Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc......

selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc......


Plagegeister aller Art und deren Bekämpfung: selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc......

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Seite 1 von 3 1 23
Alt 30.09.2012, 18:30   #1
Janis540
 
selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc...... - Standard

selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc......


Hallo Leute,

Ich habe nun seit längerer Zeit kleinere .exe Dateien auf meinem Laptop (Windows 7 Home Premium).
Die Dateien sind nicht sehr groß. Lediglich rund 350 KB.
Sie befinden sich im Ordner Roaming. In der Suchleiste bei Windows einfach "%appdata%" eingeben.
Die Minecraft-Spieler kennen den Ordner. Es ist der Ordner in in den man den .minecraft Ordner platzieren muss.
Und genau darin befinden sich die Dateien. Sie erstellen sich auch immer neu. Ich habe schon mehrmals versucht sie einfach zu löschen, aber es funktioniert nicht. Sie werden einfach wieder erstellt. Und es sind auch nicht immer dieselben Dateinamen. Und sie öffnen sich auch automatisch; Im Taskmanager unter Prozesse werden IMMER 2 identische Viren geöffnet. Egal welchen Namen sie haben, es sind immer 2 gleiche. Ich poste mal ein Screenshot hier rein, wie das bei mir aussieht:

Also erstmal der Roaming Ordner wo sich die Dateien befinden:



Und hier ist der/ sind die Prozesse im Task Manager:



Ich habe keiner Ahnung wo diese Teile herkommen.
Durch irgendeinen Download höchstwahrscheinlich.

Der Virus bremst auch erheblich die Systemleistung aus.


Wenn mir jemand helfen kann, wäre ich sehr dankbar

Gruß, Janis

Alt 02.10.2012, 07:14   #2
schrauber
/// the machine
/// TB-Ausbilder
 
selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc...... - Standard

selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc......


Hi,


Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
  • Starte bitte die OTL.exe.
  • Kopiere nun den Inhalt aus der Codebox in die Textbox.
Code:
ATTFilter
activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
%windir%\installer\*. /5
%localappdata%\*. /5
CREATERESTOREPOINT
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Quick Scan Button.
  • Kopiere nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread
__________________

__________________
Alt 02.10.2012, 18:59   #3
Janis540
 
selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc...... - Standard

selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc......


Danke erstmal, schrauber...

Ich habe den Scan gestartet, jedoch hängt sich das Programm immer auf wenn folgendes gescannt wird:

"Scanning HKEY_CURRENT_USER Run Keys..."

Muss ich einfach nur lange warten? Ich hatte nämlich ca. 15 Minuten gewartet, doch es hat sich nichts getan....
__________________
Alt 02.10.2012, 19:00   #4
schrauber
/// the machine
/// TB-Ausbilder
 
selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc...... - Standard

selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc......


Dann versuchen wir was andres.


Downloade dir bitte dds ( von sUBs ) von einem der folgenden Downloadspiegel und speichere die Datei auf deinem Desktop.

dds.com
dds.scr
dds.pif
  • Schließe alle laufenden Programme.
  • Starte DDS mit Doppelklick.
  • Es wird 2 Logfiles erstellen.
    • dds.txt
    • attach.txt
  • Speichere beide Logfiles auf deinem Desktop
  • Poste beide Logfiles hier.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 02.10.2012, 21:20   #5
Janis540
 
selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc...... - Standard

selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc......


Danke, hat geklappt.

Also hier ist das Attach file:

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.DDS Logfile:
Code:
ATTFilter
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Home Premium 
Boot Device: \Device\HarddiskVolume2
Install Date: 06.03.2012 13:03:52
System Uptime: 02.10.2012 11:47:51 (11 hours ago)
.
Motherboard: Acer |  | Aspire one      
Processor: Intel(R) Atom(TM) CPU N270   @ 1.60GHz | CPU | 800/533mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 114 GiB total, 18,399 GiB free.
.
==== Disabled Device Manager Items =============
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: AVG AVI Loader Driver
Device ID: ROOT\LEGACY_AVGLDX86\0000
Manufacturer: 
Name: AVG AVI Loader Driver
PNP Device ID: ROOT\LEGACY_AVGLDX86\0000
Service: Avgldx86
.
Class GUID: {36fc9e60-c465-11cf-8056-444553540000}
Description: Unknown Device
Device ID: USB\VID_0000&PID_0000\5&36089DE0&0&2
Manufacturer: (Standard-USB-Hostcontroller)
Name: Unknown Device
PNP Device ID: USB\VID_0000&PID_0000\5&36089DE0&0&2
Service: 
.
==== System Restore Points ===================
.
No restore point in system.
.
==== Installed Programs ======================
.
Adobe AIR
Adobe Download Assistant
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Help Manager
Adobe Illustrator CS6
Adobe Photoshop CS6
Adobe Reader X (10.1.3) - Deutsch
Adobe Shockwave Player
Atheros Communications Inc.(R) AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver
µTorrent
Audacity 1.2.6
AVG 2012
AVS Update Manager 1.0
AVS Video Converter 8
Broadcom Wireless Utility
Camtasia Studio 7
Canon IJ Network Scan Utility
Canon IJ Network Tool
Canon MP640 series MP Drivers
CDBurnerXP
Cheat Engine 6.1
CINEMA 4D 11.514
Cisco EAP-FAST Module
Cisco LEAP Module
Cisco PEAP Module
DarkLoader v4.1
Dev-C++ 5 beta 9 release (4.9.9.2)
Driver Genius Professional Edition
eReg
Führerschein-Trainer 2007
Fraps (remove only)
GadgetBox
GBox
GermaniXEncoder
Google Chrome
Google Earth
Google Update Helper
Hama Wireless LAN Adapter
Hex-Editor MX
Iminent
Intel(R) Graphics Media Accelerator Driver
InterActual Player
IsoBuster 2.8.5
Java 7 Update 7
Java Auto Updater
JavaFX 2.1.1
JDiskReport 1.4.0
LAME v3.99.3 (for Windows)
Logitech SetPoint 6.32
Media Player Codec Pack 4.1.9
Microsoft .NET Framework 4.5 DEU Language Pack RC
Microsoft .NET Framework 4.5 RC
Microsoft Office Access MUI (German) 2010
Microsoft Office Excel MUI (German) 2010
Microsoft Office Groove MUI (German) 2010
Microsoft Office InfoPath MUI (German) 2010
Microsoft Office OneNote MUI (German) 2010
Microsoft Office Outlook MUI (German) 2010
Microsoft Office PowerPoint MUI (German) 2010
Microsoft Office Professional Plus 2010
Microsoft Office Proof (English) 2010
Microsoft Office Proof (French) 2010
Microsoft Office Proof (German) 2010
Microsoft Office Proof (Italian) 2010
Microsoft Office Proofing (German) 2010
Microsoft Office Publisher MUI (German) 2010
Microsoft Office Shared MUI (German) 2010
Microsoft Office Word MUI (German) 2010
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable - KB2467175
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
Microsoft_VC80_CRT_x86
Microsoft_VC90_CRT_x86
Minecraft Version Changer
mIRC
Mozilla Firefox 13.0.1 (x86 de)
MP3 Skype Recorder
MSVCRT Redists
Orbit Downloader
PDF Settings CS6
Pflanzen gegen Zombies
Realtek High Definition Audio Driver
Skype™ 5.10
SopCast 3.5.0
sprotector 1.62
Stream Player
swMSM
TeamSpeak 3 Client
Tunatic
Vegas Pro 10.0
VLC media player 1.1.11
WebCam
WinRAR 4.11 (32-Bit)
Xilisoft HD Video Converter 6
.
==== End Of File ===========================




Und hier ist das DDS file:

[TABLE].
DDS (Ver_2011-08-26.01) - NTFSx86 
Internet Explorer: 9.0.8112.16421  BrowserJavaVersion: 10.7.2
Run by Janis at 22:00:20 on 2012-10-02
Microsoft Windows 7 Home Premium   6.1.7600.0.1252.49.1033.18.1014.224 [GMT 2:00]
.
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\WLTRYSVC.EXE
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\bcmwltry.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\Hama\Common\RaRegistry.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Program Files\Logitech\SetPointP\SetPoint.exe
C:\Windows\WebCam\S6000\S6000Mnt.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\WLTRAY.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
C:\Windows\system32\taskeng.exe
C:\ProgramData\Premium\GBox\GBox.exe
C:\Windows\System32\taskmgr.exe
C:\Users\Janis\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Janis\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Janis\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Janis\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Janis\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Janis\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Janis\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Janis\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Orbitdownloader\orbitnet.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Program Files\Orbitdownloader\orbitdm.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = https://isearch.avg.com/?cid={123DB6E3-65D0-4739-BE8A-6F30961BFD49}&mid=796bcf77900347d08b28d16a1c858f15-4dda9021002b6c4077fe60294b0ad61d9441fe9a&lang=en&ds=yu012&pr=sa&d=2012-08-14 15:54:10&v=12.1.0.20&sap=hp
uURLSearchHooks: H - No File
mWinlogon: Userinit=c:\windows\system32\userinit.exe,c:\users\janis\documents\msdcsc\msdcsc.exe,c:\users\janis\documents\msdcsc\msdcsc.exe,c:\users\cinema 4d\documents\msdcsc\msdcsc.exe,c:\users\cinema 4d\documents\msdcsc\msdcsc.exe,c:\users\janis\documents\msdcsc\msdcsc.exe,c:\users\janis\documents\msdcsc\msdcsc.exe,c:\users\janis\documents\msdcsc\msdcsc.exe,c:\users\janis\documents\msdcsc\msdcsc.exe,c:\users\janis\documents\msdcsc\msdcsc.exe,c:\users\janis\documents\msdcsc\msdcsc.exe,c:\users\janis\documents\msdcsc\msdcsc.exe,c:\users\janis\documents\msdcsc\msdcsc.exe,c:\users\janis\documents\msdcsc\msdcsc.exe,c:\users\janis\documents\msdcsc\msdcsc.exe,c:\users\janis\documents\msdcsc\msdcsc.exe,c:\users\janis\documents\msdcsc\msdcsc.exe
BHO: Octh Class: {000123b4-9b42-4900-b3f7-f4b073efc214} - c:\program files\orbitdownloader\orbitcth.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg2012\avgssie.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~2\micros~2\office14\GROOVEEX.DLL
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre7\bin\ssv.dll
BHO: {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - No File
BHO: IMinent WebBooster (BHO): {a09ab6eb-31b5-454c-97ec-9b294d92ee2a} - c:\program files\iminent\Iminent.WebBooster.InternetExplorer.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~2\micros~2\office14\URLREDIR.DLL
BHO: Help the General-Search Project: {ca4520f3-ae13-4fb1-a513-58e23991c86d} - c:\users\janis\appdata\roaming\mediaf~1\extens~1\GENCRA~1.DLL
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre7\bin\jp2ssv.dll
TB: Grab Pro: {c55bbcd6-41ad-48ad-9953-3609c48eacc7} - c:\program files\orbitdownloader\GrabPro.dll
uRun: [ViStart] c:\program files\vistart\ViStart.exe
uRun: [85d7b90b3f039ec268747896125a906f] 
uRun: [Microsoft DLL Registration] c:\users\janis\appdata\roaming\regsrv32.exe
uRun: [MicroUpdate] c:\users\janis\documents\msdcsc\msdcsc.exe
uRun: [Fztitn] c:\users\janis\appdata\roaming\Fztitn.exe
uRun: [AdobeBridge] 
uRun: [Google Update] "c:\users\janis\appdata\local\google\update\GoogleUpdate.exe" /c
uRun: [MP3 Skype Recorder] c:\program files\mp3 skype recorder\MP3 Skype Recorder.exe
uRun: [WINSXS32] c:\users\janis\appdata\roaming\A86B.exe
mRun: [Driver Genius] 
mRun: [IJNetworkScanUtility] c:\program files\canon\canon ij network scan utility\CNMNSUT.exe
mRun: [S6000Mnt] Rundll32.exe S6000Rmv.dll ,WinMainRmv /StartStillMnt
mRun: [WINSXS32] c:\users\janis\appdata\roaming\DA66.exe
mRun: [RTHDVCPL] c:\program files\realtek\audio\hda\RtHDVCpl.exe -s
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [EvtMgr6] c:\program files\logitech\setpointp\SetPoint.exe /launchGaming
mRun: [Broadcom Wireless Manager UI] c:\program files\broadcom\broadcom 802.11 network adapter\WLTRAY.exe
mRun: [TaskTray] 
mRun: [Iminent] c:\program files\iminent\Iminent.exe /warmup "F77F87E5-A6BD-4922-A530-EDF63D7E9F8C"
mRun: [IminentMessenger] c:\program files\iminent\Iminent.Messengers.exe /startup
mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"
mRun: [SwitchBoard] c:\program files\common files\adobe\switchboard\SwitchBoard.exe
mRun: [AdobeCS6ServiceManager] "c:\program files\common files\adobe\cs6servicemanager\CS6ServiceManager.exe" -launchedbylogin
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [ROC_ROC_JULY_P1] "c:\program files\avg secure search\ROC_ROC_JULY_P1.exe" / /PROMPT /CMPID=ROC_JULY_P1
mRun: [Skype Recorder] "c:\program files\skype recorder\Skype Recorder.exe"
StartupFolder: c:\users\janis\appdata\roaming\microsoft\windows\start menu\programs\startup\explorer.exe
StartupFolder: c:\progra~3\micros~1\windows\startm~1\programs\startup\hamawi~1.lnk - c:\program files\hama\common\RaUI.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: &Download by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/204
IE: An OneNote s&enden - c:\progra~2\micros~2\office14\ONBttnIE.dll/105
IE: Do&wnload selected by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/202
IE: Download with &Media Finder - c:\program files\media finder\hook.html
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\micros~2\office14\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll
TCP: DhcpNameServer = 82.212.62.62 192.168.0.1
TCP: Interfaces\{06FECF99-3B43-4B79-86CF-19CD04F12C59} : DhcpNameServer = 82.212.62.62 192.168.0.1
TCP: Interfaces\{0D919A74-7B99-489D-A36B-D638B135663D} : DhcpNameServer = 82.212.62.62 192.168.0.1
TCP: Interfaces\{AE28F08E-E615-46C3-9091-3A3AF9BF2C0A} : DhcpNameServer = 82.212.62.62 192.168.0.1
TCP: Interfaces\{AE28F08E-E615-46C3-9091-3A3AF9BF2C0A}\2475D2E45647A7775627B6 : DhcpNameServer = 82.212.62.62 78.42.43.62
TCP: Interfaces\{AE28F08E-E615-46C3-9091-3A3AF9BF2C0A}\75C414E4D2145413935393 : DhcpNameServer = 192.168.2.1
TCP: Interfaces\{AECCD3BF-6684-4A29-98B1-59BDF8643224} : DhcpNameServer = 82.212.62.62 192.168.0.1
TCP: Interfaces\{B94362DE-0FA9-41E4-9AFE-BCAFFD87BFEB}\4456661657C647 : DhcpNameServer = 82.212.62.62 192.168.0.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - 
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\mp3 skype recorder\Skype4COM.dll
Notify: igfxcui - igfxdev.dll
Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
AppInit_DLLs: c:\progra~2\sprote~1\sprote~1.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~2\micros~2\office14\GROOVEEX.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\janis\appdata\roaming\mozilla\firefox\profiles\bw776v5k.default\
FF - prefs.js: browser.startup.homepage - hxxp://search.iminent.com/?appId=f4539de6-f4fd-40fe-9b84-0c6e9e69524c&lcid=1031&ref=homepage
FF - prefs.js: keyword.URL - hxxps://isearch.avg.com/search?cid={123DB6E3-65D0-4739-BE8A-6F30961BFD49}&mid=796bcf77900347d08b28d16a1c858f15-4dda9021002b6c4077fe60294b0ad61d9441fe9a&lang=en&ds=yu012&pr=sa&d=2012-08-14 15:54:10&v=12.2.5.32&sap=ku&q=
FF - plugin: c:\progra~2\micros~2\office14\NPAUTHZ.DLL
FF - plugin: c:\progra~2\micros~2\office14\NPSPWRAP.DLL
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.3.21.111\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\1.3.21.115\npGoogleUpdate3.dll
FF - plugin: c:\program files\google\update\1.3.21.123\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.10411.0\npctrlui.dll
FF - plugin: c:\users\janis\appdata\local\google\update\1.3.21.123\npGoogleUpdate3.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_4_402_278.dll
FF - plugin: c:\windows\system32\npdeployJava1.dll
FF - plugin: c:\windows\system32\npmproxy.dll
.
---- FIREFOX POLICIES ----
.
user_pref('extensions.dealply.partner', 'vita');
.
user_pref('extensions.dealply.channel', 'vitaeazel');
.
user_pref('extensions.dealply.installId', 'v23500236973251394706402012061719195630');
.
user_pref('extensions.dealply.installIdSource', 'inst');
.
user_pref('extensions.dealply.sampleGroup', '0');
.
user_pref('extensions.dealply.partner', 'vita');
.
user_pref('extensions.dealply.channel', 'vitaeazel');
.
user_pref('extensions.dealply.installId', 'v23500236973251394706402012061719195630');
.
user_pref('extensions.dealply.installIdSource', 'inst');
.
user_pref('extensions.dealply.sampleGroup', '0');
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=112555&tt=060612_5_
FF - user.js: extensions.BabylonToolbar_i.babExt - 
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - 70fd172f00000000000000235a6166e6
FF - user.js: extensions.BabylonToolbar_i.hardId - 70fd172f00000000000000235a6166e6
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15511
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1720:56:43
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [2012-4-19 24896]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2012-1-31 31952]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-12-23 41040]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2012-3-19 301248]
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-14 48128]
R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2012-1-3 63928]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [2011-12-23 139856]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\avgidsfilterx.sys [2011-12-23 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [2011-12-23 17232]
S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2012-2-22 235216]
S2 AVGIDSAgent;AVGIDSAgent;"c:\program files\avg\avg2012\avgidsagent.exe" --> c:\program files\avg\avg2012\avgidsagent.exe [?]
S2 avgwd;AVG WatchDog;"c:\program files\avg\avg2012\avgwdsvc.exe" --> c:\program files\avg\avg2012\avgwdsvc.exe [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2012-4-30 104872]
S2 gupdate;Google Update-Dienst (gupdate);c:\program files\google\update\GoogleUpdate.exe [2012-4-17 116648]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-12 250288]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]
S3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2012-4-17 116648]
S3 netr73;RT73 USB Extensible Wireless LAN Card Driver;c:\windows\system32\drivers\netr73.sys [2012-9-10 562464]
S3 PortTalk;PortTalk;c:\windows\system32\drivers\porttalk.sys [2012-3-7 3567]
S3 S6000KNT;S6000KNT_WebCam Driver;c:\windows\system32\drivers\S6000KNT.sys [2010-8-5 167576]
S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [2010-7-1 34896]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\drivers\vwifimp.sys [2009-7-14 14336]
.
=============== Created Last 30 ================
.
2012-10-02 20:00:35	195072	----a-w-	c:\users\janis\appdata\roaming\Fztitn.exe
2012-10-02 15:33:21	347136	----a-w-	c:\users\janis\appdata\roaming\A86B.exe
2012-10-01 19:29:36	--------	d-----w-	c:\programdata\Premium
2012-10-01 19:29:33	--------	d-----w-	c:\program files\SProtector
2012-10-01 19:29:24	--------	d-----w-	c:\program files\GadgetBox
2012-10-01 19:29:07	--------	d-----w-	c:\programdata\InstallMate
2012-09-30 19:24:36	347136	----a-w-	c:\users\janis\appdata\roaming\963D.exe
2012-09-30 17:11:00	--------	d-----w-	c:\program files\ps3emu
2012-09-28 17:27:43	369664	----a-w-	c:\users\janis\appdata\roaming\E7AA.exe
2012-09-28 17:19:47	348160	----a-w-	c:\users\janis\appdata\roaming\A3F5.exe
2012-09-28 16:53:39	353280	----a-w-	c:\users\janis\appdata\roaming\B7A3.exe
2012-09-28 16:36:55	353280	----a-w-	c:\users\janis\appdata\roaming\66A5.exe
2012-09-28 16:30:23	353280	----a-w-	c:\users\janis\appdata\roaming\6AD8.exe
2012-09-26 18:31:46	56200	----a-w-	c:\programdata\microsoft\windows defender\definition updates\{6bb8abbd-b80f-46c1-9878-7292ddc844c6}\offreg.dll
2012-09-20 21:00:03	--------	d-----w-	c:\windows\Profiles
2012-09-17 15:10:54	--------	d-----w-	c:\users\janis\2012-09-16 time 13_15_46 Outgoing Peer-to-Peer Call killakeks97_data
2012-09-14 14:57:29	--------	d-----w-	c:\users\janis\flash-disinfector-
2012-09-13 21:11:39	132597	----a-w-	c:\users\janis\flash-disinfector-.exe
2012-09-10 18:23:36	--------	d-----w-	c:\programdata\ALM
2012-09-10 18:01:29	--------	d-----w-	c:\users\janis\crack il
2012-09-10 16:14:15	--------	d-----w-	c:\users\janis\stick musik
2012-09-10 14:48:07	--------	d-----w-	c:\programdata\Ralink
2012-09-10 14:45:14	562464	----a-w-	c:\windows\system32\drivers\netr73.sys
2012-09-10 14:45:14	226592	----a-w-	c:\windows\system32\RaCoInst.dll
2012-09-10 14:45:12	--------	d-----w-	c:\programdata\RalinkRT7x Driver
2012-09-10 14:43:52	776480	----a-w-	c:\windows\system32\RAIHV.dll
2012-09-10 14:43:52	102688	----a-w-	c:\windows\system32\RAEXTUI.dll
2012-09-10 14:43:50	1590560	----a-w-	c:\windows\system32\RaCertMgr.dll
2012-09-10 14:43:44	--------	d-----w-	c:\program files\Hama
2012-09-09 12:12:25	--------	d-----w-	c:\program files\Skype Recorder
2012-09-09 12:02:56	153	----a-w-	c:\users\janis\settings.bin
2012-09-07 15:56:23	--------	d-----w-	c:\program files\Tunatic
2012-09-06 09:37:57	--------	d-----w-	c:\users\janis\appdata\roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2012-09-05 09:07:55	--------	d-----w-	c:\users\janis\appdata\roaming\Iminent
2012-09-05 07:52:20	--------	d-----r-	c:\users\janis\sound
2012-09-04 20:34:39	--------	d-----w-	c:\program files\VideoLAN
2012-09-04 14:26:58	--------	d-----w-	c:\users\janis\savegame cod 4 janis
2012-09-04 08:12:21	93672	----a-w-	c:\windows\system32\WindowsAccessBridge.dll
2012-09-04 08:09:09	--------	d-----w-	c:\users\janis\PS3
.
==================== Find3M  ====================
.
2012-09-21 20:51:36	73136	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-21 20:51:36	696240	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2012-09-04 08:11:45	821736	----a-w-	c:\windows\system32\npdeployJava1.dll
2012-09-04 08:11:45	746984	----a-w-	c:\windows\system32\deployJava1.dll
2012-08-27 14:31:34	299047	----a-w-	c:\users\janis\Crusader_Multihack_Beta.exe
.
============= FINISH: 22:03:28,72 ===============
[/CODE]
--- --- ---
--- --- ---

--- --- ---


Das war's,
Gruß, Janis


Alt 03.10.2012, 06:23   #6
schrauber
/// the machine
/// TB-Ausbilder
 
selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc...... - Standard

selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc......


Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!
Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.
__________________
--> selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc......

Alt 03.10.2012, 11:14   #7
Janis540
 
selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc...... - Standard

selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc......


Danke, schrauber.

Das ist das Text file:

Combofix Logfile:
Code:
ATTFilter
ComboFix 12-10-02.02 - Janis 03.10.2012  11:33:08.1.2 - x86
Microsoft Windows 7 Home Premium   6.1.7600.0.1252.49.1033.18.1014.302 [GMT 2:00]
ausgeführt von:: c:\downloads\ComboFix.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\DealPly
c:\program files\DealPly\DealPlyTune.dll
c:\users\Janis\AppData\Roaming\66A5.exe
c:\users\Janis\AppData\Roaming\6AD8.exe
c:\users\Janis\AppData\Roaming\963D.exe
c:\users\Janis\AppData\Roaming\A3F5.exe
c:\users\Janis\AppData\Roaming\A86B.exe
c:\users\Janis\AppData\Roaming\B7A3.exe
c:\users\Janis\AppData\Roaming\E7AA.exe
c:\users\Janis\AppData\Roaming\Microsoft\Windows\Templates\Lame_v3.99.3_for_Windows.exe
c:\users\Janis\Crusader_Multihack_Beta.exe
c:\users\Janis\flash-disinfector-.exe
c:\windows\IsUn0407.exe
c:\windows\system32\drivers\etc\hosts.ics
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-09-03 bis 2012-10-03  ))))))))))))))))))))))))))))))
.
.
2012-10-03 09:53 . 2012-10-03 09:54	--------	d-----w-	c:\users\Janis\AppData\Local\temp
2012-10-03 09:53 . 2012-10-03 09:53	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-10-03 09:17 . 2012-10-03 09:17	195072	----a-w-	c:\users\Janis\AppData\Roaming\Fztitn.exe
2012-10-01 19:29 . 2012-10-01 19:29	--------	d-----w-	c:\programdata\Premium
2012-10-01 19:29 . 2012-10-01 19:29	--------	d-----w-	c:\program files\SProtector
2012-10-01 19:29 . 2012-10-01 19:29	--------	d-----w-	c:\program files\GadgetBox
2012-10-01 19:29 . 2012-10-01 19:29	--------	d-----w-	c:\programdata\InstallMate
2012-09-30 17:11 . 2012-09-30 17:11	--------	d-----w-	c:\program files\ps3emu
2012-09-26 18:31 . 2012-10-01 15:04	56200	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{6BB8ABBD-B80F-46C1-9878-7292DDC844C6}\offreg.dll
2012-09-20 21:00 . 2012-09-20 21:00	--------	d-----w-	c:\windows\Profiles
2012-09-20 20:59 . 2012-09-20 21:00	--------	d-----w-	c:\users\Cinema 4D
2012-09-18 19:40 . 2012-09-18 19:40	--------	d-----w-	c:\windows\Sun
2012-09-17 15:10 . 2012-09-17 15:11	--------	d-----w-	c:\users\Janis\2012-09-16 time 13_15_46 Outgoing Peer-to-Peer Call killakeks97_data
2012-09-14 14:57 . 2012-09-14 14:57	--------	d-----w-	c:\users\Janis\flash-disinfector-
2012-09-10 18:23 . 2012-09-10 18:23	--------	d-----w-	c:\programdata\ALM
2012-09-10 18:01 . 2012-09-10 18:25	--------	d-----w-	c:\users\Janis\crack il
2012-09-10 16:14 . 2012-09-10 16:15	--------	d-----w-	c:\users\Janis\stick musik
2012-09-10 14:48 . 2012-09-26 19:34	--------	d-----w-	c:\programdata\Ralink
2012-09-10 14:45 . 2010-02-24 13:06	562464	----a-w-	c:\windows\system32\drivers\netr73.sys
2012-09-10 14:45 . 2010-02-24 12:07	226592	----a-w-	c:\windows\system32\RaCoInst.dll
2012-09-10 14:43 . 2009-12-10 10:16	776480	----a-w-	c:\windows\system32\RAIHV.dll
2012-09-10 14:43 . 2009-12-10 10:16	102688	----a-w-	c:\windows\system32\RAEXTUI.dll
2012-09-10 14:43 . 2009-12-10 10:16	1590560	----a-w-	c:\windows\system32\RaCertMgr.dll
2012-09-10 14:43 . 2012-09-10 14:43	--------	d-----w-	c:\program files\Hama
2012-09-09 12:12 . 2012-09-20 21:00	--------	d-----w-	c:\program files\Skype Recorder
2012-09-09 12:02 . 2012-09-09 12:02	153	----a-w-	c:\users\Janis\settings.bin
2012-09-07 15:56 . 2012-09-07 15:56	--------	d-----w-	c:\program files\Tunatic
2012-09-06 09:37 . 2012-09-06 09:37	--------	d-----w-	c:\users\Janis\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2012-09-05 09:07 . 2012-09-05 09:07	--------	d-----w-	c:\users\Janis\AppData\Roaming\Iminent
2012-09-05 07:52 . 2012-09-05 07:52	--------	d-----r-	c:\users\Janis\sound
2012-09-04 20:35 . 2012-09-05 20:26	--------	d-----w-	c:\users\Janis\AppData\Roaming\vlc
2012-09-04 20:34 . 2012-09-04 20:34	--------	d-----w-	c:\program files\VideoLAN
2012-09-04 14:26 . 2012-09-04 14:27	--------	d-----w-	c:\users\Janis\savegame cod 4 janis
2012-09-04 08:17 . 2012-09-04 08:17	--------	d-----w-	c:\program files\Common Files\Java
2012-09-04 08:12 . 2012-09-04 08:11	93672	----a-w-	c:\windows\system32\WindowsAccessBridge.dll
2012-09-04 08:11 . 2012-09-04 08:11	--------	d-----w-	c:\program files\Java
2012-09-04 08:09 . 2012-09-04 08:09	--------	d-----w-	c:\users\Janis\PS3
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-21 20:51 . 2012-04-11 23:57	73136	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-21 20:51 . 2012-04-11 23:57	696240	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2012-09-04 08:11 . 2012-03-06 13:59	821736	----a-w-	c:\windows\system32\npdeployJava1.dll
2012-09-04 08:11 . 2012-03-06 13:59	746984	----a-w-	c:\windows\system32\deployJava1.dll
2012-06-14 22:19 . 2012-07-04 22:57	85472	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Fztitn"="c:\users\Janis\AppData\Roaming\Fztitn.exe" [2012-10-03 195072]
"MP3 Skype Recorder"="c:\program files\MP3 Skype Recorder\MP3 Skype Recorder.exe" [2011-11-17 1975296]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"S6000Mnt"="S6000Rmv.dll " [X]
"IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe" [2009-05-19 136544]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2011-12-13 11487848]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 150552]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 173592]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-10-07 1387288]
"Broadcom Wireless Manager UI"="c:\program files\Broadcom\Broadcom 802.11 Network Adapter\WLTRAY.exe" [2012-03-06 6475264]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS6ServiceManager"="c:\program files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-03-09 1073312]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"Skype Recorder"="c:\program files\Skype Recorder\Skype Recorder.exe" [2012-09-09 720896]
.
c:\users\Janis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
explorer.exe [2011-2-26 2614784]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Hama Wireless LAN Utility.lnk - c:\program files\Hama\Common\RaUI.exe [2012-9-10 1671168]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2011-09-27 19:03	66328	----a-w-	c:\program files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0c:\progra~2\AVG\AVG2012\avgrsx.exe /sync /restart
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Orbit.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Orbit.lnk
backup=c:\windows\pss\Orbit.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-03 13:10	843712	----a-w-	c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]
2010-03-13 13:54	91520	----a-w-	c:\program files\Microsoft Office\Office14\BCSSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Fztitn]
2012-10-03 09:17	195072	----a-w-	c:\users\Janis\AppData\Roaming\Fztitn.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2012-03-06 13:33	136176	----atw-	c:\users\Janis\AppData\Local\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2012-07-13 11:33	17418928	----a-r-	c:\program files\Skype\Phone\Skype.exe
.
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [x]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\avgidsagent.exe [x]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [x]
R2 gupdate;Google Update-Dienst (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x]
R2 KMService;KMService;c:\windows\system32\srvany.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
R3 EraserUtilDrv11113;EraserUtilDrv11113;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11113.sys [x]
R3 EraserUtilDrv11122;EraserUtilDrv11122;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11122.sys [x]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [x]
R3 netr73;RT73 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr73.sys [x]
R3 NLNdisMP;NLNdisMP;c:\windows\system32\DRIVERS\nlndis.sys [x]
R3 NLNdisPT;NetLimiter Ndis Protocol Service;c:\windows\system32\DRIVERS\nlndis.sys [x]
R3 PortTalk;PortTalk;c:\windows\system32\Drivers\PortTalk.sys [x]
R3 S6000KNT;S6000KNT_WebCam Driver;c:\windows\system32\Drivers\S6000KNT.sys [x]
R3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [x]
R3 SwitchBoard;Adobe SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files\IObit\Game Booster 3\Driver\WinRing0.sys [x]
S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys [x]
S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [x]
S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdriverx.sys [x]
S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\avgidsfilterx.sys [x]
S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\avgidsshimx.sys [x]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-10-03 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-11 20:51]
.
2012-10-03 c:\windows\Tasks\GBoxUpdaterTask{BB9A370B-C90C-4552-A89E-FF2EBE445C96}.job
- c:\programdata\Premium\GBox\GBox.exe [2012-10-01 12:31]
.
2012-10-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-04-16 23:50]
.
2012-10-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-04-16 23:50]
.
2012-10-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2531966209-3547886753-3818554424-1000Core.job
- c:\users\Janis\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-06 13:33]
.
2012-10-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2531966209-3547886753-3818554424-1000UA.job
- c:\users\Janis\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-06 13:33]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = https://isearch.avg.com/?cid={123DB6E3-65D0-4739-BE8A-6F30961BFD49}&mid=796bcf77900347d08b28d16a1c858f15-4dda9021002b6c4077fe60294b0ad61d9441fe9a&lang=en&ds=yu012&pr=sa&d=2012-08-14 15:54&v=12.1.0.20&sap=hp
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: An OneNote s&enden - c:\progra~2\MICROS~2\Office14\ONBttnIE.dll/105
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: Download with &Media Finder - c:\program files\Media Finder\hook.html
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 82.212.62.62 192.168.0.1
FF - ProfilePath - c:\users\Janis\AppData\Roaming\Mozilla\Firefox\Profiles\bw776v5k.default\
FF - prefs.js: browser.startup.homepage - hxxp://search.iminent.com/?appId=f4539de6-f4fd-40fe-9b84-0c6e9e69524c&lcid=1031&ref=homepage
FF - prefs.js: keyword.URL - hxxps://isearch.avg.com/search?cid={123DB6E3-65D0-4739-BE8A-6F30961BFD49}&mid=796bcf77900347d08b28d16a1c858f15-4dda9021002b6c4077fe60294b0ad61d9441fe9a&lang=en&ds=yu012&pr=sa&d=2012-08-14 15:54&v=12.2.5.32&sap=ku&q=
user_pref('extensions.dealply.partner', 'vita');
user_pref('extensions.dealply.channel', 'vitaeazel');
user_pref('extensions.dealply.installId', 'v23500236973251394706402012061719195630');
user_pref('extensions.dealply.installIdSource', 'inst');
user_pref('extensions.dealply.sampleGroup', '0');
user_pref('extensions.dealply.partner', 'vita');
user_pref('extensions.dealply.channel', 'vitaeazel');
user_pref('extensions.dealply.installId', 'v23500236973251394706402012061719195630');
user_pref('extensions.dealply.installIdSource', 'inst');
user_pref('extensions.dealply.sampleGroup', '0');
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=112555&tt=060612_5_
FF - user.js: extensions.BabylonToolbar_i.babExt - 
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - 70fd172f00000000000000235a6166e6
FF - user.js: extensions.BabylonToolbar_i.hardId - 70fd172f00000000000000235a6166e6
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15511
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1720:56
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{84FF7BD6-B47F-46F8-9130-01B2696B36CB} - (no file)
BHO-{84FF7BD6-B47F-46F8-9130-01B2696B36CB} - (no file)
HKCU-Run-ViStart - c:\program files\ViStart\ViStart.exe
HKCU-Run-AdobeBridge - (no file)
HKCU-Run-WINSXS32 - c:\users\Janis\AppData\Roaming\A86B.exe
HKLM-Run-Driver Genius - (no file)
HKLM-Run-WINSXS32 - c:\users\Janis\AppData\Roaming\DA66.exe
HKLM-Run-TaskTray - (no file)
HKLM-Run-Iminent - c:\program files\Iminent\Iminent.exe
HKLM-Run-IminentMessenger - c:\program files\Iminent\Iminent.Messengers.exe
HKLM-Run-ROC_ROC_JULY_P1 - c:\program files\AVG Secure Search\ROC_ROC_JULY_P1.exe
MSConfigStartUp-avgnt - c:\program files\Avira\AntiVir Desktop\avgnt.exe
MSConfigStartUp-Media Finder - c:\program files\Media Finder\MF.exe
MSConfigStartUp-MicroUpdate - c:\users\Janis\Documents\MSDCSC\01M7kAsKUXn3\msdcsc.exe
MSConfigStartUp-NetLimiter - c:\program files\NetLimiter 3\NLClientApp.exe
MSConfigStartUp-vProt - c:\program files\AVG Secure Search\vprot.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{95B7759C-8C7F-4BF1-B163-73684A933233}"=hex:51,66,7a,6c,4c,1d,38,12,f2,76,a4,
   91,4d,c2,9f,0e,ce,75,30,28,4f,cd,76,27
"{000123B4-9B42-4900-B3F7-F4B073EFC214}"=hex:51,66,7a,6c,4c,1d,38,12,da,20,12,
   04,70,d5,6e,0c,cc,e1,b7,f0,76,b1,86,00
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
   1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{31332EEF-CB9F-458F-AFEB-D30E9A66B6BA}"=hex:51,66,7a,6c,4c,1d,38,12,81,2d,20,
   35,ad,85,e1,00,d0,fd,90,4e,9f,38,f2,ae
"{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}"=hex:51,66,7a,6c,4c,1d,38,12,7c,f0,b1,
   38,5c,21,3d,0e,d9,78,0d,25,e1,c9,8c,d4
"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"=hex:51,66,7a,6c,4c,1d,38,12,0f,32,96,
   76,f7,7e,4c,08,c8,ef,48,fc,18,66,e7,6a
"{B4F3A835-0E21-4959-BA22-42B3008E02FF}"=hex:51,66,7a,6c,4c,1d,38,12,5b,ab,e0,
   b0,13,40,37,0c,c5,34,01,f3,05,d0,46,eb
"{CA4520F3-AE13-4FB1-A513-58E23991C86D}"=hex:51,66,7a,6c,4c,1d,38,12,9d,23,56,
   ce,21,e0,df,0a,da,05,1b,a2,3c,cf,8c,79
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
   df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*M*a*i*l*aާG\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*m*p*Ö‘Um\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*m*p*ƛi\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*m*p*»ýi\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*_*m*a*r*i*o*_*w*i*n*a*n*s*_*-*_*i*_*n*e*e*d*_*a*_*g*i*r*l*_*p*a*r*t*_*3*ˆmm\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*G|št]
@Class="Shell"
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*G|št\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.**€ŸÞ§G]
@Class="Shell"
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.**€ŸÞ§G\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.**€žß§G]
@Class="Shell"
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.**€žß§G\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*G|št]
@Allowed: (Read) (RestrictedCode)
"0"=hex:43,3a,5c,55,73,65,72,73,5c,4a,61,6e,69,73,5c,44,65,73,6b,74,6f,70,5c,
   47,65,72,6d,61,6e,20,54,6f,70,20,31,30,30,20,53,69,6e,67,6c,65,20,43,68,61,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.**€ŸÞ§G]
@Allowed: (Read) (RestrictedCode)
"0"=hex:48,00,61,00,6c,00,20,00,43,00,61,00,6e,00,6e,00,56,fa,a2,42,2e,00,00,
   80,9f,de,a7,47,00,00,86,00,36,00,00,00,00,00,00,00,00,00,00,00,48,00,61,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.**€žß§G]
@Allowed: (Read) (RestrictedCode)
"0"=hex:48,00,61,00,6c,00,20,00,43,00,61,00,6e,00,6e,00,56,fa,a2,42,2e,00,00,
   80,9e,df,a7,47,00,00,86,00,36,00,00,00,00,00,00,00,00,00,00,00,48,00,61,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-10-03  12:00:15
ComboFix-quarantined-files.txt  2012-10-03 10:00
.
Vor Suchlauf: 23 Verzeichnis(se), 22.124.974.080 Bytes frei
Nach Suchlauf: 30 Verzeichnis(se), 23.053.103.104 Bytes frei
.
- - End Of File - - 34727DBB192449BBDB7B1FD505BDF8B1
--- --- ---
Alt 03.10.2012, 15:15   #8
schrauber
/// the machine
/// TB-Ausbilder
 
selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc...... - Standard

selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc......


Combofix muss vom Desktop ausgeführt werden. Bitte Combofix löschen, neu laden auf den Desktop und nochmal laufen lassen.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 03.10.2012, 16:57   #9
Janis540
 
selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc...... - Standard

selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc......


Alles klar, ich hab das jetzt nochmal gemacht.
Wenns wieder falsch ist, weiß ich auch nicht was los ist...

Combofix Logfile:
Code:
ATTFilter
ComboFix 12-10-03.03 - Janis 03.10.2012  17:30:32.2.2 - x86
Microsoft Windows 7 Home Premium   6.1.7600.0.1252.49.1033.18.1014.347 [GMT 2:00]
ausgeführt von:: c:\downloads\ComboFix.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Cinema 4D\Documents\MSDCSC\msdcsc.exe
c:\users\Janis\AppData\Roaming\Fztitn.exe
c:\users\Janis\Documents\MSDCSC\msdcsc.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-09-03 bis 2012-10-03  ))))))))))))))))))))))))))))))
.
.
2012-10-03 15:49 . 2012-10-03 15:49	--------	d-----w-	c:\users\Janis\AppData\Local\temp
2012-10-03 15:49 . 2012-10-03 15:49	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-10-01 19:29 . 2012-10-01 19:29	--------	d-----w-	c:\programdata\Premium
2012-10-01 19:29 . 2012-10-01 19:29	--------	d-----w-	c:\program files\SProtector
2012-10-01 19:29 . 2012-10-01 19:29	--------	d-----w-	c:\program files\GadgetBox
2012-10-01 19:29 . 2012-10-01 19:29	--------	d-----w-	c:\programdata\InstallMate
2012-09-30 17:11 . 2012-09-30 17:11	--------	d-----w-	c:\program files\ps3emu
2012-09-26 18:31 . 2012-10-01 15:04	56200	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{6BB8ABBD-B80F-46C1-9878-7292DDC844C6}\offreg.dll
2012-09-20 21:00 . 2012-09-20 21:00	--------	d-----w-	c:\windows\Profiles
2012-09-20 20:59 . 2012-09-20 21:00	--------	d-----w-	c:\users\Cinema 4D
2012-09-18 19:40 . 2012-09-18 19:40	--------	d-----w-	c:\windows\Sun
2012-09-17 15:10 . 2012-09-17 15:11	--------	d-----w-	c:\users\Janis\2012-09-16 time 13_15_46 Outgoing Peer-to-Peer Call killakeks97_data
2012-09-14 14:57 . 2012-09-14 14:57	--------	d-----w-	c:\users\Janis\flash-disinfector-
2012-09-10 18:23 . 2012-09-10 18:23	--------	d-----w-	c:\programdata\ALM
2012-09-10 18:01 . 2012-09-10 18:25	--------	d-----w-	c:\users\Janis\crack il
2012-09-10 16:14 . 2012-09-10 16:15	--------	d-----w-	c:\users\Janis\stick musik
2012-09-10 14:48 . 2012-09-26 19:34	--------	d-----w-	c:\programdata\Ralink
2012-09-10 14:45 . 2010-02-24 13:06	562464	----a-w-	c:\windows\system32\drivers\netr73.sys
2012-09-10 14:45 . 2010-02-24 12:07	226592	----a-w-	c:\windows\system32\RaCoInst.dll
2012-09-10 14:43 . 2009-12-10 10:16	776480	----a-w-	c:\windows\system32\RAIHV.dll
2012-09-10 14:43 . 2009-12-10 10:16	102688	----a-w-	c:\windows\system32\RAEXTUI.dll
2012-09-10 14:43 . 2009-12-10 10:16	1590560	----a-w-	c:\windows\system32\RaCertMgr.dll
2012-09-10 14:43 . 2012-09-10 14:43	--------	d-----w-	c:\program files\Hama
2012-09-09 12:12 . 2012-09-20 21:00	--------	d-----w-	c:\program files\Skype Recorder
2012-09-09 12:02 . 2012-09-09 12:02	153	----a-w-	c:\users\Janis\settings.bin
2012-09-07 15:56 . 2012-09-07 15:56	--------	d-----w-	c:\program files\Tunatic
2012-09-06 09:37 . 2012-09-06 09:37	--------	d-----w-	c:\users\Janis\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2012-09-05 09:07 . 2012-09-05 09:07	--------	d-----w-	c:\users\Janis\AppData\Roaming\Iminent
2012-09-05 07:52 . 2012-09-05 07:52	--------	d-----r-	c:\users\Janis\sound
2012-09-04 20:35 . 2012-09-05 20:26	--------	d-----w-	c:\users\Janis\AppData\Roaming\vlc
2012-09-04 20:34 . 2012-09-04 20:34	--------	d-----w-	c:\program files\VideoLAN
2012-09-04 14:26 . 2012-09-04 14:27	--------	d-----w-	c:\users\Janis\savegame cod 4 janis
2012-09-04 08:17 . 2012-09-04 08:17	--------	d-----w-	c:\program files\Common Files\Java
2012-09-04 08:12 . 2012-09-04 08:11	93672	----a-w-	c:\windows\system32\WindowsAccessBridge.dll
2012-09-04 08:11 . 2012-09-04 08:11	--------	d-----w-	c:\program files\Java
2012-09-04 08:09 . 2012-09-04 08:09	--------	d-----w-	c:\users\Janis\PS3
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-21 20:51 . 2012-04-11 23:57	73136	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-21 20:51 . 2012-04-11 23:57	696240	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2012-09-04 08:11 . 2012-03-06 13:59	821736	----a-w-	c:\windows\system32\npdeployJava1.dll
2012-09-04 08:11 . 2012-03-06 13:59	746984	----a-w-	c:\windows\system32\deployJava1.dll
2012-06-14 22:19 . 2012-07-04 22:57	85472	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MP3 Skype Recorder"="c:\program files\MP3 Skype Recorder\MP3 Skype Recorder.exe" [2011-11-17 1975296]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"S6000Mnt"="S6000Rmv.dll " [X]
"IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe" [2009-05-19 136544]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2011-12-13 11487848]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 150552]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 173592]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-10-07 1387288]
"Broadcom Wireless Manager UI"="c:\program files\Broadcom\Broadcom 802.11 Network Adapter\WLTRAY.exe" [2012-03-06 6475264]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS6ServiceManager"="c:\program files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-03-09 1073312]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"Skype Recorder"="c:\program files\Skype Recorder\Skype Recorder.exe" [2012-09-09 720896]
.
c:\users\Janis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
explorer.exe [2011-2-26 2614784]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Hama Wireless LAN Utility.lnk - c:\program files\Hama\Common\RaUI.exe [2012-9-10 1671168]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2011-09-27 19:03	66328	----a-w-	c:\program files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0c:\progra~2\AVG\AVG2012\avgrsx.exe /sync /restart
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Orbit.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Orbit.lnk
backup=c:\windows\pss\Orbit.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-03 13:10	843712	----a-w-	c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]
2010-03-13 13:54	91520	----a-w-	c:\program files\Microsoft Office\Office14\BCSSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2012-03-06 13:33	136176	----atw-	c:\users\Janis\AppData\Local\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2012-07-13 11:33	17418928	----a-r-	c:\program files\Skype\Phone\Skype.exe
.
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [x]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\avgidsagent.exe [x]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [x]
R2 gupdate;Google Update-Dienst (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x]
R2 KMService;KMService;c:\windows\system32\srvany.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
R3 EraserUtilDrv11113;EraserUtilDrv11113;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11113.sys [x]
R3 EraserUtilDrv11122;EraserUtilDrv11122;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11122.sys [x]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [x]
R3 netr73;RT73 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr73.sys [x]
R3 NLNdisMP;NLNdisMP;c:\windows\system32\DRIVERS\nlndis.sys [x]
R3 NLNdisPT;NetLimiter Ndis Protocol Service;c:\windows\system32\DRIVERS\nlndis.sys [x]
R3 PortTalk;PortTalk;c:\windows\system32\Drivers\PortTalk.sys [x]
R3 S6000KNT;S6000KNT_WebCam Driver;c:\windows\system32\Drivers\S6000KNT.sys [x]
R3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [x]
R3 SwitchBoard;Adobe SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files\IObit\Game Booster 3\Driver\WinRing0.sys [x]
S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys [x]
S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [x]
S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdriverx.sys [x]
S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\avgidsfilterx.sys [x]
S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\avgidsshimx.sys [x]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-10-03 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-11 20:51]
.
2012-10-03 c:\windows\Tasks\GBoxUpdaterTask{BB9A370B-C90C-4552-A89E-FF2EBE445C96}.job
- c:\programdata\Premium\GBox\GBox.exe [2012-10-01 12:31]
.
2012-10-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-04-16 23:50]
.
2012-10-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-04-16 23:50]
.
2012-10-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2531966209-3547886753-3818554424-1000Core.job
- c:\users\Janis\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-06 13:33]
.
2012-10-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2531966209-3547886753-3818554424-1000UA.job
- c:\users\Janis\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-06 13:33]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = https://isearch.avg.com/?cid={123DB6E3-65D0-4739-BE8A-6F30961BFD49}&mid=796bcf77900347d08b28d16a1c858f15-4dda9021002b6c4077fe60294b0ad61d9441fe9a&lang=en&ds=yu012&pr=sa&d=2012-08-14 15:54&v=12.1.0.20&sap=hp
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: An OneNote s&enden - c:\progra~2\MICROS~2\Office14\ONBttnIE.dll/105
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: Download with &Media Finder - c:\program files\Media Finder\hook.html
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 82.212.62.62 192.168.0.1
FF - ProfilePath - c:\users\Janis\AppData\Roaming\Mozilla\Firefox\Profiles\bw776v5k.default\
FF - prefs.js: browser.startup.homepage - hxxp://search.iminent.com/?appId=f4539de6-f4fd-40fe-9b84-0c6e9e69524c&lcid=1031&ref=homepage
FF - prefs.js: keyword.URL - hxxps://isearch.avg.com/search?cid={123DB6E3-65D0-4739-BE8A-6F30961BFD49}&mid=796bcf77900347d08b28d16a1c858f15-4dda9021002b6c4077fe60294b0ad61d9441fe9a&lang=en&ds=yu012&pr=sa&d=2012-08-14 15:54&v=12.2.5.32&sap=ku&q=
user_pref('extensions.dealply.partner', 'vita');
user_pref('extensions.dealply.channel', 'vitaeazel');
user_pref('extensions.dealply.installId', 'v23500236973251394706402012061719195630');
user_pref('extensions.dealply.installIdSource', 'inst');
user_pref('extensions.dealply.sampleGroup', '0');
user_pref('extensions.dealply.partner', 'vita');
user_pref('extensions.dealply.channel', 'vitaeazel');
user_pref('extensions.dealply.installId', 'v23500236973251394706402012061719195630');
user_pref('extensions.dealply.installIdSource', 'inst');
user_pref('extensions.dealply.sampleGroup', '0');
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=112555&tt=060612_5_
FF - user.js: extensions.BabylonToolbar_i.babExt - 
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - 70fd172f00000000000000235a6166e6
FF - user.js: extensions.BabylonToolbar_i.hardId - 70fd172f00000000000000235a6166e6
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15511
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1720:56
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKCU-Run-Fztitn - c:\users\Janis\AppData\Roaming\Fztitn.exe
MSConfigStartUp-Fztitn - c:\users\Janis\AppData\Roaming\Fztitn.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{95B7759C-8C7F-4BF1-B163-73684A933233}"=hex:51,66,7a,6c,4c,1d,38,12,f2,76,a4,
   91,4d,c2,9f,0e,ce,75,30,28,4f,cd,76,27
"{000123B4-9B42-4900-B3F7-F4B073EFC214}"=hex:51,66,7a,6c,4c,1d,38,12,da,20,12,
   04,70,d5,6e,0c,cc,e1,b7,f0,76,b1,86,00
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
   1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{31332EEF-CB9F-458F-AFEB-D30E9A66B6BA}"=hex:51,66,7a,6c,4c,1d,38,12,81,2d,20,
   35,ad,85,e1,00,d0,fd,90,4e,9f,38,f2,ae
"{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}"=hex:51,66,7a,6c,4c,1d,38,12,7c,f0,b1,
   38,5c,21,3d,0e,d9,78,0d,25,e1,c9,8c,d4
"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"=hex:51,66,7a,6c,4c,1d,38,12,0f,32,96,
   76,f7,7e,4c,08,c8,ef,48,fc,18,66,e7,6a
"{B4F3A835-0E21-4959-BA22-42B3008E02FF}"=hex:51,66,7a,6c,4c,1d,38,12,5b,ab,e0,
   b0,13,40,37,0c,c5,34,01,f3,05,d0,46,eb
"{CA4520F3-AE13-4FB1-A513-58E23991C86D}"=hex:51,66,7a,6c,4c,1d,38,12,9d,23,56,
   ce,21,e0,df,0a,da,05,1b,a2,3c,cf,8c,79
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
   df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*M*a*i*l*aާG\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*m*p*Ö‘Um\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*m*p*ƛi\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*m*p*»ýi\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*_*m*a*r*i*o*_*w*i*n*a*n*s*_*-*_*i*_*n*e*e*d*_*a*_*g*i*r*l*_*p*a*r*t*_*3*ˆmm\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*G|št]
@Class="Shell"
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*G|št\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.**€ŸÞ§G]
@Class="Shell"
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.**€ŸÞ§G\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.**€žß§G]
@Class="Shell"
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.**€žß§G\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*G|št]
@Allowed: (Read) (RestrictedCode)
"0"=hex:43,3a,5c,55,73,65,72,73,5c,4a,61,6e,69,73,5c,44,65,73,6b,74,6f,70,5c,
   47,65,72,6d,61,6e,20,54,6f,70,20,31,30,30,20,53,69,6e,67,6c,65,20,43,68,61,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.**€ŸÞ§G]
@Allowed: (Read) (RestrictedCode)
"0"=hex:48,00,61,00,6c,00,20,00,43,00,61,00,6e,00,6e,00,56,fa,a2,42,2e,00,00,
   80,9f,de,a7,47,00,00,86,00,36,00,00,00,00,00,00,00,00,00,00,00,48,00,61,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.**€žß§G]
@Allowed: (Read) (RestrictedCode)
"0"=hex:48,00,61,00,6c,00,20,00,43,00,61,00,6e,00,6e,00,56,fa,a2,42,2e,00,00,
   80,9e,df,a7,47,00,00,86,00,36,00,00,00,00,00,00,00,00,00,00,00,48,00,61,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-10-03  17:54:17
ComboFix-quarantined-files.txt  2012-10-03 15:54
ComboFix2.txt  2012-10-03 10:00
.
Vor Suchlauf: 29 Verzeichnis(se), 21.680.721.920 Bytes frei
Nach Suchlauf: 30 Verzeichnis(se), 21.752.598.528 Bytes frei
.
- - End Of File - - D1711FB957BBBCE9F0450E85E2704112
--- --- ---
Alt 03.10.2012, 18:19   #10
schrauber
/// the machine
/// TB-Ausbilder
 
selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc...... - Standard

selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc......


Zitat:
ausgeführt von:: c:\downloads\ComboFix.exe
Verschieb doch einfach die Combofix.exe vom Downloads-Ordner auf den Desktop
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 03.10.2012, 19:44   #11
Janis540
 
selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc...... - Standard

selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc......


dafuq

Ich hab das Teil doch auf den Desktop gezogen o__o
Ok ich machs nochmal

Alt 03.10.2012, 19:51   #12
schrauber
/// the machine
/// TB-Ausbilder
 
selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc...... - Standard

selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc......


Mach am Besten ausschneiden/einfügen, nicht dass du durch irgend nen dummen zufall nur ne verknüpfung machst
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 03.10.2012, 20:26   #13
Janis540
 
selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc...... - Standard

selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc......


Rate, was ich aus irgend nem dummen Zufall gemacht hab...

Aber egal :P Hier ist jetz das richtige:

Combofix Logfile:
Code:
ATTFilter
ComboFix 12-10-03.03 - Janis 03.10.2012  20:52:53.3.2 - x86
Microsoft Windows 7 Home Premium   6.1.7600.0.1252.49.1033.18.1014.359 [GMT 2:00]
ausgeführt von:: c:\users\Janis\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-09-03 bis 2012-10-03  ))))))))))))))))))))))))))))))
.
.
2012-10-03 19:11 . 2012-10-03 19:11	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-10-03 15:54 . 2012-10-03 19:11	--------	d-----w-	c:\users\Janis\AppData\Local\temp
2012-10-01 19:29 . 2012-10-01 19:29	--------	d-----w-	c:\programdata\Premium
2012-10-01 19:29 . 2012-10-01 19:29	--------	d-----w-	c:\program files\SProtector
2012-10-01 19:29 . 2012-10-01 19:29	--------	d-----w-	c:\program files\GadgetBox
2012-10-01 19:29 . 2012-10-01 19:29	--------	d-----w-	c:\programdata\InstallMate
2012-09-30 17:11 . 2012-09-30 17:11	--------	d-----w-	c:\program files\ps3emu
2012-09-26 18:31 . 2012-10-03 17:46	56200	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{6BB8ABBD-B80F-46C1-9878-7292DDC844C6}\offreg.dll
2012-09-20 21:00 . 2012-09-20 21:00	--------	d-----w-	c:\windows\Profiles
2012-09-20 20:59 . 2012-09-20 21:00	--------	d-----w-	c:\users\Cinema 4D
2012-09-18 19:40 . 2012-09-18 19:40	--------	d-----w-	c:\windows\Sun
2012-09-17 15:10 . 2012-09-17 15:11	--------	d-----w-	c:\users\Janis\2012-09-16 time 13_15_46 Outgoing Peer-to-Peer Call killakeks97_data
2012-09-14 14:57 . 2012-09-14 14:57	--------	d-----w-	c:\users\Janis\flash-disinfector-
2012-09-10 18:23 . 2012-09-10 18:23	--------	d-----w-	c:\programdata\ALM
2012-09-10 18:01 . 2012-09-10 18:25	--------	d-----w-	c:\users\Janis\crack il
2012-09-10 16:14 . 2012-09-10 16:15	--------	d-----w-	c:\users\Janis\stick musik
2012-09-10 14:48 . 2012-09-26 19:34	--------	d-----w-	c:\programdata\Ralink
2012-09-10 14:45 . 2010-02-24 13:06	562464	----a-w-	c:\windows\system32\drivers\netr73.sys
2012-09-10 14:45 . 2010-02-24 12:07	226592	----a-w-	c:\windows\system32\RaCoInst.dll
2012-09-10 14:43 . 2009-12-10 10:16	776480	----a-w-	c:\windows\system32\RAIHV.dll
2012-09-10 14:43 . 2009-12-10 10:16	102688	----a-w-	c:\windows\system32\RAEXTUI.dll
2012-09-10 14:43 . 2009-12-10 10:16	1590560	----a-w-	c:\windows\system32\RaCertMgr.dll
2012-09-10 14:43 . 2012-09-10 14:43	--------	d-----w-	c:\program files\Hama
2012-09-09 12:12 . 2012-09-20 21:00	--------	d-----w-	c:\program files\Skype Recorder
2012-09-09 12:02 . 2012-09-09 12:02	153	----a-w-	c:\users\Janis\settings.bin
2012-09-07 15:56 . 2012-09-07 15:56	--------	d-----w-	c:\program files\Tunatic
2012-09-06 09:37 . 2012-09-06 09:37	--------	d-----w-	c:\users\Janis\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
2012-09-05 09:07 . 2012-09-05 09:07	--------	d-----w-	c:\users\Janis\AppData\Roaming\Iminent
2012-09-05 07:52 . 2012-09-05 07:52	--------	d-----r-	c:\users\Janis\sound
2012-09-04 20:35 . 2012-09-05 20:26	--------	d-----w-	c:\users\Janis\AppData\Roaming\vlc
2012-09-04 20:34 . 2012-09-04 20:34	--------	d-----w-	c:\program files\VideoLAN
2012-09-04 14:26 . 2012-09-04 14:27	--------	d-----w-	c:\users\Janis\savegame cod 4 janis
2012-09-04 08:17 . 2012-09-04 08:17	--------	d-----w-	c:\program files\Common Files\Java
2012-09-04 08:12 . 2012-09-04 08:11	93672	----a-w-	c:\windows\system32\WindowsAccessBridge.dll
2012-09-04 08:11 . 2012-09-04 08:11	--------	d-----w-	c:\program files\Java
2012-09-04 08:09 . 2012-09-04 08:09	--------	d-----w-	c:\users\Janis\PS3
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-21 20:51 . 2012-04-11 23:57	73136	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-09-21 20:51 . 2012-04-11 23:57	696240	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2012-09-04 08:11 . 2012-03-06 13:59	821736	----a-w-	c:\windows\system32\npdeployJava1.dll
2012-09-04 08:11 . 2012-03-06 13:59	746984	----a-w-	c:\windows\system32\deployJava1.dll
2012-06-14 22:19 . 2012-07-04 22:57	85472	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MP3 Skype Recorder"="c:\program files\MP3 Skype Recorder\MP3 Skype Recorder.exe" [2011-11-17 1975296]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"S6000Mnt"="S6000Rmv.dll " [X]
"IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe" [2009-05-19 136544]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2011-12-13 11487848]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 150552]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 173592]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-10-07 1387288]
"Broadcom Wireless Manager UI"="c:\program files\Broadcom\Broadcom 802.11 Network Adapter\WLTRAY.exe" [2012-03-06 6475264]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS6ServiceManager"="c:\program files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-03-09 1073312]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"Skype Recorder"="c:\program files\Skype Recorder\Skype Recorder.exe" [2012-09-09 720896]
.
c:\users\Janis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
explorer.exe [2011-2-26 2614784]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Hama Wireless LAN Utility.lnk - c:\program files\Hama\Common\RaUI.exe [2012-9-10 1671168]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2011-09-27 19:03	66328	----a-w-	c:\program files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0c:\progra~2\AVG\AVG2012\avgrsx.exe /sync /restart
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Orbit.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Orbit.lnk
backup=c:\windows\pss\Orbit.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-03 13:10	843712	----a-w-	c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]
2010-03-13 13:54	91520	----a-w-	c:\program files\Microsoft Office\Office14\BCSSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2012-03-06 13:33	136176	----atw-	c:\users\Janis\AppData\Local\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2012-07-13 11:33	17418928	----a-r-	c:\program files\Skype\Phone\Skype.exe
.
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [x]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\avgidsagent.exe [x]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [x]
R2 gupdate;Google Update-Dienst (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x]
R2 KMService;KMService;c:\windows\system32\srvany.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
R3 EraserUtilDrv11113;EraserUtilDrv11113;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11113.sys [x]
R3 EraserUtilDrv11122;EraserUtilDrv11122;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11122.sys [x]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [x]
R3 netr73;RT73 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr73.sys [x]
R3 NLNdisMP;NLNdisMP;c:\windows\system32\DRIVERS\nlndis.sys [x]
R3 NLNdisPT;NetLimiter Ndis Protocol Service;c:\windows\system32\DRIVERS\nlndis.sys [x]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [x]
R3 PortTalk;PortTalk;c:\windows\system32\Drivers\PortTalk.sys [x]
R3 S6000KNT;S6000KNT_WebCam Driver;c:\windows\system32\Drivers\S6000KNT.sys [x]
R3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [x]
R3 SwitchBoard;Adobe SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files\IObit\Game Booster 3\Driver\WinRing0.sys [x]
S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys [x]
S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [x]
S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdriverx.sys [x]
S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\avgidsfilterx.sys [x]
S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\avgidsshimx.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-10-03 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-11 20:51]
.
2012-10-03 c:\windows\Tasks\GBoxUpdaterTask{BB9A370B-C90C-4552-A89E-FF2EBE445C96}.job
- c:\programdata\Premium\GBox\GBox.exe [2012-10-01 12:31]
.
2012-10-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-04-16 23:50]
.
2012-10-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-04-16 23:50]
.
2012-10-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2531966209-3547886753-3818554424-1000Core.job
- c:\users\Janis\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-06 13:33]
.
2012-10-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2531966209-3547886753-3818554424-1000UA.job
- c:\users\Janis\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-06 13:33]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = https://isearch.avg.com/?cid={123DB6E3-65D0-4739-BE8A-6F30961BFD49}&mid=796bcf77900347d08b28d16a1c858f15-4dda9021002b6c4077fe60294b0ad61d9441fe9a&lang=en&ds=yu012&pr=sa&d=2012-08-14 15:54&v=12.1.0.20&sap=hp
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: An OneNote s&enden - c:\progra~2\MICROS~2\Office14\ONBttnIE.dll/105
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: Download with &Media Finder - c:\program files\Media Finder\hook.html
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 82.212.62.62 192.168.0.1
FF - ProfilePath - c:\users\Janis\AppData\Roaming\Mozilla\Firefox\Profiles\bw776v5k.default\
FF - prefs.js: browser.startup.homepage - hxxp://search.iminent.com/?appId=f4539de6-f4fd-40fe-9b84-0c6e9e69524c&lcid=1031&ref=homepage
FF - prefs.js: keyword.URL - hxxps://isearch.avg.com/search?cid={123DB6E3-65D0-4739-BE8A-6F30961BFD49}&mid=796bcf77900347d08b28d16a1c858f15-4dda9021002b6c4077fe60294b0ad61d9441fe9a&lang=en&ds=yu012&pr=sa&d=2012-08-14 15:54&v=12.2.5.32&sap=ku&q=
user_pref('extensions.dealply.partner', 'vita');
user_pref('extensions.dealply.channel', 'vitaeazel');
user_pref('extensions.dealply.installId', 'v23500236973251394706402012061719195630');
user_pref('extensions.dealply.installIdSource', 'inst');
user_pref('extensions.dealply.sampleGroup', '0');
user_pref('extensions.dealply.partner', 'vita');
user_pref('extensions.dealply.channel', 'vitaeazel');
user_pref('extensions.dealply.installId', 'v23500236973251394706402012061719195630');
user_pref('extensions.dealply.installIdSource', 'inst');
user_pref('extensions.dealply.sampleGroup', '0');
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=112555&tt=060612_5_
FF - user.js: extensions.BabylonToolbar_i.babExt - 
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - 70fd172f00000000000000235a6166e6
FF - user.js: extensions.BabylonToolbar_i.hardId - 70fd172f00000000000000235a6166e6
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15511
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1720:56
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{95B7759C-8C7F-4BF1-B163-73684A933233}"=hex:51,66,7a,6c,4c,1d,38,12,f2,76,a4,
   91,4d,c2,9f,0e,ce,75,30,28,4f,cd,76,27
"{000123B4-9B42-4900-B3F7-F4B073EFC214}"=hex:51,66,7a,6c,4c,1d,38,12,da,20,12,
   04,70,d5,6e,0c,cc,e1,b7,f0,76,b1,86,00
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
   1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{31332EEF-CB9F-458F-AFEB-D30E9A66B6BA}"=hex:51,66,7a,6c,4c,1d,38,12,81,2d,20,
   35,ad,85,e1,00,d0,fd,90,4e,9f,38,f2,ae
"{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}"=hex:51,66,7a,6c,4c,1d,38,12,7c,f0,b1,
   38,5c,21,3d,0e,d9,78,0d,25,e1,c9,8c,d4
"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"=hex:51,66,7a,6c,4c,1d,38,12,0f,32,96,
   76,f7,7e,4c,08,c8,ef,48,fc,18,66,e7,6a
"{B4F3A835-0E21-4959-BA22-42B3008E02FF}"=hex:51,66,7a,6c,4c,1d,38,12,5b,ab,e0,
   b0,13,40,37,0c,c5,34,01,f3,05,d0,46,eb
"{CA4520F3-AE13-4FB1-A513-58E23991C86D}"=hex:51,66,7a,6c,4c,1d,38,12,9d,23,56,
   ce,21,e0,df,0a,da,05,1b,a2,3c,cf,8c,79
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
   df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*M*a*i*l*aާG\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*m*p*Ö‘Um\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*m*p*ƛi\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*m*p*»ýi\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*_*m*a*r*i*o*_*w*i*n*a*n*s*_*-*_*i*_*n*e*e*d*_*a*_*g*i*r*l*_*p*a*r*t*_*3*ˆmm\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*G|št]
@Class="Shell"
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*G|št\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.**€ŸÞ§G]
@Class="Shell"
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.**€ŸÞ§G\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.**€žß§G]
@Class="Shell"
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.**€žß§G\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*G|št]
@Allowed: (Read) (RestrictedCode)
"0"=hex:43,3a,5c,55,73,65,72,73,5c,4a,61,6e,69,73,5c,44,65,73,6b,74,6f,70,5c,
   47,65,72,6d,61,6e,20,54,6f,70,20,31,30,30,20,53,69,6e,67,6c,65,20,43,68,61,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.**€ŸÞ§G]
@Allowed: (Read) (RestrictedCode)
"0"=hex:48,00,61,00,6c,00,20,00,43,00,61,00,6e,00,6e,00,56,fa,a2,42,2e,00,00,
   80,9f,de,a7,47,00,00,86,00,36,00,00,00,00,00,00,00,00,00,00,00,48,00,61,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.**€žß§G]
@Allowed: (Read) (RestrictedCode)
"0"=hex:48,00,61,00,6c,00,20,00,43,00,61,00,6e,00,6e,00,56,fa,a2,42,2e,00,00,
   80,9e,df,a7,47,00,00,86,00,36,00,00,00,00,00,00,00,00,00,00,00,48,00,61,00,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-10-03  21:16:37
ComboFix-quarantined-files.txt  2012-10-03 19:16
ComboFix2.txt  2012-10-03 10:00
.
Vor Suchlauf: 29 Verzeichnis(se), 18.122.334.208 Bytes frei
Nach Suchlauf: 30 Verzeichnis(se), 17.834.000.384 Bytes frei
.
- - End Of File - - 7E6B314E5AC42F013C7B44C246271941
--- --- ---
Alt 04.10.2012, 06:32   #14
schrauber
/// the machine
/// TB-Ausbilder
 
selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc...... - Standard

selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc......


Hi,

Downloade Dir bitte AdwCleaner auf deinen Desktop.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Suche.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 04.10.2012, 18:03   #15
Janis540
 
selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc...... - Standard

selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc......


Danke schrauber, hier ist das Text file:

# AdwCleaner v2.003 - Logfile created 10/04/2012 at 17:56:18
# Updated 23/09/2012 by Xplode
# Operating system : Windows 7 Home Premium (32 bits)
# User : Janis - JANIS-PC
# Boot Mode : Normal
# Running from : C:\Users\Janis\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

File Found : C:\Program Files\Mozilla Firefox\defaults\pref\all-iminent.js
File Found : C:\Program Files\Mozilla Firefox\searchplugins\avg-secure-search.xml
File Found : C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
File Found : C:\Program Files\Mozilla Firefox\searchplugins\SearchTheWeb.xml
File Found : C:\Users\Janis\AppData\Roaming\Mozilla\Firefox\Profiles\bw776v5k.default\searchplugins\SearchTheWeb.xml
Folder Found : C:\Program Files\AVG Secure Search
Folder Found : C:\ProgramData\Babylon
Folder Found : C:\ProgramData\boost_interprocess
Folder Found : C:\ProgramData\Iminent
Folder Found : C:\ProgramData\InstallMate
Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Iminent
Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Finder
Folder Found : C:\ProgramData\Premium
Folder Found : C:\Users\Janis\AppData\LocalLow\BabylonToolbar
Folder Found : C:\Users\Janis\AppData\Roaming\Iminent
Folder Found : C:\Users\Janis\AppData\Roaming\Media Finder
Folder Found : C:\Users\Janis\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\gencrawler@some.com
Folder Found : C:\Users\Janis\AppData\Roaming\Mozilla\Firefox\Profiles\bw776v5k.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444}

***** [Registry] *****

Key Found : HKCU\Software\IGearSettings
Key Found : HKCU\Software\Iminent
Key Found : HKCU\Software\MediaFinder
Key Found : HKCU\Software\Microsoft\Internet Explorer\MenuExt\Download with &Media Finder
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{BFFED5CA-8BDF-47CC-AED0-23F4E6D77732}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{CA4520F3-AE13-4FB1-A513-58E23991C86D}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CA4520F3-AE13-4FB1-A513-58E23991C86D}
Key Found : HKCU\Software\Softonic
Key Found : HKLM\Software\Babylon
Key Found : HKLM\SOFTWARE\Classes\AppID\{01994268-3C10-4044-A1EA-7A9C1B739A11}
Key Found : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Key Found : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Found : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Key Found : HKLM\SOFTWARE\Classes\AppID\Iminent.WebBooster.InternetExplorer.DLL
Key Found : HKLM\SOFTWARE\Classes\CLSID\{01A602A0-D0B9-445B-8081-719E4177C4A7}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{02C9C7B0-C7C8-4AAC-A9E4-55295BF60F8F}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{0398B101-6DA7-473F-A290-17D2FBC88CC0}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{0CC36196-8589-4B80-A771-D659411D7F90}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{143D96F9-EB64-48B3-B192-91C2C41A1F43}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{14F7D91F-F669-45C9-9F42-BACBFDB86EAD}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{187A6488-6E71-4A2A-B118-7BEFBFE58257}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{26C9BBE4-6D45-4AB6-A5B4-E068C9F5EF6D}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{2D065204-A024-4C39-8A38-EE7078EC7ACF}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{30F5476C-677B-4DB0-B397-51F5BFD86840}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{351798B1-C1D2-45AB-92B4-4D6C2D6AB5AF}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{3AEA1BEF-6195-46F4-ACA2-0ED14F7EFA1B}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{3D7F9AC3-BAC3-4E51-81D7-D121D79E550A}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{4498C5E9-93C6-4142-B6BE-F0C6DC48B77A}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{479BF2D6-E362-4A99-B1AB-BC764D7B97AE}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{492A108F-51D0-4BD8-899D-AD4AB2893064}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{4B6D6E60-FBD2-4E79-BF4B-886BC98F1797}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{5C176BA0-6FC0-4EBD-8ACF-24AC592506B6}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{60893E02-2E5B-43F9-A93A-BAD60C2DF6EF}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{6D39931F-451E-4BDD-BAF4-37FB96DBBA5D}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{76C684D2-C35D-4284-976A-D862F53ADB81}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{796D822A-C3F9-4A97-BAAB-42FE7628EA63}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{79EF3691-EC1A-4705-A01A-D2E36EC11758}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{82F41418-8E64-47EB-A7F1-4702A974D289}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{85D920CE-63A7-46DC-8992-41D1D2E07FAD}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{895ED5E8-ABB4-40C3-A0CA-2571964268E2}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{8AAC123A-1959-4A45-BFC5-E2D50783098A}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{A07956CD-81F8-4A03-B524-5D87E690DC83}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{B5E3B26B-6E5C-4865-A63D-58D04B10E245}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{B84D2DC5-42B2-4E5E-BF61-7B48152FF8EF}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{B89D5309-0367-4494-A92F-3D4C94F88307}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{C014EBF8-8854-448B-B5A4-557C4090EDCE}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{C31191DB-2F64-464C-B97C-6AC81ACB7AAC}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{C342C7A7-F622-4EF3-8B7F-ABB9FBE73F14}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{C4765B07-BC2F-477B-925C-B2BF24887823}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{C875C0A1-09E3-48D5-9F8E-BD337796FD14}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{CA4520F3-AE13-4FB1-A513-58E23991C86D}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{CD126DA6-FF5B-4181-AC13-54A62240D2FA}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{D8F01233-2DE6-4EE7-8988-37263F00651B}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{DD438708-AAB4-422D-A322-B619589F5680}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E812AE43-7799-4E67-8CF8-4104297A2D16}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{F0BAAEC7-9AE0-49FF-9C4B-86E774FF397F}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{F92193FD-2243-4401-9ACC-49FF30885898}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{FD21B8A2-910B-45AC-9C10-45E6A8B84984}
Key Found : HKLM\SOFTWARE\Classes\gencrawler_gc.GenCrawler
Key Found : HKLM\SOFTWARE\Classes\Iminent
Key Found : HKLM\SOFTWARE\Classes\Iminent.Business.Tinyfying.DownloadArgs
Key Found : HKLM\SOFTWARE\Classes\Iminent.Business.Tinyfying.LinkToPromoteArgs
Key Found : HKLM\SOFTWARE\Classes\Iminent.Business.Tinyfying.RawDataArgs
Key Found : HKLM\SOFTWARE\Classes\Iminent.Business.Tinyfying.TinyUrlArgs
Key Found : HKLM\SOFTWARE\Classes\Iminent.Business.Tinyfying.ViralLinkArgs
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.ClientCallback
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.ContractBase
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.AddToUserContentCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.CheckLoginStatusCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.CleanCacheCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GameOverCallback
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetCreditCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetInstallationContextCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetLoginStatusCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetLoginStatusResult
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetVariableCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.GetVariableResult
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.InstallationContextResult
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.LoadContentCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.LoadContentCommandResult
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.LoginCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.LoginStatusChangedCallback
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.LogoutCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.MergeIdentityCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.MyAccountCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.PlayContentCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.PostContentCallback
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.RecycleViewsCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.SetVariableCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.ShowBrowserWindowCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.ShowControlCenterCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.ShowPluginWindowCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.UserContentChangedCallback
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.VariableChangedCallback
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.WarmUpCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.DataContracts.WelcomeCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.ServerCommand
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.Communication.ServerResult
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.LightContent
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.LightUri
Key Found : HKLM\SOFTWARE\Classes\Iminent.Mediator.MediatorServiceProxy
Key Found : HKLM\SOFTWARE\Classes\IminentWebBooster.ActiveContentHandle.1
Key Found : HKLM\SOFTWARE\Classes\IminentWebBooster.ActiveContentHandler
Key Found : HKLM\SOFTWARE\Classes\IminentWebBooster.BrowserHelperObject
Key Found : HKLM\SOFTWARE\Classes\IminentWebBooster.BrowserHelperObject.1
Key Found : HKLM\SOFTWARE\Classes\IminentWebBooster.ScriptExtender
Key Found : HKLM\SOFTWARE\Classes\IminentWebBooster.ScriptExtender.1
Key Found : HKLM\SOFTWARE\Classes\IminentWebBooster.TinyUrlHandler
Key Found : HKLM\SOFTWARE\Classes\IminentWebBooster.TinyUrlHandler.1
Key Found : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Key Found : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Found : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Key Found : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Key Found : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Key Found : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Key Found : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Key Found : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Key Found : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Key Found : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Key Found : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Key Found : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Key Found : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Key Found : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Key Found : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Key Found : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Key Found : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Key Found : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Key Found : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Key Found : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Key Found : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Key Found : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Key Found : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Key Found : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Key Found : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Found : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Key Found : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Key Found : HKLM\SOFTWARE\Classes\Interface\{ACA608DB-A210-4253-B799-3FD24E9A7BF5}
Key Found : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Key Found : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Key Found : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Key Found : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Key Found : HKLM\SOFTWARE\Classes\Interface\{C58D664A-3DBC-4925-AE74-0382007DF113}
Key Found : HKLM\SOFTWARE\Classes\Interface\{C776D7F4-BA85-4B75-AAFC-3A0A11FE6E36}
Key Found : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Key Found : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Key Found : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Key Found : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Key Found : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Key Found : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Key Found : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Key Found : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Key Found : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Key Found : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Key Found : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Key Found : HKLM\SOFTWARE\Classes\MF
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{A9CAF365-EA35-45DA-BD8B-2EFA09D374AC}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\igdhbblpcellaljokkpfhcjlagemhgjl
Key Found : HKLM\Software\Iminent
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0AF350D9-3916-454B-AC53-0B0B65F41301}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BFFED5CA-8BDF-47CC-AED0-23F4E6D77732}
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA4520F3-AE13-4FB1-A513-58E23991C86D}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F7CF0E9A-D48B-4942-9537-259ED0568DF4}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP
Key Found : HKU\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Key Found : HKU\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKU\S-1-5-21-2531966209-3547886753-3818554424-1000\Software\Microsoft\Internet Explorer\SearchScopes\{BFFED5CA-8BDF-47CC-AED0-23F4E6D77732}
Value Found : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [webbooster@iminent.com]

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxps://isearch.avg.com/?cid={123DB6E3-65D0-4739-BE8A-6F30961BFD49}&mid=796bcf77900347d08b28d16a1c858f15-4dda9021002b6c4077fe60294b0ad61d9441fe9a&lang=en&ds=yu012&pr=sa&d=2012-08-14 15:54:10&v=12.1.0.20&sap=hp

-\\ Mozilla Firefox v13.0.1 (de)

Profile name : default
File : C:\Users\Janis\AppData\Roaming\Mozilla\Firefox\Profiles\bw776v5k.default\prefs.js

Found : user_pref("browser.babylon.HPOnNewTab", "search.babylon.com");
Found : user_pref("browser.search.defaultenginename", "AVG Secure Search");
Found : user_pref("browser.search.order.1", "Search the web (Babylon)");
Found : user_pref("browser.startup.homepage", "hxxp://search.iminent.com/?appId=f4539de6-f4fd-40fe-9b84-0c6e[...]
Found : user_pref("extensions.BabylonToolbar_i.aflt", "babsst");
Found : user_pref("extensions.BabylonToolbar_i.babExt", "");
Found : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=112555&tt=060612_5_");
Found : user_pref("extensions.BabylonToolbar_i.hardId", "70fd172f00000000000000235a6166e6");
Found : user_pref("extensions.BabylonToolbar_i.id", "70fd172f00000000000000235a6166e6");
Found : user_pref("extensions.BabylonToolbar_i.instlDay", "15511");
Found : user_pref("extensions.BabylonToolbar_i.instlRef", "sst");
Found : user_pref("extensions.BabylonToolbar_i.newTab", true);
Found : user_pref("extensions.BabylonToolbar_i.newTabUrl", "hxxp://search.babylon.com/?affID=112555&tt=06061[...]
Found : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");
Found : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");
Found : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Found : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
Found : user_pref("extensions.BabylonToolbar_i.tlbrId", "base");
Found : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");
Found : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1720:56:43");
Found : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");
Found : user_pref("greasemonkey.scriptvals.71f8f12556abe601d230ac099af2e207/Sharecash survey bypasser, metho[...]
Found : user_pref("keyword.URL", "hxxps://isearch.avg.com/search?cid={123DB6E3-65D0-4739-BE8A-6F30961BFD49}&[...]

-\\ Google Chrome v22.0.1229.79

File : C:\Users\Janis\AppData\Local\Google\Chrome\User Data\Default\Preferences

Found [l.12] : homepage = "hxxps://isearch.avg.com/?cid={123DB6E3-65D0-4739-BE8A-6F30961BFD49}&mid=796bcf77900347d08b28d16a1c858f15-4dda9021002b6c4077fe60294b0ad61d9441fe9a&lang=en&ds=yu012&pr=sa&d=2012-08-14 15:54:10&v=12.1.0.20&sap=hp",
Found [l.1764] : homepage = "hxxps://isearch.avg.com/?cid={123DB6E3-65D0-4739-BE8A-6F30961BFD49}&mid=796bcf77900347d08b28d16a1c858f15-4dda9021002b6c4077fe60294b0ad61d9441fe9a&lang=en&ds=yu012&pr=sa&d=2012-08-14 15:54:10&v=12.1.0.20&sap=hp",

*************************

AdwCleaner[R1].txt - [20972 octets] - [04/10/2012 17:56:18]

########## EOF - C:\AdwCleaner[R1].txt - [21033 octets] ##########

Antwort
Seite 1 von 3 1 23

Themen zu selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc......
ahnung, appdata, automatisch, dateien, dateiname, download, einfach, erstellen, funktioniert, home, ide, laptop, leute, löschen, ordner, prozesse, screenshot, systemleistung, task manager, taskmanager, viren, virus, windows, windows 7, öffnen


« Falsche Abmahnung der E-Mail - Trojaner Win32:MalOb-KU | Habe einen Virus. Notebook ist gesperrt »


Ähnliche Themen: selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc......


  1. USB-Sticks zeigen Verknüpfung zu sich selbst statt Dateien an (Windows 7)
    Log-Analyse und Auswertung - 09.09.2015 (17)
  2. dll Dateien generieren sich von selbst
    Plagegeister aller Art und deren Bekämpfung - 27.03.2015 (10)
  3. Sich selbst öffnende (Werbe-)Webseiten, Startseiten-Änderung
    Log-Analyse und Auswertung - 21.06.2014 (12)
  4. Windows 8: Pop-up Fenster und sich selbst öffnende Tabs.
    Log-Analyse und Auswertung - 07.04.2014 (15)
  5. Fenster „Computer“ uvm. öffnen sich von selbst, Tastatur fällt aus oder führt andere Befehle aus!
    Plagegeister aller Art und deren Bekämpfung - 31.12.2013 (22)
  6. Windows 7: Komische Werbung bei Chrome und selbst öffnende Fenster nach Tune-Up Utilities Installation
    Plagegeister aller Art und deren Bekämpfung - 10.09.2013 (11)
  7. 2x AVAST-Funde selbst ausmerzen oder nicht
    Mülltonne - 11.06.2013 (4)
  8. Bundestrojaner oder GVU Trojaner, offnet sich selbst im abgesicherten Modus
    Log-Analyse und Auswertung - 10.04.2013 (2)
  9. Fenster deaktivieren oder minimieren sich von selbst
    Plagegeister aller Art und deren Bekämpfung - 02.08.2012 (2)
  10. Fenster minimieren sich nach kurzer Zeit von selbst oder werden in den Hintergrund gestellt
    Alles rund um Windows - 27.12.2011 (1)
  11. selbst öffnende ports + firefox lahmt
    Log-Analyse und Auswertung - 08.06.2011 (19)
  12. Dateien erstellen sich selbst - Rogue.Crusader
    Plagegeister aller Art und deren Bekämpfung - 08.07.2010 (1)
  13. Dateien erstellen sich selbst
    Plagegeister aller Art und deren Bekämpfung - 17.06.2010 (45)
  14. problem mit trojaner oder spyware (weiss leider selbst nicht genau =( )
    Log-Analyse und Auswertung - 31.05.2007 (19)
  15. Unbekannter Virus oder Trojaner der sich selbst verbreitet
    Plagegeister aller Art und deren Bekämpfung - 11.01.2007 (3)
  16. Windows XP DLL Dateien lösen sich dauernd von selbst auf!!!
    Alles rund um Windows - 20.04.2006 (9)
  17. HiJacker oder defekte Tastatur? --Fenster und Menüs scrollen von selbst...
    Log-Analyse und Auswertung - 22.01.2006 (3)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc...... - Hallo Leute, Ich habe nun seit längerer Zeit kleinere .exe Dateien auf meinem Laptop (Windows 7 Home Premium). Die Dateien sind nicht sehr groß. Lediglich rund 350 KB. Sie befinden - selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc.........
Archiv
Du betrachtest: selbst öffnende .exe Dateien wie z.B. E7AA.exe oder DE8C.exe etc...... auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131