 000,000,000 | ---D | M] -- C:\Users\Harry\AppData\Roaming\avidemux [2010.11.10 23:47:37 | 000,000,000 | ---D | M] -- C:\Users\Harry\AppData\Roaming\calibre [2012.04.14 17:41:46 | 000,000,000 | ---D | M] -- C:\Users\Harry\AppData\Roaming\Canon [2010.08.20 13:05:37 | 000,000,000 | ---D | M] -- C:\Users\Harry\AppData\Roaming\Cherry [2011.07.07 11:42:25 | 000,000,000 | ---D | M] -- C:\Users\Harry\AppData\Roaming\Dienstplanagent [2010.05.09 16:35:52 | 000,000,000 | ---D | M] -- C:\Users\Harry\AppData\Roaming\DVDVideoSoftIEHelpers [2012.09.14 08:37:14 | 000,000,000 | ---D | M] -- C:\Users\Harry\AppData\Roaming\FileZilla [2012.01.17 10:19:05 | 000,000,000 | ---D | M] -- C:\Users\Harry\AppData\Roaming\gtk-2.0 [2012.09.14 09:30:42 | 000,000,000 | ---D | M] -- C:\Users\Harry\AppData\Roaming\hellomoto [2011.07.02 09:55:53 | 000,000,000 | ---D | M] -- C:\Users\Harry\AppData\Roaming\ImgBurn [2010.03.20 16:10:43 | 000,000,000 | ---D | M] -- C:\Users\Harry\AppData\Roaming\Leadertech [2011.11.07 10:06:41 | 000,000,000 | ---D | M] -- C:\Users\Harry\AppData\Roaming\NCH Swift Sound [2012.07.22 13:16:14 | 000,000,000 | ---D | M] -- C:\Users\Harry\AppData\Roaming\Notepad++ [2011.01.27 11:34:10 | 000,000,000 | ---D | M] -- C:\Users\Harry\AppData\Roaming\Opera [2012.02.14 18:01:24 | 000,000,000 | ---D | M] -- C:\Users\Harry\AppData\Roaming\Program Files [2011.08.24 19:58:39 | 000,000,000 | ---D | M] -- C:\Users\Harry\AppData\Roaming\Simfy [2012.06.12 07:31:20 | 000,000,000 | ---D | M] -- C:\Users\Harry\AppData\Roaming\Solveig Multimedia [2011.09.10 20:02:31 | 000,000,000 | ---D | M] -- C:\Users\Harry\AppData\Roaming\T-Mobile Internet Manager 03 [2012.01.31 17:29:39 | 000,000,000 | ---D | M] -- C:\Users\Harry\AppData\Roaming\TeamViewer [2010.03.25 14:20:21 | 000,000,000 | ---D | M] -- C:\Users\Harry\AppData\Roaming\Thunderbird [2010.03.11 19:08:38 | 000,000,000 | ---D | M] -- C:\Users\Harry\AppData\Roaming\TuneUp Software [2010.11.22 17:41:23 | 000,000,000 | ---D | M] -- C:\Users\Harry\AppData\Roaming\Ubisoft [2010.03.20 15:46:29 | 000,000,000 | ---D | M] -- C:\Users\Harry\AppData\Roaming\Ulead Systems [2010.10.31 12:52:07 | 000,000,000 | ---D | M] -- C:\Users\Harry\AppData\Roaming\Valuga Software [2011.07.03 12:43:18 | 000,000,000 | ---D | M] -- C:\Users\Harry\AppData\Roaming\wargaming.net [2010.10.17 13:15:53 | 000,000,000 | ---D | M] -- C:\Users\Harry\AppData\Roaming\xaran.de [2010.12.19 10:27:40 | 000,000,000 | ---D | M] -- C:\Users\Harry\AppData\Roaming\Xilisoft [2012.07.22 13:22:10 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 60 bytes -> C:\Users\Harry\PHOTOSHOP CS5 READ ME.PDF:AFP_AfpInfo < End of report >  |
| Themen zu Trojan.Ransom.FGen - "Der Computer ist für die Verletzung der Gesetze der BRD wurde blockiert" - mit Bordmitteln nicht zu killen |
| administrator, adobe, bho, blockiert, bonjour, computer, converter, defender, emsisoft, excel, explorer, firefox, format, ftp, hängen, mozilla, mp3, nvidia, object, photoshop, plug-in, realtek, registry, senden, services.exe, software, t-mobile, vdeck.exe |
Baum-Darstellung